{ "type": "Domain", "indicator": "captiorweb.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/captiorweb.com", "alexa": "http://www.alexa.com/siteinfo/captiorweb.com", "indicator": "captiorweb.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4183342115, "indicator": "captiorweb.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 12, "pulses": [ { "id": "69c081afa2bd54a9599b7c07", "name": "PhishDestroy \u2014 Active Phishing & Crypto Scam Domains", "description": "Real-time feed of phishing, crypto drainer, and scam domains detected by PhishDestroy (phishdestroy.io). Updated hourly. 108K+ domains tracked, 55K+ currently active. Source: github.com/phishdestroy/destroylist", "modified": "2026-05-24T00:00:03.049000", "created": "2026-03-22T23:56:29.438000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 93266, "hostname": 57600 }, "indicator_count": 150866, "is_author": false, "is_subscribing": null, "subscriber_count": 99, "modified_text": "7 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c08867316c564ade394c69", "name": "PhishDestroy \u2014 Content Active Threats (Live)", "description": "Live feed of phishing and crypto scam domains with ACTIVE malicious content from PhishDestroy. These domains are verified to have live phishing/scam pages. Updated hourly. Source: github.com/phishdestroy/destroylist/dns/content_active.json", "modified": "2026-05-21T12:06:19.702000", "created": "2026-03-23T00:25:09.116000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy", "active", "content" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 132502, "hostname": 66217 }, "indicator_count": 198719, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cb0ce73bef5c452bfb0", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:04.332000", "created": "2026-05-04T06:29:04.332000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83caf1bef3609f0eb79e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:03.120000", "created": "2026-05-04T06:29:03.120000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cac7d6c947de6c080f9", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:00.417000", "created": "2026-05-04T06:29:00.417000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab9769e92b3285a2b4", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.770000", "created": "2026-05-04T06:28:59.770000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab7e03b19c5f1078e3", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.113000", "created": "2026-05-04T06:28:59.113000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca9411c8ab5d294a7e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:57.479000", "created": "2026-05-04T06:28:57.479000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca77d6c947de6c080f8", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:55.093000", "created": "2026-05-04T06:28:55.093000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bbba3ed3b01bcf222ccc1d", "name": "EbeeMar2026 Pt3", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-04-18T08:06:12.483000", "created": "2026-03-19T08:56:30.058000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "yara" ], "references": [ "IOCs.2026.3.csv" ], "public": 1, "adversary": "ClipXDaemon, TENGU RANSOMWARE, A0Backdoor, GlassWorm, Operation CamelClone, VOID#GEIST", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 96, "CVE": 3, "FileHash-MD5": 93, "FileHash-SHA1": 101, "FileHash-SHA256": 153, "domain": 156, "email": 9 }, "indicator_count": 708, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "43 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b1a513f065525df442ae88", "name": "When Trusted Websites Turn Malicious: WordPress Compromises Advance Global Stealer Operation", "description": "The following in-depth analysis of the most commonly-used CAPTCHA - the code used to secure the registration of a person using a password - has been published: (AS 202412).", "modified": "2026-04-10T17:01:02.103000", "created": "2026-03-11T17:23:31.303000", "tags": [ "cybersecurity company", "managed detection and response", "exposure management", "managed security solutions", "vulnerability management", "exposure assessment platform", "vidar", "javascript", "iocs", "clickfix", "captcha", "rapid7", "wordpress", "vidar stealer", "impure stealer", "windows", "february", "stealc", "slovakia", "powershell", "twitter", "body", "polish", "turkish", "hungarian", "czech", "swedish", "loader", "python", "stealer", "rhadamanthys", "belarus", "exodus", "bitcoin", "sha256", "doubledonut", "vodkastealer", "htmlcss", "fake captcha", "html", "loader c2s", "must" ], "references": [ "https://www.rapid7.com/blog/post/tr-malicious-websites-wordpress-compromise-advances-global-stealer-operation/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1584.006", "name": "Web Services", "display_name": "T1584.006 - Web Services" }, { "id": "T1587", "name": "Develop Capabilities", "display_name": "T1587 - Develop Capabilities" }, { "id": "T1588.001", "name": "Malware", "display_name": "T1588.001 - Malware" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1608.004", "name": "Drive-by Target", "display_name": "T1608.004 - Drive-by Target" }, { "id": "T1189", "name": "Drive-by Compromise", "display_name": "T1189 - Drive-by Compromise" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1497.001", "name": "System Checks", "display_name": "T1497.001 - System Checks" }, { "id": "T1497.003", "name": "Time Based Evasion", "display_name": "T1497.003 - Time Based Evasion" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1552", "name": "Unsecured Credentials", "display_name": "T1552 - Unsecured Credentials" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1132.002", "name": "Non-Standard Encoding", "display_name": "T1132.002 - Non-Standard Encoding" }, { "id": "T1573.001", "name": "Symmetric Cryptography", "display_name": "T1573.001 - Symmetric Cryptography" }, { "id": "T1104", "name": "Multi-Stage Channels", "display_name": "T1104 - Multi-Stage Channels" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1571", "name": "Non-Standard Port", "display_name": "T1571 - Non-Standard Port" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 65, "domain": 47, "hostname": 23, "FileHash-MD5": 5, "FileHash-SHA1": 4, "FileHash-SHA256": 22 }, "indicator_count": 166, "is_author": false, "is_subscribing": null, "subscriber_count": 541, "modified_text": "50 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69782d96567a4b9cadf7e97b", "name": "Twitter Feed - CarlyGriggs13 - 26-01-2026", "description": "", "modified": "2026-01-27T03:14:30.735000", "created": "2026-01-27T03:14:30.735000", "tags": [ "scam" ], "references": [ "https://x.com/CarlyGriggs13/status/2015577495588729292", "https://x.com/CarlyGriggs13/status/2015582441591710103", "https://x.com/CarlyGriggs13/status/2015582577092964674", "https://x.com/CarlyGriggs13/status/2015582714854818084", "https://x.com/CarlyGriggs13/status/2015582851618439444", "https://x.com/CarlyGriggs13/status/2015582998201078147", "https://x.com/CarlyGriggs13/status/2015583144078889361", "https://x.com/CarlyGriggs13/status/2015583298022498325", "https://x.com/CarlyGriggs13/status/2015583434383520113", "https://x.com/CarlyGriggs13/status/2015583582228467875", "https://x.com/CarlyGriggs13/status/2015583724797051109", "https://x.com/CarlyGriggs13/status/2015583863129424183", "https://x.com/CarlyGriggs13/status/2015584005765091389", "https://x.com/CarlyGriggs13/status/2015584137638215890", "https://x.com/CarlyGriggs13/status/2015584285692944632", "https://x.com/CarlyGriggs13/status/2015584432246169939", "https://x.com/CarlyGriggs13/status/2015585323623780375", "https://x.com/CarlyGriggs13/status/2015586685652758656", "https://x.com/CarlyGriggs13/status/2015586820721893447", "https://x.com/CarlyGriggs13/status/2015586969682653211", "https://x.com/CarlyGriggs13/status/2015587118739775658", "https://x.com/CarlyGriggs13/status/2015587255910375883", "https://x.com/CarlyGriggs13/status/2015587397002576073", "https://x.com/CarlyGriggs13/status/2015587536349847660", "https://x.com/CarlyGriggs13/status/2015587668692705446", "https://x.com/CarlyGriggs13/status/2015587814524526749", "https://x.com/CarlyGriggs13/status/2015587969801781694", "https://x.com/CarlyGriggs13/status/2015588111632191590", "https://x.com/CarlyGriggs13/status/2015588257908597231", "https://x.com/CarlyGriggs13/status/2015588395045499079", "https://x.com/CarlyGriggs13/status/2015588530517377439", "https://x.com/CarlyGriggs13/status/2015588675388653998", "https://x.com/CarlyGriggs13/status/2015589396137771283", "https://x.com/CarlyGriggs13/status/2015591943485489313", "https://x.com/CarlyGriggs13/status/2015701254643609920", "https://x.com/CarlyGriggs13/status/2015701357018087646", "https://x.com/CarlyGriggs13/status/2015701439511724131", "https://x.com/CarlyGriggs13/status/2015701542058197274", "https://x.com/CarlyGriggs13/status/2015701652993441857", "https://x.com/CarlyGriggs13/status/2015701744123060588", "https://x.com/CarlyGriggs13/status/2015701856408736083", "https://x.com/CarlyGriggs13/status/2015701958175203578", "https://x.com/CarlyGriggs13/status/2015702057647267912", "https://x.com/CarlyGriggs13/status/2015702166707605556", "https://x.com/CarlyGriggs13/status/2015702269400891758", "https://x.com/CarlyGriggs13/status/2015702372006183271", "https://x.com/CarlyGriggs13/status/2015703459245216090", "https://x.com/CarlyGriggs13/status/2015705089701253182", "https://x.com/CarlyGriggs13/status/2015705709468352772", "https://x.com/CarlyGriggs13/status/2015705980596547695", "https://x.com/CarlyGriggs13/status/2015706091703672954", "https://x.com/CarlyGriggs13/status/2015706190844424606", "https://x.com/CarlyGriggs13/status/2015706302308057595", "https://x.com/CarlyGriggs13/status/2015706404313600392", "https://x.com/CarlyGriggs13/status/2015706514246275172", "https://x.com/CarlyGriggs13/status/2015706603136209060", "https://x.com/CarlyGriggs13/status/2015706698447487482", "https://x.com/CarlyGriggs13/status/2015706795897987254", "https://x.com/CarlyGriggs13/status/2015706886931193946", "https://x.com/CarlyGriggs13/status/2015706973392470086", "https://x.com/CarlyGriggs13/status/2015712574273159437", "https://x.com/CarlyGriggs13/status/2015728091000140048", "https://x.com/CarlyGriggs13/status/2015728245954519383", "https://x.com/CarlyGriggs13/status/2015728371821416726", "https://x.com/CarlyGriggs13/status/2015728507838513172", "https://x.com/CarlyGriggs13/status/2015728742379724853", "https://x.com/CarlyGriggs13/status/2015728867613237691", "https://x.com/CarlyGriggs13/status/2015728967261495792", "https://x.com/CarlyGriggs13/status/2015729328852471978", "https://x.com/CarlyGriggs13/status/2015730646476337556", "https://x.com/CarlyGriggs13/status/2015730750104956972", "https://x.com/CarlyGriggs13/status/2015730855285575904", "https://x.com/CarlyGriggs13/status/2015731198266356112", "https://x.com/CarlyGriggs13/status/2015734182392074336", "https://x.com/CarlyGriggs13/status/2015735358986596363", "https://x.com/CarlyGriggs13/status/2015735490956152882", "https://x.com/CarlyGriggs13/status/2015735788307099912", "https://x.com/CarlyGriggs13/status/2015735910667628628", "https://x.com/CarlyGriggs13/status/2015736053978615812", "https://x.com/CarlyGriggs13/status/2015736296174506066", "https://x.com/CarlyGriggs13/status/2015736458296889671", "https://x.com/CarlyGriggs13/status/2015736574420414806", "https://x.com/CarlyGriggs13/status/2015736806696788134", "https://x.com/CarlyGriggs13/status/2015736931926126962", "https://x.com/CarlyGriggs13/status/2015737049416917465", "https://x.com/CarlyGriggs13/status/2015737481031762356", "https://x.com/CarlyGriggs13/status/2015737610048614524", "https://x.com/CarlyGriggs13/status/2015738951844204809", "https://x.com/CarlyGriggs13/status/2015739106056151396", "https://x.com/CarlyGriggs13/status/2015739452807586097", "https://x.com/CarlyGriggs13/status/2015739587230863609", "https://x.com/CarlyGriggs13/status/2015739713882042859", "https://x.com/CarlyGriggs13/status/2015739996339085578", "https://x.com/CarlyGriggs13/status/2015740124139495575", "https://x.com/CarlyGriggs13/status/2015740255710728362", "https://x.com/CarlyGriggs13/status/2015740515891761356", "https://x.com/CarlyGriggs13/status/2015740656887418983", "https://x.com/CarlyGriggs13/status/2015740768611107173", "https://x.com/CarlyGriggs13/status/2015741000249954763", "https://x.com/CarlyGriggs13/status/2015741932643741734", "https://x.com/CarlyGriggs13/status/2015746229162910032", "https://x.com/CarlyGriggs13/status/2015751377616535776", "https://x.com/CarlyGriggs13/status/2015754413252530368", "https://x.com/CarlyGriggs13/status/2015757937193476175", "https://x.com/CarlyGriggs13/status/2015762016170815648", "https://x.com/CarlyGriggs13/status/2015763950546116891", "https://x.com/CarlyGriggs13/status/2015764077230923818", "https://x.com/CarlyGriggs13/status/2015764177785168374", "https://x.com/CarlyGriggs13/status/2015764499672760363", "https://x.com/CarlyGriggs13/status/2015764619965440420", "https://x.com/CarlyGriggs13/status/2015764715125833804", "https://x.com/CarlyGriggs13/status/2015765015983223137", "https://x.com/CarlyGriggs13/status/2015774902045774201", "https://x.com/CarlyGriggs13/status/2015779628632191254", "https://x.com/CarlyGriggs13/status/2015779747200934026", "https://x.com/CarlyGriggs13/status/2015779864188510606", "https://x.com/CarlyGriggs13/status/2015780131910869305", "https://x.com/CarlyGriggs13/status/2015780249162637411", "https://x.com/CarlyGriggs13/status/2015780355823767783", "https://x.com/CarlyGriggs13/status/2015780698255249622", "https://x.com/CarlyGriggs13/status/2015780812226961684", "https://x.com/CarlyGriggs13/status/2015781166670880961", "https://x.com/CarlyGriggs13/status/2015808146787238203", "https://x.com/CarlyGriggs13/status/2015808373250199736", "https://x.com/CarlyGriggs13/status/2015835179223224328", "https://x.com/CarlyGriggs13/status/2015846887186657296", "https://x.com/CarlyGriggs13/status/2015847019944792243", "https://x.com/CarlyGriggs13/status/2015847145207738731", "https://x.com/CarlyGriggs13/status/2015847578441490729", "https://x.com/CarlyGriggs13/status/2015847698679595250", "https://x.com/CarlyGriggs13/status/2015866361616986186", "https://x.com/CarlyGriggs13/status/2015866691641606571", "https://x.com/CarlyGriggs13/status/2015867093497868628", "https://x.com/CarlyGriggs13/status/2015867256966709658", "https://x.com/CarlyGriggs13/status/2015867425976156377", "https://x.com/CarlyGriggs13/status/2015867595564413185", "https://x.com/CarlyGriggs13/status/2015867807586542069", "https://x.com/CarlyGriggs13/status/2015867966802288919" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 32, "URL": 138, "domain": 106 }, "indicator_count": 276, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "124 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.rapid7.com/blog/post/tr-malicious-websites-wordpress-compromise-advances-global-stealer-operation/", "https://x.com/CarlyGriggs13/status/2015729328852471978", "https://x.com/CarlyGriggs13/status/2015739587230863609", "https://x.com/CarlyGriggs13/status/2015740515891761356", "https://x.com/CarlyGriggs13/status/2015587118739775658", "https://x.com/CarlyGriggs13/status/2015706795897987254", "https://x.com/CarlyGriggs13/status/2015780698255249622", "https://x.com/CarlyGriggs13/status/2015706091703672954", "https://x.com/CarlyGriggs13/status/2015739996339085578", "https://x.com/CarlyGriggs13/status/2015705980596547695", "https://x.com/CarlyGriggs13/status/2015846887186657296", "https://x.com/CarlyGriggs13/status/2015584432246169939", "https://x.com/CarlyGriggs13/status/2015737610048614524", "https://x.com/CarlyGriggs13/status/2015779747200934026", "https://x.com/CarlyGriggs13/status/2015706973392470086", "https://x.com/CarlyGriggs13/status/2015735358986596363", "https://x.com/CarlyGriggs13/status/2015762016170815648", "https://x.com/CarlyGriggs13/status/2015735910667628628", "https://x.com/CarlyGriggs13/status/2015706404313600392", "https://x.com/CarlyGriggs13/status/2015764715125833804", "https://x.com/CarlyGriggs13/status/2015587969801781694", "https://x.com/CarlyGriggs13/status/2015847698679595250", "https://x.com/CarlyGriggs13/status/2015706302308057595", "https://x.com/CarlyGriggs13/status/2015583582228467875", "https://x.com/CarlyGriggs13/status/2015588530517377439", "https://x.com/CarlyGriggs13/status/2015736931926126962", "https://x.com/CarlyGriggs13/status/2015741000249954763", "https://x.com/CarlyGriggs13/status/2015741932643741734", "https://x.com/CarlyGriggs13/status/2015702057647267912", "https://x.com/CarlyGriggs13/status/2015730855285575904", "https://x.com/CarlyGriggs13/status/2015736574420414806", "https://x.com/CarlyGriggs13/status/2015728867613237691", "https://x.com/CarlyGriggs13/status/2015736806696788134", "https://x.com/CarlyGriggs13/status/2015577495588729292", "https://x.com/CarlyGriggs13/status/2015587668692705446", "https://x.com/CarlyGriggs13/status/2015701958175203578", "https://x.com/CarlyGriggs13/status/2015584137638215890", "https://x.com/CarlyGriggs13/status/2015712574273159437", "https://x.com/CarlyGriggs13/status/2015701357018087646", "https://x.com/CarlyGriggs13/status/2015583144078889361", "https://x.com/CarlyGriggs13/status/2015740255710728362", "https://x.com/CarlyGriggs13/status/2015738951844204809", "https://x.com/CarlyGriggs13/status/2015764499672760363", "https://x.com/CarlyGriggs13/status/2015701744123060588", "https://x.com/CarlyGriggs13/status/2015867256966709658", "https://x.com/CarlyGriggs13/status/2015779864188510606", "https://x.com/CarlyGriggs13/status/2015706886931193946", "https://x.com/CarlyGriggs13/status/2015847019944792243", "https://x.com/CarlyGriggs13/status/2015582998201078147", "https://x.com/CarlyGriggs13/status/2015734182392074336", "https://x.com/CarlyGriggs13/status/2015701856408736083", "https://x.com/CarlyGriggs13/status/2015764177785168374", "https://x.com/CarlyGriggs13/status/2015730646476337556", "https://x.com/CarlyGriggs13/status/2015763950546116891", "https://x.com/CarlyGriggs13/status/2015702166707605556", "https://x.com/CarlyGriggs13/status/2015847145207738731", "https://x.com/CarlyGriggs13/status/2015582851618439444", "https://x.com/CarlyGriggs13/status/2015867425976156377", "https://x.com/CarlyGriggs13/status/2015835179223224328", "https://x.com/CarlyGriggs13/status/2015728507838513172", "https://x.com/CarlyGriggs13/status/2015728245954519383", "https://x.com/CarlyGriggs13/status/2015587536349847660", "https://x.com/CarlyGriggs13/status/2015780355823767783", "https://x.com/CarlyGriggs13/status/2015706190844424606", "https://x.com/CarlyGriggs13/status/2015728371821416726", "https://x.com/CarlyGriggs13/status/2015588111632191590", "https://x.com/CarlyGriggs13/status/2015764619965440420", "https://x.com/CarlyGriggs13/status/2015780249162637411", "https://x.com/CarlyGriggs13/status/2015702372006183271", "https://x.com/CarlyGriggs13/status/2015737481031762356", "https://x.com/CarlyGriggs13/status/2015774902045774201", "https://x.com/CarlyGriggs13/status/2015740124139495575", "https://x.com/CarlyGriggs13/status/2015587397002576073", "https://x.com/CarlyGriggs13/status/2015765015983223137", "https://x.com/CarlyGriggs13/status/2015583863129424183", "https://x.com/CarlyGriggs13/status/2015588395045499079", "https://x.com/CarlyGriggs13/status/2015866361616986186", "https://x.com/CarlyGriggs13/status/2015701542058197274", "https://x.com/CarlyGriggs13/status/2015583434383520113", "https://x.com/CarlyGriggs13/status/2015585323623780375", "https://x.com/CarlyGriggs13/status/2015736296174506066", "https://x.com/CarlyGriggs13/status/2015582577092964674", "https://x.com/CarlyGriggs13/status/2015808146787238203", "https://x.com/CarlyGriggs13/status/2015757937193476175", "https://x.com/CarlyGriggs13/status/2015701652993441857", "https://x.com/CarlyGriggs13/status/2015731198266356112", "https://x.com/CarlyGriggs13/status/2015866691641606571", "https://x.com/CarlyGriggs13/status/2015582714854818084", "https://x.com/CarlyGriggs13/status/2015706603136209060", "https://x.com/CarlyGriggs13/status/2015736458296889671", "https://x.com/CarlyGriggs13/status/2015728091000140048", "https://x.com/CarlyGriggs13/status/2015754413252530368", "https://x.com/CarlyGriggs13/status/2015751377616535776", "https://x.com/CarlyGriggs13/status/2015779628632191254", "https://x.com/CarlyGriggs13/status/2015867966802288919", "https://x.com/CarlyGriggs13/status/2015582441591710103", "https://x.com/CarlyGriggs13/status/2015737049416917465", "https://x.com/CarlyGriggs13/status/2015780131910869305", "https://x.com/CarlyGriggs13/status/2015867595564413185", "https://x.com/CarlyGriggs13/status/2015586820721893447", "https://x.com/CarlyGriggs13/status/2015780812226961684", "https://x.com/CarlyGriggs13/status/2015739713882042859", "https://x.com/CarlyGriggs13/status/2015701439511724131", "https://x.com/CarlyGriggs13/status/2015740768611107173", "https://x.com/CarlyGriggs13/status/2015703459245216090", "https://x.com/CarlyGriggs13/status/2015705709468352772", "https://x.com/CarlyGriggs13/status/2015736053978615812", "https://x.com/CarlyGriggs13/status/2015588257908597231", "https://x.com/CarlyGriggs13/status/2015706514246275172", "https://x.com/CarlyGriggs13/status/2015589396137771283", "https://x.com/CarlyGriggs13/status/2015706698447487482", "https://x.com/CarlyGriggs13/status/2015728967261495792", "https://x.com/CarlyGriggs13/status/2015586969682653211", "https://x.com/CarlyGriggs13/status/2015587255910375883", "https://x.com/CarlyGriggs13/status/2015705089701253182", "https://x.com/CarlyGriggs13/status/2015728742379724853", "https://x.com/CarlyGriggs13/status/2015588675388653998", "https://x.com/CarlyGriggs13/status/2015781166670880961", "https://x.com/CarlyGriggs13/status/2015739106056151396", "https://x.com/CarlyGriggs13/status/2015583724797051109", "https://x.com/CarlyGriggs13/status/2015591943485489313", "https://x.com/CarlyGriggs13/status/2015701254643609920", "https://x.com/CarlyGriggs13/status/2015730750104956972", "https://x.com/CarlyGriggs13/status/2015735788307099912", "https://x.com/CarlyGriggs13/status/2015735490956152882", "https://x.com/CarlyGriggs13/status/2015740656887418983", "https://x.com/CarlyGriggs13/status/2015583298022498325", "https://x.com/CarlyGriggs13/status/2015764077230923818", "https://x.com/CarlyGriggs13/status/2015847578441490729", "IOCs.2026.3.csv", "https://x.com/CarlyGriggs13/status/2015867807586542069", "https://x.com/CarlyGriggs13/status/2015867093497868628", "https://x.com/CarlyGriggs13/status/2015584005765091389", "https://x.com/CarlyGriggs13/status/2015586685652758656", "https://x.com/CarlyGriggs13/status/2015587814524526749", "https://x.com/CarlyGriggs13/status/2015808373250199736", "https://x.com/CarlyGriggs13/status/2015702269400891758", "https://x.com/CarlyGriggs13/status/2015584285692944632", "https://x.com/CarlyGriggs13/status/2015739452807586097", "https://x.com/CarlyGriggs13/status/2015746229162910032" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "ClipXDaemon, TENGU RANSOMWARE, A0Backdoor, GlassWorm, Operation CamelClone, VOID#GEIST" ], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 12, "pulses": [ { "id": "69c081afa2bd54a9599b7c07", "name": "PhishDestroy \u2014 Active Phishing & Crypto Scam Domains", "description": "Real-time feed of phishing, crypto drainer, and scam domains detected by PhishDestroy (phishdestroy.io). Updated hourly. 108K+ domains tracked, 55K+ currently active. Source: github.com/phishdestroy/destroylist", "modified": "2026-05-24T00:00:03.049000", "created": "2026-03-22T23:56:29.438000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 93266, "hostname": 57600 }, "indicator_count": 150866, "is_author": false, "is_subscribing": null, "subscriber_count": 99, "modified_text": "7 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c08867316c564ade394c69", "name": "PhishDestroy \u2014 Content Active Threats (Live)", "description": "Live feed of phishing and crypto scam domains with ACTIVE malicious content from PhishDestroy. These domains are verified to have live phishing/scam pages. Updated hourly. Source: github.com/phishdestroy/destroylist/dns/content_active.json", "modified": "2026-05-21T12:06:19.702000", "created": "2026-03-23T00:25:09.116000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy", "active", "content" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 132502, "hostname": 66217 }, "indicator_count": 198719, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "10 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cb0ce73bef5c452bfb0", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:04.332000", "created": "2026-05-04T06:29:04.332000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83caf1bef3609f0eb79e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:03.120000", "created": "2026-05-04T06:29:03.120000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cac7d6c947de6c080f9", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:29:00.417000", "created": "2026-05-04T06:29:00.417000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab9769e92b3285a2b4", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.770000", "created": "2026-05-04T06:28:59.770000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83cab7e03b19c5f1078e3", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:59.113000", "created": "2026-05-04T06:28:59.113000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca9411c8ab5d294a7e2", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:57.479000", "created": "2026-05-04T06:28:57.479000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f83ca77d6c947de6c080f8", "name": "Credit: PhishDestroy Clone [\"phish detroy- open domains\"]", "description": "", "modified": "2026-05-04T06:28:55.093000", "created": "2026-05-04T06:28:55.093000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "69c081afa2bd54a9599b7c07", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 88564, "hostname": 54516 }, "indicator_count": 143080, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bbba3ed3b01bcf222ccc1d", "name": "EbeeMar2026 Pt3", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-04-18T08:06:12.483000", "created": "2026-03-19T08:56:30.058000", "tags": [ "filehashsha256", "filehashmd5", "filehashsha1", "yara" ], "references": [ "IOCs.2026.3.csv" ], "public": 1, "adversary": "ClipXDaemon, TENGU RANSOMWARE, A0Backdoor, GlassWorm, Operation CamelClone, VOID#GEIST", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "URL": 96, "CVE": 3, "FileHash-MD5": 93, "FileHash-SHA1": 101, "FileHash-SHA256": 153, "domain": 156, "email": 9 }, "indicator_count": 708, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "43 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "captiorweb.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "captiorweb.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780236220.5074594 }