{ "type": "Domain", "indicator": "centralizebd.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/centralizebd.com", "alexa": "http://www.alexa.com/siteinfo/centralizebd.com", "indicator": "centralizebd.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3889526502, "indicator": "centralizebd.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "6783308fc0b6e2bd8dfb209c", "name": "TTC-CERT_blocklist_recommended", "description": "", "modified": "2026-02-14T00:03:07.406000", "created": "2025-01-12T03:01:35.075000", "tags": [], "references": [ "https://github.com/ttc-cert/TTC-CERT_blocklist_recommended/blob/master/domain_blocklist_recommended.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 606, "URL": 4, "domain": 25122, "hostname": 25306 }, "indicator_count": 51038, "is_author": false, "is_subscribing": null, "subscriber_count": 187, "modified_text": "108 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67ba1e9e40c225f7da92e169", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "A look at some of the key details about the latest cyber-espionage tools to be targeted by Earth Hundun, as well as the names of those who have been tracking them on social media.", "modified": "2025-02-22T18:59:42.408000", "created": "2025-02-22T18:59:42.408000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network", "cyberespionage" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cyberespionage", "display_name": "Cyberespionage", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Armature_TIP", "id": "308911", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_308911/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "464 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664b09751bb2fb046587f903", "name": "Hackers Use Two-Stage Approach with Deuterbear RAT", "description": "A complete list of key data for the 21st Century cyber-security research project, published by the International Institute of Strategic Studies (IISS), has been released. and will be released on 20 May 2024", "modified": "2024-06-19T08:02:40.726000", "created": "2024-05-20T08:27:33.489000", "tags": [ "cyber", "threat", "time", "crypto cyber", "defence", "domains" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 13, "domain": 14, "hostname": 1 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 500, "modified_text": "713 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664eff5df79f99501f2d34e7", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "", "modified": "2024-05-23T08:33:33.365000", "created": "2024-05-23T08:33:33.365000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Waterbear - S0579", "display_name": "Waterbear - S0579", "target": null }, { "id": "Deuterbear", "display_name": "Deuterbear", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "664865e4baff5646ab78f497", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "740 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664865e4baff5646ab78f497", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "", "modified": "2024-05-18T08:25:08.105000", "created": "2024-05-18T08:25:08.105000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Waterbear - S0579", "display_name": "Waterbear - S0579", "target": null }, { "id": "Deuterbear", "display_name": "Deuterbear", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "664788a185b05055c3318928", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "745 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664788a185b05055c3318928", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "In our previous report, we introduced the sophisticated cyberespionage campaign orchestrated by Earth Hundun, a threat actor known for targeting the Asia-Pacific region using the Waterbear malware and its latest iteration, Deuterbear. We first observed Deuterbear being used by Earth Hundun in October 2022, and it has since been part of the group\u2019s subsequent campaigns.", "modified": "2024-05-17T16:41:05.081000", "created": "2024-05-17T16:41:05.081000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Waterbear - S0579", "display_name": "Waterbear - S0579", "target": null }, { "id": "Deuterbear", "display_name": "Deuterbear", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AustinBH", "id": "147442", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 59, "modified_text": "745 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://github.com/ttc-cert/TTC-CERT_blocklist_recommended/blob/master/domain_blocklist_recommended.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Cyberespionage", "Deuterbear", "Waterbear - s0579" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "6783308fc0b6e2bd8dfb209c", "name": "TTC-CERT_blocklist_recommended", "description": "", "modified": "2026-02-14T00:03:07.406000", "created": "2025-01-12T03:01:35.075000", "tags": [], "references": [ "https://github.com/ttc-cert/TTC-CERT_blocklist_recommended/blob/master/domain_blocklist_recommended.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 606, "URL": 4, "domain": 25122, "hostname": 25306 }, "indicator_count": 51038, "is_author": false, "is_subscribing": null, "subscriber_count": 187, "modified_text": "108 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67ba1e9e40c225f7da92e169", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "A look at some of the key details about the latest cyber-espionage tools to be targeted by Earth Hundun, as well as the names of those who have been tracking them on social media.", "modified": "2025-02-22T18:59:42.408000", "created": "2025-02-22T18:59:42.408000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network", "cyberespionage" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cyberespionage", "display_name": "Cyberespionage", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Armature_TIP", "id": "308911", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_308911/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "464 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664b09751bb2fb046587f903", "name": "Hackers Use Two-Stage Approach with Deuterbear RAT", "description": "A complete list of key data for the 21st Century cyber-security research project, published by the International Institute of Strategic Studies (IISS), has been released. and will be released on 20 May 2024", "modified": "2024-06-19T08:02:40.726000", "created": "2024-05-20T08:27:33.489000", "tags": [ "cyber", "threat", "time", "crypto cyber", "defence", "domains" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 13, "domain": 14, "hostname": 1 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 500, "modified_text": "713 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664eff5df79f99501f2d34e7", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "", "modified": "2024-05-23T08:33:33.365000", "created": "2024-05-23T08:33:33.365000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Waterbear - S0579", "display_name": "Waterbear - S0579", "target": null }, { "id": "Deuterbear", "display_name": "Deuterbear", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "664865e4baff5646ab78f497", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "740 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664865e4baff5646ab78f497", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "", "modified": "2024-05-18T08:25:08.105000", "created": "2024-05-18T08:25:08.105000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Waterbear - S0579", "display_name": "Waterbear - S0579", "target": null }, { "id": "Deuterbear", "display_name": "Deuterbear", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "664788a185b05055c3318928", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "745 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "664788a185b05055c3318928", "name": "Tracking the Progression of Earth Hundun's Cyberespionage Campaign in 2024", "description": "In our previous report, we introduced the sophisticated cyberespionage campaign orchestrated by Earth Hundun, a threat actor known for targeting the Asia-Pacific region using the Waterbear malware and its latest iteration, Deuterbear. We first observed Deuterbear being used by Earth Hundun in October 2022, and it has since been part of the group\u2019s subsequent campaigns.", "modified": "2024-05-17T16:41:05.081000", "created": "2024-05-17T16:41:05.081000", "tags": [ "progression", "earth hundun", "file", "sha256", "detection", "network" ], "references": [ "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/e/tracking-the-progression-of-earth-hundun-cyberespionage-campaign-/ioc-tracking-the-progression-of-earth-hundun-cyberespionage-campaign-in-2024.txt", "https://www.trendmicro.com/en_us/research/24/e/earth-hundun-2.html", "https://www.trendmicro.com/en_ph/research/24/d/earth-hundun-waterbear-deuterbear.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Waterbear - S0579", "display_name": "Waterbear - S0579", "target": null }, { "id": "Deuterbear", "display_name": "Deuterbear", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AustinBH", "id": "147442", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 8, "domain": 14 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 59, "modified_text": "745 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "centralizebd.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "centralizebd.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780405874.1118786 }