{ "type": "Domain", "indicator": "circleeducational.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/circleeducational.com", "alexa": "http://www.alexa.com/siteinfo/circleeducational.com", "indicator": "circleeducational.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3338837466, "indicator": "circleeducational.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "61ee7e8829b5ffe854076a41", "name": "Phish and Scamthreats", "description": "These domains have been checked and found to contain malware/phishing or other content on websites or in emails that is harmful to users and their data in our company.\nMost of the domains have been found sending spam/scam/phishing mails.\nThese domains/email have been blocked due to security risks.", "modified": "2023-08-15T17:52:09.703000", "created": "2022-01-24T10:25:12.684000", "tags": [ "email", "spam", "scam", "phishing", "europe" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Italy", "France", "Germany", "Austria" ], "malware_families": [ { "id": "", "display_name": "", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "p.lechner", "id": "177533", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_177533/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 549, "email": 50, "hostname": 66, "URL": 25 }, "indicator_count": 690, "is_author": false, "is_subscribing": null, "subscriber_count": 8, "modified_text": "1023 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a7261459933cde712b", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:27.524000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1437 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a874a16678d3b6bef0", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:28.111000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1437 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61b8627022c3e2fc021be93d", "name": "Webscanning Traffic", "description": "Indicators I'm coming across attempting to scan for new vulnerabilities", "modified": "2022-04-14T00:01:40.805000", "created": "2021-12-14T09:22:56.809000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Silius_Soddus", "id": "67731", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_67731/resized/80/avatar_51e2b48419.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 58, "domain": 157, "hostname": 6 }, "indicator_count": 221, "is_author": false, "is_subscribing": null, "subscriber_count": 74, "modified_text": "1511 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "622ae9b495a2a398b5cf87e9", "name": "Qakbot injects itself into the middle of your conversations", "description": "The emails can be jarring, but the technique used by Qakbot (aka Qbot) seems to be especially convincing: The email-borne malware has a tendency to spread itself around by inserting malicious replies into the middle of existing email conversations, using the compromised accounts of other infection victims. These interjections in the form of a reply-all message include a short sentence, and a link to download a zip file containing a malicious office document, one that brings down the malware when someone opens it.", "modified": "2022-04-10T00:02:49.890000", "created": "2022-03-11T06:18:28.811000", "tags": [ "qakbot", "trickbot", "dridex", "c2 server", "latin", "ip address", "msgtype", "urls", "excel", "explorer", "c2 address", "uptime", "qbot", "emotet", "cobalt strike", "facebook", "iocs", "public", "github", "sophoslabs", "jump", "strong", "sign", "c2 urls", "payload", "contact", "star" ], "references": [ "https://github.com/sophoslabs/IoCs/blob/master/Troj-Qakbot.csv", "https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Qakbot", "display_name": "Qakbot", "target": null }, { "id": "Dridex", "display_name": "Dridex", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "mohdrennis", "id": "138092", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 40, "URL": 178, "domain": 57 }, "indicator_count": 275, "is_author": false, "is_subscribing": null, "subscriber_count": 357, "modified_text": "1515 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "622b598bfa975e12e9b8c35e", "name": "Qakbot IOCs", "description": "The full text of the report on the EU referendum, which was held on 26 May 2016.. and the results will be published on 23 March 2017. \u00c2\u00a31.5m.", "modified": "2022-04-10T00:02:49.890000", "created": "2022-03-11T14:15:39.708000", "tags": [ "c2 address", "c2 urls", "payload", "malicious excel", "dll payload", "qakbot malware", "qakbot core", "email collector", "windows nt", "wow64", "zip file", "jjccbb", "hashes", "redirect urls", "download urls", "xlsb file", "excel4 macros", "call", "kernel32", "return" ], "references": [ "https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/", "https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-10%20Qakbot%20(AA)%20IOCs" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 31, "URL": 298, "domain": 62, "email": 28, "FileHash-SHA256": 40 }, "indicator_count": 459, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "1515 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-10%20Qakbot%20(AA)%20IOCs", "https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/", "Tasheel Finance IOCs.txt", "https://github.com/sophoslabs/IoCs/blob/master/Troj-Qakbot.csv" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "", "Trickbot", "Dridex", "Qakbot" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "61ee7e8829b5ffe854076a41", "name": "Phish and Scamthreats", "description": "These domains have been checked and found to contain malware/phishing or other content on websites or in emails that is harmful to users and their data in our company.\nMost of the domains have been found sending spam/scam/phishing mails.\nThese domains/email have been blocked due to security risks.", "modified": "2023-08-15T17:52:09.703000", "created": "2022-01-24T10:25:12.684000", "tags": [ "email", "spam", "scam", "phishing", "europe" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Italy", "France", "Germany", "Austria" ], "malware_families": [ { "id": "", "display_name": "", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "p.lechner", "id": "177533", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_177533/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 549, "email": 50, "hostname": 66, "URL": 25 }, "indicator_count": 690, "is_author": false, "is_subscribing": null, "subscriber_count": 8, "modified_text": "1023 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a7261459933cde712b", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:27.524000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1437 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629251a874a16678d3b6bef0", "name": "Tasheel IoC", "description": "", "modified": "2022-06-27T00:04:33.529000", "created": "2022-05-28T16:45:28.111000", "tags": [ "hxxp", "saudicareup" ], "references": [ "Tasheel Finance IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ucfs-otx", "id": "117946", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 685, "FileHash-MD5": 134, "FileHash-SHA1": 98, "FileHash-SHA256": 134, "domain": 183, "email": 11, "hostname": 769 }, "indicator_count": 2014, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1437 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61b8627022c3e2fc021be93d", "name": "Webscanning Traffic", "description": "Indicators I'm coming across attempting to scan for new vulnerabilities", "modified": "2022-04-14T00:01:40.805000", "created": "2021-12-14T09:22:56.809000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Silius_Soddus", "id": "67731", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_67731/resized/80/avatar_51e2b48419.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 58, "domain": 157, "hostname": 6 }, "indicator_count": 221, "is_author": false, "is_subscribing": null, "subscriber_count": 74, "modified_text": "1511 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "622ae9b495a2a398b5cf87e9", "name": "Qakbot injects itself into the middle of your conversations", "description": "The emails can be jarring, but the technique used by Qakbot (aka Qbot) seems to be especially convincing: The email-borne malware has a tendency to spread itself around by inserting malicious replies into the middle of existing email conversations, using the compromised accounts of other infection victims. These interjections in the form of a reply-all message include a short sentence, and a link to download a zip file containing a malicious office document, one that brings down the malware when someone opens it.", "modified": "2022-04-10T00:02:49.890000", "created": "2022-03-11T06:18:28.811000", "tags": [ "qakbot", "trickbot", "dridex", "c2 server", "latin", "ip address", "msgtype", "urls", "excel", "explorer", "c2 address", "uptime", "qbot", "emotet", "cobalt strike", "facebook", "iocs", "public", "github", "sophoslabs", "jump", "strong", "sign", "c2 urls", "payload", "contact", "star" ], "references": [ "https://github.com/sophoslabs/IoCs/blob/master/Troj-Qakbot.csv", "https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Qakbot", "display_name": "Qakbot", "target": null }, { "id": "Dridex", "display_name": "Dridex", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null } ], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "mohdrennis", "id": "138092", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 40, "URL": 178, "domain": 57 }, "indicator_count": 275, "is_author": false, "is_subscribing": null, "subscriber_count": 357, "modified_text": "1515 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "622b598bfa975e12e9b8c35e", "name": "Qakbot IOCs", "description": "The full text of the report on the EU referendum, which was held on 26 May 2016.. and the results will be published on 23 March 2017. \u00c2\u00a31.5m.", "modified": "2022-04-10T00:02:49.890000", "created": "2022-03-11T14:15:39.708000", "tags": [ "c2 address", "c2 urls", "payload", "malicious excel", "dll payload", "qakbot malware", "qakbot core", "email collector", "windows nt", "wow64", "zip file", "jjccbb", "hashes", "redirect urls", "download urls", "xlsb file", "excel4 macros", "call", "kernel32", "return" ], "references": [ "https://news.sophos.com/en-us/2022/03/10/qakbot-injects-itself-into-the-middle-of-your-conversations/", "https://github.com/executemalware/Malware-IOCs/blob/main/2022-03-10%20Qakbot%20(AA)%20IOCs" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "brazen.fox.thirteen", "id": "155136", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 31, "URL": 298, "domain": 62, "email": 28, "FileHash-SHA256": 40 }, "indicator_count": 459, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "1515 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "circleeducational.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "circleeducational.com", "found": true, "verdict": "malicious", "url_count": 3, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "http://circleeducational.com/pl/dq/y8/bxfwlmsy.zip", "status": "offline", "threat": "malware_download", "date_added": "2021-12-16", "tags": [ "ArkeiStealer", "Obama146", "Qakbot", "Quakbot", "zip" ] }, { "url": "http://circleeducational.com/pl/6kr/z44/45N/jJVQtzB.zip", "status": "offline", "threat": "malware_download", "date_added": "2021-12-15", "tags": [ "ArkeiStealer", "Qakbot", "Quakbot" ] }, { "url": "http://circleeducational.com/pl/bWqh1TDFlJ.zip", "status": "offline", "threat": "malware_download", "date_added": "2021-12-14", "tags": [ "ArkeiStealer", "Qakbot", "Quakbot" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780512062.3403664 }