{ "type": "Domain", "indicator": "codeinecrazy.xyz", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/codeinecrazy.xyz", "alexa": "http://www.alexa.com/siteinfo/codeinecrazy.xyz", "indicator": "codeinecrazy.xyz", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4224725305, "indicator": "codeinecrazy.xyz", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "69f3785a17758b977e678e70", "name": "Botnet_C2 | May 1, 2026", "description": "Botnet_C2 indicators. Date: May 1, 2026. Total: 720 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-30T15:08:27.020000", "created": "2026-04-30T15:42:18.766000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 131, "URL": 136, "domain": 98 }, "indicator_count": 365, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "10 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f227149758c0da125208b5", "name": "Botnet_C2 | Apr 30, 2026", "description": "Botnet_C2 indicators. Date: Apr 30, 2026. Total: 702 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-29T15:30:19.711000", "created": "2026-04-29T15:43:16.686000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 145, "hostname": 125, "domain": 90 }, "indicator_count": 360, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f9fb15fe269b01c669a4fd", "name": "Botnet_C2 | May 6, 2026", "description": "Botnet_C2 indicators. Date: May 6, 2026. Total: 1125 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-05T14:13:41.596000", "created": "2026-05-05T14:13:41.596000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "URL": 150, "hostname": 165, "domain": 86 }, "indicator_count": 406, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f8a980a739c03f1bf1e92e", "name": "Botnet_C2 | May 5, 2026", "description": "Botnet_C2 indicators. Date: May 5, 2026. Total: 1060 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-04T14:13:20.351000", "created": "2026-05-04T14:13:20.351000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "domain": 73, "hostname": 160, "URL": 133 }, "indicator_count": 371, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f76e81612bd09f529876c0", "name": "Botnet_C2 | May 4, 2026", "description": "Botnet_C2 indicators. Date: May 4, 2026. Total: 1099 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-03T15:49:21.132000", "created": "2026-05-03T15:49:21.132000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "hostname": 154, "URL": 136, "domain": 82 }, "indicator_count": 377, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f61d10dd9cc819d9fe9779", "name": "Botnet_C2 | May 3, 2026", "description": "Botnet_C2 indicators. Date: May 3, 2026. Total: 1058 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-02T15:49:36.045000", "created": "2026-05-02T15:49:36.045000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "domain": 84, "hostname": 148, "URL": 136 }, "indicator_count": 373, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "28 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f5e9457c510da7d95e0e38", "name": "qwdqawdQA", "description": "A security alert has been issued by the European Commission (TI) over a TeamPCP-linked cyber-attack on the SAP cloud development ecosystem. and its associated systems, including its own database.", "modified": "2026-05-02T12:08:37.650000", "created": "2026-05-02T12:08:37.650000", "tags": [ "sap cloud", "advisory", "github", "apple mac", "os sap", "windows linux", "node packager", "manager", "github summary", "sap cap" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 2, "FileHash-MD5": 31, "FileHash-SHA1": 31, "FileHash-SHA256": 31, "domain": 6, "hostname": 1 }, "indicator_count": 102, "is_author": false, "is_subscribing": null, "subscriber_count": 16, "modified_text": "28 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f4cb76fe838834b6105356", "name": "Botnet_C2 | May 2, 2026", "description": "Botnet_C2 indicators. Date: May 2, 2026. Total: 992 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-01T15:49:10.769000", "created": "2026-05-01T15:49:10.769000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "URL": 146, "hostname": 139, "domain": 87 }, "indicator_count": 377, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "29 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a046863c1c92107079f81b", "name": "EbeeFeb2026 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-31T06:00:59.128000", "created": "2026-02-26T13:11:34.763000", "tags": [ "filehashsha1", "filehashsha256", "filehashmd5" ], "references": [ "IOCs.2026.csv" ], "public": 1, "adversary": "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 78, "FileHash-MD5": 191, "FileHash-SHA1": 220, "FileHash-SHA256": 192, "CVE": 2, "URL": 58, "domain": 220 }, "indicator_count": 961, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699a1b91987e3a07295248d9", "name": "\"Charity\" phishing: What we know about attacks using the Solana blockchain", "description": "In January 2026, the Expert Security Center's cyber intelligence team identified a series of attacks exploiting the Solana blockchain through malicious XLL files containing obfuscated JavaScript, deployed via phishing emails. The attack was initiated with a ZIP archive, which included a malicious payload disguised as a legitimate document. The malicious XLL file decodes a Base64-encoded PowerShell command upon execution, allowing the attackers to drop various harmful components onto the victim's system.", "modified": "2026-03-23T20:05:30.881000", "created": "2026-02-21T20:54:41.182000", "tags": [ "\u0431\u043b\u043e\u043a\u0447\u0435\u0439\u043d", "solana", "rat", "javascript", "powershell", "excel", "base64", "snsdomain", "http", "html", "positive", "intelligence", "service", "fusion" ], "references": [ "https://habr.com/ru/companies/pt/articles/1001196/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1021.004", "name": "SSH", "display_name": "T1021.004 - SSH" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 10, "URL": 1, "domain": 15 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 539, "modified_text": "68 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://habr.com/ru/companies/pt/articles/1001196/", "https://ltna.com.au/cyber", "IOCs.2026.csv" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo" ], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "69f3785a17758b977e678e70", "name": "Botnet_C2 | May 1, 2026", "description": "Botnet_C2 indicators. Date: May 1, 2026. Total: 720 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-30T15:08:27.020000", "created": "2026-04-30T15:42:18.766000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 131, "URL": 136, "domain": 98 }, "indicator_count": 365, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "10 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f227149758c0da125208b5", "name": "Botnet_C2 | Apr 30, 2026", "description": "Botnet_C2 indicators. Date: Apr 30, 2026. Total: 702 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-29T15:30:19.711000", "created": "2026-04-29T15:43:16.686000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 145, "hostname": 125, "domain": 90 }, "indicator_count": 360, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1 day ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f9fb15fe269b01c669a4fd", "name": "Botnet_C2 | May 6, 2026", "description": "Botnet_C2 indicators. Date: May 6, 2026. Total: 1125 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-05T14:13:41.596000", "created": "2026-05-05T14:13:41.596000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "URL": 150, "hostname": 165, "domain": 86 }, "indicator_count": 406, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f8a980a739c03f1bf1e92e", "name": "Botnet_C2 | May 5, 2026", "description": "Botnet_C2 indicators. Date: May 5, 2026. Total: 1060 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-04T14:13:20.351000", "created": "2026-05-04T14:13:20.351000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "domain": 73, "hostname": 160, "URL": 133 }, "indicator_count": 371, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "26 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f76e81612bd09f529876c0", "name": "Botnet_C2 | May 4, 2026", "description": "Botnet_C2 indicators. Date: May 4, 2026. Total: 1099 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-03T15:49:21.132000", "created": "2026-05-03T15:49:21.132000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "hostname": 154, "URL": 136, "domain": 82 }, "indicator_count": 377, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "27 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f61d10dd9cc819d9fe9779", "name": "Botnet_C2 | May 3, 2026", "description": "Botnet_C2 indicators. Date: May 3, 2026. Total: 1058 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-02T15:49:36.045000", "created": "2026-05-02T15:49:36.045000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "domain": 84, "hostname": 148, "URL": 136 }, "indicator_count": 373, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "28 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f5e9457c510da7d95e0e38", "name": "qwdqawdQA", "description": "A security alert has been issued by the European Commission (TI) over a TeamPCP-linked cyber-attack on the SAP cloud development ecosystem. and its associated systems, including its own database.", "modified": "2026-05-02T12:08:37.650000", "created": "2026-05-02T12:08:37.650000", "tags": [ "sap cloud", "advisory", "github", "apple mac", "os sap", "windows linux", "node packager", "manager", "github summary", "sap cap" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 2, "FileHash-MD5": 31, "FileHash-SHA1": 31, "FileHash-SHA256": 31, "domain": 6, "hostname": 1 }, "indicator_count": 102, "is_author": false, "is_subscribing": null, "subscriber_count": 16, "modified_text": "28 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69f4cb76fe838834b6105356", "name": "Botnet_C2 | May 2, 2026", "description": "Botnet_C2 indicators. Date: May 2, 2026. Total: 992 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-01T15:49:10.769000", "created": "2026-05-01T15:49:10.769000", "tags": [ "botnet_c2" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 5, "URL": 146, "hostname": 139, "domain": 87 }, "indicator_count": 377, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "29 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a046863c1c92107079f81b", "name": "EbeeFeb2026 Pt5", "description": "Multiple APT/threat actors, Malware and Campaigns", "modified": "2026-03-31T06:00:59.128000", "created": "2026-02-26T13:11:34.763000", "tags": [ "filehashsha1", "filehashsha256", "filehashmd5" ], "references": [ "IOCs.2026.csv" ], "public": 1, "adversary": "Contagious Interview Campaign, Triton fork campaign, CRESCENTHARVEST, MIMICRAT, Operation Olalampo", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 78, "FileHash-MD5": 191, "FileHash-SHA1": 220, "FileHash-SHA256": 192, "CVE": 2, "URL": 58, "domain": 220 }, "indicator_count": 961, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699a1b91987e3a07295248d9", "name": "\"Charity\" phishing: What we know about attacks using the Solana blockchain", "description": "In January 2026, the Expert Security Center's cyber intelligence team identified a series of attacks exploiting the Solana blockchain through malicious XLL files containing obfuscated JavaScript, deployed via phishing emails. The attack was initiated with a ZIP archive, which included a malicious payload disguised as a legitimate document. The malicious XLL file decodes a Base64-encoded PowerShell command upon execution, allowing the attackers to drop various harmful components onto the victim's system.", "modified": "2026-03-23T20:05:30.881000", "created": "2026-02-21T20:54:41.182000", "tags": [ "\u0431\u043b\u043e\u043a\u0447\u0435\u0439\u043d", "solana", "rat", "javascript", "powershell", "excel", "base64", "snsdomain", "http", "html", "positive", "intelligence", "service", "fusion" ], "references": [ "https://habr.com/ru/companies/pt/articles/1001196/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1021.004", "name": "SSH", "display_name": "T1021.004 - SSH" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 3, "FileHash-SHA256": 10, "URL": 1, "domain": 15 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 539, "modified_text": "68 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "codeinecrazy.xyz", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "codeinecrazy.xyz", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780191980.909382 }