{ "type": "Domain", "indicator": "com-view.online", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/com-view.online", "alexa": "http://www.alexa.com/siteinfo/com-view.online", "indicator": "com-view.online", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2793354399, "indicator": "com-view.online", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "646cf500357f2cf4f750e722", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit", "description": "North Korean APT group focuses on file reconnaissance and information exfiltration with latest variant of RandomQuery malware.", "modified": "2023-05-24T06:58:01.752000", "created": "2023-05-23T17:16:48.881000", "tags": [ "RandomQuery", "Kimusky" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimusky", "targeted_countries": [], "malware_families": [ { "id": "RandomQuery", "display_name": "RandomQuery", "target": null } ], "attack_ids": [ { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "TA0043", "name": "Reconnaissance", "display_name": "TA0043 - Reconnaissance" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [ "" ], "TLP": "green", "cloned_from": null, "export_count": 321, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 16, "FileHash-SHA1": 6 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 386761, "modified_text": "1104 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696ce9f08296f0375da8770", "name": "Kimsuky APT IOCs - Part 6 - SEC-1275-1", "description": "Search for Kimsuky - \u00c2\u00a31.5m - - on the website of SentinelLabs, a firm of security experts, iddo iawn ers.", "modified": "2024-07-16T19:48:47.291000", "created": "2024-07-16T19:48:47.291000", "tags": [ "kimsuky", "randomquery", "kimsuky apt", "iocs", "sentinellabs", "toggle", "sha1", "metador apt", "iocs wip19", "apt iocs", "\u0441\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "mirai" ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "display_name": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "685 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696ce9dd3f197cd3943ae47", "name": "Kimsuky APT IOCs - Part 6 - SEC-1275-1", "description": "Search for Kimsuky - \u00c2\u00a31.5m - - on the website of SentinelLabs, a firm of security experts, iddo iawn ers.", "modified": "2024-07-16T19:48:45.767000", "created": "2024-07-16T19:48:45.767000", "tags": [ "kimsuky", "randomquery", "kimsuky apt", "iocs", "sentinellabs", "toggle", "sha1", "metador apt", "iocs wip19", "apt iocs", "\u0441\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "mirai" ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "display_name": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "685 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696ce9da8d8d3dd8db87334", "name": "Kimsuky APT IOCs - Part 6 - SEC-1275-1", "description": "Search for Kimsuky - \u00c2\u00a31.5m - - on the website of SentinelLabs, a firm of security experts, iddo iawn ers.", "modified": "2024-07-16T19:48:45.610000", "created": "2024-07-16T19:48:45.610000", "tags": [ "kimsuky", "randomquery", "kimsuky apt", "iocs", "sentinellabs", "toggle", "sha1", "metador apt", "iocs wip19", "apt iocs", "\u0441\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "mirai" ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "display_name": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "685 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64886ada7313b886df588f8f", "name": "domains", "description": "domains", "modified": "2023-06-13T13:10:50.659000", "created": "2023-06-13T13:10:50.659000", "tags": [ "domain" ], "references": [ "entities (48).csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ASQ505sa", "id": "217420", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 23, "domain": 91 }, "indicator_count": 114, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "1084 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6475c4f9dcffb720e9c7a305", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit - SentinelOne", "description": "North Korea-focused information services, human rights activists and defectors in relation to North Korea are the target of an ongoing campaign by a suspected North Korean advanced persistent threat group, according to SentinelLabs.", "modified": "2023-05-30T09:42:17.761000", "created": "2023-05-30T09:42:17.761000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 1, "URL": 4, "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16, "hostname": 1 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1098 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646da7f9883651a5e83f6dc0", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit", "description": "", "modified": "2023-05-24T06:00:25.106000", "created": "2023-05-24T06:00:25.106000", "tags": [ "RandomQuery", "Kimusky" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimusky", "targeted_countries": [], "malware_families": [ { "id": "RandomQuery", "display_name": "RandomQuery", "target": null } ], "attack_ids": [ { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "TA0043", "name": "Reconnaissance", "display_name": "TA0043 - Reconnaissance" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [ "" ], "TLP": "green", "cloned_from": "646cf500357f2cf4f750e722", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 17, "FileHash-SHA1": 6 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "1104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646d16b7d2e09a9c95ce002b", "name": "North Korean Kimsuky Hackers Strike Again with Advanced Reconnaissance Malware", "description": "", "modified": "2023-05-23T19:40:39.576000", "created": "2023-05-23T19:40:39.576000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "cobalt strike", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": "646cda68d4a18bba1b9f8d81", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "feisty-swim1410", "id": "217462", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "URL": 2, "domain": 16, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "1105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646cda68d4a18bba1b9f8d81", "name": "North Korean Kimsuky Hackers Strike Again with Advanced Reconnaissance Malware", "description": "SentinelLabs recently observed an ongoing campaign carried out by Kimsuky, a North Korean APT group. The targets of this campaign include North Korea-focused information services, human rights activists, and organizations supporting DPRK defectors. The main objective of the campaign is to conduct file reconnaissance and exfiltrate information using a variant of the RandomQuery malware, which enables precise subsequent attacks.", "modified": "2023-05-23T18:19:07.029000", "created": "2023-05-23T15:23:20.299000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "cobalt strike", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": "646cce249bf18fc8eaf1395a", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Superpro", "id": "61676", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "URL": 2, "domain": 16, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 216, "modified_text": "1105 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646cef4da4c0cf0fe8f9ca2b", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit - SentinelOne", "description": "North Korea-focused information services, human rights activists and defectors in relation to North Korea are the target of an ongoing campaign by a suspected North Korean advanced persistent threat group, according to SentinelLabs.", "modified": "2023-05-23T16:52:29.514000", "created": "2023-05-23T16:52:29.514000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Cyber74Team", "id": "202637", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202637/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 5, "URL": 1, "domain": 16 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 164, "modified_text": "1105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646cce249bf18fc8eaf1395a", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit - SentinelOne", "description": "North Korea-focused information services, human rights activists and defectors in relation to North Korea are the target of an ongoing campaign by a suspected North Korean advanced persistent threat group, according to SentinelLabs.", "modified": "2023-05-23T14:31:00.774000", "created": "2023-05-23T14:31:00.774000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "cobalt strike", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Sand-Storm", "id": "94093", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_94093/resized/80/avatar_281f69b768.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "URL": 2, "domain": 16, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 415, "modified_text": "1105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/", "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/", "entities (48).csv" ], "related": { "alienvault": { "adversary": [ "Kimusky" ], "malware_families": [ "Randomquery" ], "industries": [ "" ] }, "other": { "adversary": [ "Kimusky", "Kimsuky" ], "malware_families": [ "Vbscript randomquery", "Randomquery", "Cobalt strike", "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "Mirai", "Kimsuky" ], "industries": [ "", "Human rights" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "646cf500357f2cf4f750e722", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit", "description": "North Korean APT group focuses on file reconnaissance and information exfiltration with latest variant of RandomQuery malware.", "modified": "2023-05-24T06:58:01.752000", "created": "2023-05-23T17:16:48.881000", "tags": [ "RandomQuery", "Kimusky" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimusky", "targeted_countries": [], "malware_families": [ { "id": "RandomQuery", "display_name": "RandomQuery", "target": null } ], "attack_ids": [ { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "TA0043", "name": "Reconnaissance", "display_name": "TA0043 - Reconnaissance" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [ "" ], "TLP": "green", "cloned_from": null, "export_count": 321, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 16, "FileHash-SHA1": 6 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 386761, "modified_text": "1104 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696ce9f08296f0375da8770", "name": "Kimsuky APT IOCs - Part 6 - SEC-1275-1", "description": "Search for Kimsuky - \u00c2\u00a31.5m - - on the website of SentinelLabs, a firm of security experts, iddo iawn ers.", "modified": "2024-07-16T19:48:47.291000", "created": "2024-07-16T19:48:47.291000", "tags": [ "kimsuky", "randomquery", "kimsuky apt", "iocs", "sentinellabs", "toggle", "sha1", "metador apt", "iocs wip19", "apt iocs", "\u0441\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "mirai" ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "display_name": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "685 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696ce9dd3f197cd3943ae47", "name": "Kimsuky APT IOCs - Part 6 - SEC-1275-1", "description": "Search for Kimsuky - \u00c2\u00a31.5m - - on the website of SentinelLabs, a firm of security experts, iddo iawn ers.", "modified": "2024-07-16T19:48:45.767000", "created": "2024-07-16T19:48:45.767000", "tags": [ "kimsuky", "randomquery", "kimsuky apt", "iocs", "sentinellabs", "toggle", "sha1", "metador apt", "iocs wip19", "apt iocs", "\u0441\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "mirai" ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "display_name": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "685 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696ce9da8d8d3dd8db87334", "name": "Kimsuky APT IOCs - Part 6 - SEC-1275-1", "description": "Search for Kimsuky - \u00c2\u00a31.5m - - on the website of SentinelLabs, a firm of security experts, iddo iawn ers.", "modified": "2024-07-16T19:48:45.610000", "created": "2024-07-16T19:48:45.610000", "tags": [ "kimsuky", "randomquery", "kimsuky apt", "iocs", "sentinellabs", "toggle", "sha1", "metador apt", "iocs wip19", "apt iocs", "\u0441\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u043a\u043e\u0440\u0435\u0438", "mirai" ], "references": [ "https://1275.ru/ioc/1986/kimsuky-apt-iocs-part-6/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "display_name": "\u0421\u0435\u0432\u0435\u0440\u043d\u043e\u0439 \u041a\u043e\u0440\u0435\u0438", "target": null }, { "id": "Mirai", "display_name": "Mirai", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16 }, "indicator_count": 32, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "685 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64886ada7313b886df588f8f", "name": "domains", "description": "domains", "modified": "2023-06-13T13:10:50.659000", "created": "2023-06-13T13:10:50.659000", "tags": [ "domain" ], "references": [ "entities (48).csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ASQ505sa", "id": "217420", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 23, "domain": 91 }, "indicator_count": 114, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "1084 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6475c4f9dcffb720e9c7a305", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit - SentinelOne", "description": "North Korea-focused information services, human rights activists and defectors in relation to North Korea are the target of an ongoing campaign by a suspected North Korean advanced persistent threat group, according to SentinelLabs.", "modified": "2023-05-30T09:42:17.761000", "created": "2023-05-30T09:42:17.761000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 1, "URL": 4, "FileHash-MD5": 5, "FileHash-SHA1": 6, "FileHash-SHA256": 5, "domain": 16, "hostname": 1 }, "indicator_count": 38, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1098 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646da7f9883651a5e83f6dc0", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit", "description": "", "modified": "2023-05-24T06:00:25.106000", "created": "2023-05-24T06:00:25.106000", "tags": [ "RandomQuery", "Kimusky" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimusky", "targeted_countries": [], "malware_families": [ { "id": "RandomQuery", "display_name": "RandomQuery", "target": null } ], "attack_ids": [ { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "TA0043", "name": "Reconnaissance", "display_name": "TA0043 - Reconnaissance" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [ "" ], "TLP": "green", "cloned_from": "646cf500357f2cf4f750e722", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 17, "FileHash-SHA1": 6 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "1104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646d16b7d2e09a9c95ce002b", "name": "North Korean Kimsuky Hackers Strike Again with Advanced Reconnaissance Malware", "description": "", "modified": "2023-05-23T19:40:39.576000", "created": "2023-05-23T19:40:39.576000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "cobalt strike", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": "646cda68d4a18bba1b9f8d81", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "feisty-swim1410", "id": "217462", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "URL": 2, "domain": 16, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "1105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646cda68d4a18bba1b9f8d81", "name": "North Korean Kimsuky Hackers Strike Again with Advanced Reconnaissance Malware", "description": "SentinelLabs recently observed an ongoing campaign carried out by Kimsuky, a North Korean APT group. The targets of this campaign include North Korea-focused information services, human rights activists, and organizations supporting DPRK defectors. The main objective of the campaign is to conduct file reconnaissance and exfiltrate information using a variant of the RandomQuery malware, which enables precise subsequent attacks.", "modified": "2023-05-23T18:19:07.029000", "created": "2023-05-23T15:23:20.299000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "cobalt strike", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": "646cce249bf18fc8eaf1395a", "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Superpro", "id": "61676", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 6, "URL": 2, "domain": 16, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 216, "modified_text": "1105 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "646cef4da4c0cf0fe8f9ca2b", "name": "Kimsuky | Ongoing Campaign Using Tailored Reconnaissance Toolkit - SentinelOne", "description": "North Korea-focused information services, human rights activists and defectors in relation to North Korea are the target of an ongoing campaign by a suspected North Korean advanced persistent threat group, according to SentinelLabs.", "modified": "2023-05-23T16:52:29.514000", "created": "2023-05-23T16:52:29.514000", "tags": [ "kimsuky", "randomquery", "vbscript randomquery", "tlds", "north korea", "korean", "vb script", "chm file", "userprofile", "c2 server", "program files", "daum", "desktop" ], "references": [ "https://www.sentinelone.com/labs/kimsuky-ongoing-campaign-using-tailored-reconnaissance-toolkit/" ], "public": 1, "adversary": "Kimsuky", "targeted_countries": [ "Korea, Democratic People's Republic of" ], "malware_families": [ { "id": "VBScript RandomQuery", "display_name": "VBScript RandomQuery", "target": null }, { "id": "RandomQuery", "display_name": "RandomQuery", "target": null }, { "id": "Kimsuky", "display_name": "Kimsuky", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [ "Human Rights" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Cyber74Team", "id": "202637", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202637/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 5, "URL": 1, "domain": 16 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 164, "modified_text": "1105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "com-view.online", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "com-view.online", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780351495.7830331 }