{
  "type": "Domain",
  "indicator": "datmo.vn",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/datmo.vn",
    "alexa": "http://www.alexa.com/siteinfo/datmo.vn",
    "indicator": "datmo.vn",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2259371719,
      "indicator": "datmo.vn",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69b02c952ff0220b3d0baf13",
          "name": "Phishing | Mar 11, 2026 | Part 126/776",
          "description": "Phishing indicators. Date: Mar 11, 2026. Part 126/776. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-03-10T14:37:09.485000",
          "created": "2026-03-10T14:37:09.485000",
          "tags": [
            "phishing"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 731,
            "hostname": 1269
          },
          "indicator_count": 2000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "83 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "684a3719a2708183b1b16d00",
          "name": "Follow Bot (black-basta_cova_cryptb) affects threat researcher(s)account(s)",
          "description": "Surprised: \nFollow bot account  affects threat researcher(s)account(s). % path , attempts DoS. Threatening account name,. \n\n\n(00285c99b52d41679b1aa3b8a80895b037df8a7500f4ad97ce06068eac4a95b7 | =\nfollow) \n|| {2025-05-20_bf3a6ba6e3421a7214ffbfe97642a578_amadey_black-basta_cova_cryptbot_elex_luca-stealer\nFastCopy5.9.0.exe}\n\nET DNS Query for .cc \n PROTOCOL-ICMP PATH MTU denial of service attempt\nPROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set",
          "modified": "2025-07-12T01:02:11.925000",
          "created": "2025-06-12T02:10:33.839000",
          "tags": [
            "gtmkvjvztk",
            "open threat",
            "learn",
            "levelblue",
            "exchange meta",
            "tags twitter",
            "alienvault",
            "script tags",
            "iframe tags",
            "google tag",
            "html internet",
            "html document",
            "ascii text",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "number",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "cus subject",
            "stwa lredmond",
            "omicrosoft c",
            "resolved ips",
            "get http",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "defense evasion",
            "ta0009 command",
            "impact ta0040",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "ob0007 impact",
            "ob0012 file",
            "system oc0001",
            "process oc0003",
            "data oc0004",
            "oc0008",
            "get https",
            "vis1",
            "oid2",
            "post https",
            "cjutxg",
            "base64uidenc",
            "error https"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 162,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2459,
            "domain": 889,
            "hostname": 1217,
            "URL": 4326,
            "FilePath": 1
          },
          "indicator_count": 9082,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "324 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6507e71385d966429fb82783",
          "name": "NEW Phishing Links Discovered 2023-09-18",
          "description": "",
          "modified": "2023-10-18T05:00:18.068000",
          "created": "2023-09-18T05:58:43.467000",
          "tags": [
            "sign",
            "search",
            "github",
            "strong",
            "code issues",
            "pull",
            "browse",
            "sast",
            "skip",
            "product actions",
            "star",
            "footer"
          ],
          "references": [
            "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/8862c986106a380915d200280a11f93030152568/phishing-domains-ACTIVE.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "akhanafeer",
            "id": "195327",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 33,
            "FileHash-SHA1": 1,
            "URL": 1,
            "domain": 50140,
            "hostname": 7669
          },
          "indicator_count": 57844,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 81,
          "modified_text": "957 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://ltna.com.au/cyber",
        "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/8862c986106a380915d200280a11f93030152568/phishing-domains-ACTIVE.txt"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69b02c952ff0220b3d0baf13",
      "name": "Phishing | Mar 11, 2026 | Part 126/776",
      "description": "Phishing indicators. Date: Mar 11, 2026. Part 126/776. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-03-10T14:37:09.485000",
      "created": "2026-03-10T14:37:09.485000",
      "tags": [
        "phishing"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 731,
        "hostname": 1269
      },
      "indicator_count": 2000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 91,
      "modified_text": "83 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "684a3719a2708183b1b16d00",
      "name": "Follow Bot (black-basta_cova_cryptb) affects threat researcher(s)account(s)",
      "description": "Surprised: \nFollow bot account  affects threat researcher(s)account(s). % path , attempts DoS. Threatening account name,. \n\n\n(00285c99b52d41679b1aa3b8a80895b037df8a7500f4ad97ce06068eac4a95b7 | =\nfollow) \n|| {2025-05-20_bf3a6ba6e3421a7214ffbfe97642a578_amadey_black-basta_cova_cryptbot_elex_luca-stealer\nFastCopy5.9.0.exe}\n\nET DNS Query for .cc \n PROTOCOL-ICMP PATH MTU denial of service attempt\nPROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set",
      "modified": "2025-07-12T01:02:11.925000",
      "created": "2025-06-12T02:10:33.839000",
      "tags": [
        "gtmkvjvztk",
        "open threat",
        "learn",
        "levelblue",
        "exchange meta",
        "tags twitter",
        "alienvault",
        "script tags",
        "iframe tags",
        "google tag",
        "html internet",
        "html document",
        "ascii text",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "number",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "cus subject",
        "stwa lredmond",
        "omicrosoft c",
        "resolved ips",
        "get http",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "defense evasion",
        "ta0009 command",
        "impact ta0040",
        "catalog tree",
        "analysis ob0001",
        "analysis ob0002",
        "ob0007 impact",
        "ob0012 file",
        "system oc0001",
        "process oc0003",
        "data oc0004",
        "oc0008",
        "get https",
        "vis1",
        "oid2",
        "post https",
        "cjutxg",
        "base64uidenc",
        "error https"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 162,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 2459,
        "domain": 889,
        "hostname": 1217,
        "URL": 4326,
        "FilePath": 1
      },
      "indicator_count": 9082,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "324 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6507e71385d966429fb82783",
      "name": "NEW Phishing Links Discovered 2023-09-18",
      "description": "",
      "modified": "2023-10-18T05:00:18.068000",
      "created": "2023-09-18T05:58:43.467000",
      "tags": [
        "sign",
        "search",
        "github",
        "strong",
        "code issues",
        "pull",
        "browse",
        "sast",
        "skip",
        "product actions",
        "star",
        "footer"
      ],
      "references": [
        "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/8862c986106a380915d200280a11f93030152568/phishing-domains-ACTIVE.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "akhanafeer",
        "id": "195327",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 33,
        "FileHash-SHA1": 1,
        "URL": 1,
        "domain": 50140,
        "hostname": 7669
      },
      "indicator_count": 57844,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 81,
      "modified_text": "957 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "datmo.vn",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "datmo.vn",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780337051.1355941
}