{
  "type": "Domain",
  "indicator": "ddownload.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/ddownload.com",
    "alexa": "http://www.alexa.com/siteinfo/ddownload.com",
    "indicator": "ddownload.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2920217551,
      "indicator": "ddownload.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "68596260a9ca6c4cc92ca068",
          "name": "Delete service | Affects Threat Research Platforms",
          "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
          "modified": "2025-08-20T04:13:22.641000",
          "created": "2025-06-23T14:19:12.328000",
          "tags": [
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "oc0006",
            "get http",
            "resolved ips",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ip address",
            "country name",
            "cname",
            "port",
            "accept",
            "gmt ifnonematch",
            "url data",
            "icmp",
            "mutexes nothing",
            "data",
            "datacrashpad",
            "edge",
            "created",
            "nothing",
            "html internet",
            "html document",
            "ascii text",
            "gtmkvjvztk dl"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2401,
            "URL": 5856,
            "FileHash-SHA256": 3473,
            "domain": 2188,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 120,
            "CVE": 2
          },
          "indicator_count": 14163,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "287 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a00c4c0c0aa442282399",
          "name": "Free messages platform",
          "description": "",
          "modified": "2023-12-06T16:23:40.032000",
          "created": "2023-12-06T16:23:40.032000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 182,
            "domain": 574,
            "URL": 1697,
            "hostname": 504,
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1
          },
          "indicator_count": 2959,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "910 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a00933876ed78e19e1d9",
          "name": "Free messages platform",
          "description": "",
          "modified": "2023-12-06T16:23:37.114000",
          "created": "2023-12-06T16:23:37.114000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 162,
            "domain": 363,
            "URL": 879,
            "hostname": 375,
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1
          },
          "indicator_count": 1781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "910 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64de2fd6ca4420be476ba265",
          "name": "Free messages platform",
          "description": "ALF:Trojan:MSIL/AgentTesla.KM\nWin.Dropper.Agent-33289\nWin32:Malware-gen\nWin32:TrojanX-gen\\ [Trj]\nWorm:Win32/AutoRun!atmn\n\nAffected internet  instant messaging and VoIP social platform service,free voice and video chat service that enables users globally, to connect.",
          "modified": "2023-09-16T14:04:22.357000",
          "created": "2023-08-17T14:33:58.149000",
          "tags": [
            "as13335",
            "united",
            "aaaa",
            "passive dns",
            "win32",
            "search",
            "status hostname",
            "query type",
            "address first",
            "seen last",
            "worm",
            "next",
            "body",
            "seen asn",
            "country"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "domain": 363,
            "hostname": 375,
            "URL": 879,
            "FileHash-SHA256": 162
          },
          "indicator_count": 1781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "991 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64de2fd7d66d4e32a6853df3",
          "name": "Free messages platform",
          "description": "ALF:Trojan:MSIL/AgentTesla.KM\nWin.Dropper.Agent-33289\nWin32:Malware-gen\nWin32:TrojanX-gen\\ [Trj]\nWorm:Win32/AutoRun!atmn\n\nAffected internet  instant messaging and VoIP social platform service,free voice and video chat service that enables users globally, to connect.",
          "modified": "2023-09-16T14:04:22.357000",
          "created": "2023-08-17T14:33:59.605000",
          "tags": [
            "as13335",
            "united",
            "aaaa",
            "passive dns",
            "win32",
            "search",
            "status hostname",
            "query type",
            "address first",
            "seen last",
            "worm",
            "next",
            "body",
            "seen asn",
            "country"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "domain": 708,
            "hostname": 664,
            "URL": 1984,
            "FileHash-SHA256": 241
          },
          "indicator_count": 3599,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "991 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "68596260a9ca6c4cc92ca068",
      "name": "Delete service | Affects Threat Research Platforms",
      "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
      "modified": "2025-08-20T04:13:22.641000",
      "created": "2025-06-23T14:19:12.328000",
      "tags": [
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "oc0006",
        "get http",
        "resolved ips",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ip address",
        "country name",
        "cname",
        "port",
        "accept",
        "gmt ifnonematch",
        "url data",
        "icmp",
        "mutexes nothing",
        "data",
        "datacrashpad",
        "edge",
        "created",
        "nothing",
        "html internet",
        "html document",
        "ascii text",
        "gtmkvjvztk dl"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2401,
        "URL": 5856,
        "FileHash-SHA256": 3473,
        "domain": 2188,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 120,
        "CVE": 2
      },
      "indicator_count": 14163,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "287 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a00c4c0c0aa442282399",
      "name": "Free messages platform",
      "description": "",
      "modified": "2023-12-06T16:23:40.032000",
      "created": "2023-12-06T16:23:40.032000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 182,
        "domain": 574,
        "URL": 1697,
        "hostname": 504,
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1
      },
      "indicator_count": 2959,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "910 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a00933876ed78e19e1d9",
      "name": "Free messages platform",
      "description": "",
      "modified": "2023-12-06T16:23:37.114000",
      "created": "2023-12-06T16:23:37.114000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 162,
        "domain": 363,
        "URL": 879,
        "hostname": 375,
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1
      },
      "indicator_count": 1781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "910 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64de2fd6ca4420be476ba265",
      "name": "Free messages platform",
      "description": "ALF:Trojan:MSIL/AgentTesla.KM\nWin.Dropper.Agent-33289\nWin32:Malware-gen\nWin32:TrojanX-gen\\ [Trj]\nWorm:Win32/AutoRun!atmn\n\nAffected internet  instant messaging and VoIP social platform service,free voice and video chat service that enables users globally, to connect.",
      "modified": "2023-09-16T14:04:22.357000",
      "created": "2023-08-17T14:33:58.149000",
      "tags": [
        "as13335",
        "united",
        "aaaa",
        "passive dns",
        "win32",
        "search",
        "status hostname",
        "query type",
        "address first",
        "seen last",
        "worm",
        "next",
        "body",
        "seen asn",
        "country"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "domain": 363,
        "hostname": 375,
        "URL": 879,
        "FileHash-SHA256": 162
      },
      "indicator_count": 1781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "991 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64de2fd7d66d4e32a6853df3",
      "name": "Free messages platform",
      "description": "ALF:Trojan:MSIL/AgentTesla.KM\nWin.Dropper.Agent-33289\nWin32:Malware-gen\nWin32:TrojanX-gen\\ [Trj]\nWorm:Win32/AutoRun!atmn\n\nAffected internet  instant messaging and VoIP social platform service,free voice and video chat service that enables users globally, to connect.",
      "modified": "2023-09-16T14:04:22.357000",
      "created": "2023-08-17T14:33:59.605000",
      "tags": [
        "as13335",
        "united",
        "aaaa",
        "passive dns",
        "win32",
        "search",
        "status hostname",
        "query type",
        "address first",
        "seen last",
        "worm",
        "next",
        "body",
        "seen asn",
        "country"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "domain": 708,
        "hostname": 664,
        "URL": 1984,
        "FileHash-SHA256": 241
      },
      "indicator_count": 3599,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "991 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "ddownload.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "ddownload.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780518777.3710473
}