{ "type": "Domain", "indicator": "financeht.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/financeht.com", "alexa": "http://www.alexa.com/siteinfo/financeht.com", "indicator": "financeht.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3624453901, "indicator": "financeht.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 50, "pulses": [ { "id": "64346babfbd170eba783cec6", "name": "CobaltStrikeC2s_1681156972", "description": "", "modified": "2023-05-10T20:00:32.823000", "created": "2023-04-10T20:03:55.705000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 17, "domain": 3 }, "indicator_count": 20, "is_author": false, "is_subscribing": null, "subscriber_count": 253, "modified_text": "1117 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6433fac756a7eae7f9add1d2", "name": "Cobalt Strike Servers & C2 | 04/03/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 04/03/2023.", "modified": "2023-05-10T00:05:09.736000", "created": "2023-04-10T12:02:14.989000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "1118 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "64331aa9fb67696d5a666638", "name": "CobaltStrikeC2s_1681070698", "description": "", "modified": "2023-05-09T20:03:48.235000", "created": "2023-04-09T20:06:01.447000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 18, "domain": 4 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1118 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6431cab032151a1cc1a72471", "name": "CobaltStrikeC2s_1680984688", "description": "", "modified": "2023-05-08T20:02:01.231000", "created": "2023-04-08T20:12:32.732000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 20 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1119 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64307973a483c94e725c1ff9", "name": "CobaltStrikeC2s_1680898356", "description": "", "modified": "2023-05-07T20:00:31.257000", "created": "2023-04-07T20:13:39.056000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 20, "domain": 4 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642f263ebb73cd5a0d4c94b2", "name": "CobaltStrikeC2s_1680811519", "description": "", "modified": "2023-05-06T20:00:44.385000", "created": "2023-04-06T20:06:22.779000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 21, "domain": 4 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1121 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642dd6779fe0dbcfad32645c", "name": "CobaltStrikeC2s_1680725560", "description": "", "modified": "2023-05-05T20:01:31.955000", "created": "2023-04-05T20:13:43.877000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 20, "domain": 4 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1122 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642c82d889ff983bb157f5dd", "name": "CobaltStrikeC2s_1680638618", "description": "", "modified": "2023-05-04T20:03:41.018000", "created": "2023-04-04T20:04:40.897000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 23 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1123 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6452be4c8859dd7b7a577652", "name": "CobaltStrikeC2s_1683144205", "description": "", "modified": "2023-05-03T20:04:28.409000", "created": "2023-05-03T20:04:28.409000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 121, "hostname": 18, "domain": 5 }, "indicator_count": 144, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1124 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642ac08bb29fde85b6ea899a", "name": "Cobalt Strike Servers & C2 | 03/27/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 03/27/2023.", "modified": "2023-05-03T00:02:19.100000", "created": "2023-04-03T12:03:23.007000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "1125 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6429e02b03a661c7d43c824a", "name": "CobaltStrikeC2s_1680465900", "description": "", "modified": "2023-05-02T20:00:08.869000", "created": "2023-04-02T20:06:03.686000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 24, "domain": 7 }, "indicator_count": 31, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1125 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64516b8747ec0bfa3e6dd7bf", "name": "CobaltStrikeC2s_1683057480", "description": "", "modified": "2023-05-02T19:59:03.207000", "created": "2023-05-02T19:59:03.207000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 119, "hostname": 18, "domain": 5 }, "indicator_count": 142, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1125 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64501ba3bf29ac5e952db119", "name": "CobaltStrikeC2s_1682971489", "description": "", "modified": "2023-05-01T20:05:54.231000", "created": "2023-05-01T20:05:54.231000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 115, "domain": 5, "hostname": 18 }, "indicator_count": 138, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1126 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64288ed6e277c8bba5bf2e1b", "name": "CobaltStrikeC2s_1680379544", "description": "", "modified": "2023-05-01T20:01:39.744000", "created": "2023-04-01T20:06:46.931000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7, "hostname": 23 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1126 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64273ecf941956022b97644d", "name": "CobaltStrikeC2s_1680293521", "description": "", "modified": "2023-04-30T20:04:50.010000", "created": "2023-03-31T20:13:03.896000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 22, "domain": 7 }, "indicator_count": 29, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1127 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644ec9617dcf8b230dd70ce9", "name": "CobaltStrikeC2s_1682884898", "description": "", "modified": "2023-04-30T20:02:41.188000", "created": "2023-04-30T20:02:41.188000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 114, "domain": 5, "hostname": 18 }, "indicator_count": 137, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1127 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6425ecb220a6c6a78579a0a9", "name": "CobaltStrikeC2s_1680206957", "description": "", "modified": "2023-04-29T20:02:33.795000", "created": "2023-03-30T20:10:26.358000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 22, "domain": 6 }, "indicator_count": 28, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1128 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64249ae3599f8757fe453c97", "name": "CobaltStrikeC2s_1680120484", "description": "", "modified": "2023-04-28T20:10:46.964000", "created": "2023-03-29T20:09:07.366000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 5, "hostname": 22 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1129 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644c28289108225fe1f4cdb1", "name": "CobaltStrikeC2s_1682712536", "description": "", "modified": "2023-04-28T20:10:16.923000", "created": "2023-04-28T20:10:16.923000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 119, "hostname": 18, "domain": 5 }, "indicator_count": 142, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1129 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "644ad74d35a03821a061a386", "name": "CobaltStrikeC2s_1682626312", "description": "", "modified": "2023-04-27T20:12:55.666000", "created": "2023-04-27T20:12:55.666000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 117, "hostname": 16, "domain": 5 }, "indicator_count": 138, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1130 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64234c2328a2a8d84cfde0ce", "name": "CobaltStrikeC2s_1680034784", "description": "", "modified": "2023-04-27T20:01:09.680000", "created": "2023-03-28T20:20:51.068000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 19, "domain": 4 }, "indicator_count": 23, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1130 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64498376adc23072214d3e10", "name": "CobaltStrikeC2s_1682539319", "description": "", "modified": "2023-04-26T20:03:02.761000", "created": "2023-04-26T20:03:02.761000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 109, "hostname": 15, "domain": 5 }, "indicator_count": 129, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1131 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6421f852abfce1a53a4eb869", "name": "CobaltStrikeC2s_1679947795", "description": "", "modified": "2023-04-26T20:02:30.271000", "created": "2023-03-27T20:10:58.523000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 22, "domain": 4 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1131 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642185ca96dbd4012b8922e2", "name": "Cobalt Strike Servers & C2 | 03/20/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 03/20/2023.", "modified": "2023-04-26T00:05:52.861000", "created": "2023-03-27T12:02:18.404000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "1132 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "644834eb639dfd839c5c64cf", "name": "CobaltStrikeC2s_1682453675", "description": "", "modified": "2023-04-25T20:15:38.797000", "created": "2023-04-25T20:15:38.797000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 109, "hostname": 17, "domain": 5 }, "indicator_count": 131, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1132 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6420a6ebe1e286efacae9d13", "name": "CobaltStrikeC2s_1679861420", "description": "", "modified": "2023-04-25T20:03:57.745000", "created": "2023-03-26T20:11:23.303000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 24 }, "indicator_count": 28, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1132 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641f5447d2b7c2472e263efb", "name": "CobaltStrikeC2s_1679774728", "description": "", "modified": "2023-04-24T20:00:13.793000", "created": "2023-03-25T20:06:31.310000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 24 }, "indicator_count": 28, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1133 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64458f2b8a4a73af2dec367a", "name": "CobaltStrikeC2s_1682280172", "description": "", "modified": "2023-04-23T20:03:55.854000", "created": "2023-04-23T20:03:55.854000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 94, "hostname": 14, "domain": 3 }, "indicator_count": 111, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1134 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641e0282fddad1f4cb1756b0", "name": "CobaltStrikeC2s_1679688258", "description": "", "modified": "2023-04-23T20:01:09.139000", "created": "2023-03-24T20:05:22.135000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 22, "domain": 4 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1134 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641cb1b5620c6552f3a361fa", "name": "CobaltStrikeC2s_1679602038", "description": "", "modified": "2023-04-22T20:03:13.882000", "created": "2023-03-23T20:08:21.501000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6, "hostname": 21 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1135 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64443d6c6284fb17ee1f49a5", "name": "CobaltStrikeC2s_1682193710", "description": "", "modified": "2023-04-22T20:02:52.822000", "created": "2023-04-22T20:02:52.822000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 99, "hostname": 13, "domain": 4 }, "indicator_count": 116, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1135 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6442eb90a9ed9aed632456fa", "name": "CobaltStrikeC2s_1682107217", "description": "", "modified": "2023-04-21T20:01:20.192000", "created": "2023-04-21T20:01:20.192000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 92, "domain": 4, "hostname": 15 }, "indicator_count": 111, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1136 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641b60932c79d8b56c32cccc", "name": "CobaltStrikeC2s_1679515732", "description": "", "modified": "2023-04-21T20:00:51.686000", "created": "2023-03-22T20:09:55.131000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 17, "domain": 5 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1136 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64419c7fabef8bfa141c6606", "name": "CobaltStrikeC2s_1682021438", "description": "", "modified": "2023-04-20T20:11:43.002000", "created": "2023-04-20T20:11:43.002000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 93, "domain": 4, "hostname": 22 }, "indicator_count": 119, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1137 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641a0d53ac16256d10e5f5a5", "name": "CobaltStrikeC2s_1679428884", "description": "", "modified": "2023-04-20T20:03:26.964000", "created": "2023-03-21T20:02:27.816000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 16, "domain": 6 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1137 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64404c4427a151c71929bb13", "name": "CobaltStrikeC2s_1681935366", "description": "", "modified": "2023-04-19T20:17:08.948000", "created": "2023-04-19T20:17:08.948000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 94, "hostname": 22, "domain": 4 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1138 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6418bb9506c871a65f0714f9", "name": "CobaltStrikeC2s_1679342421", "description": "", "modified": "2023-04-19T20:00:23.599000", "created": "2023-03-20T20:01:24.998000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6, "hostname": 21 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1138 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64184b5d8c3a603b343450ae", "name": "Cobalt Strike Servers & C2 | 03/13/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 03/13/2023.", "modified": "2023-04-19T00:02:20.271000", "created": "2023-03-20T12:02:37.636000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "1139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "643efa5bc6d73780a539f148", "name": "CobaltStrikeC2s_1681848860", "description": "", "modified": "2023-04-18T20:15:23.954000", "created": "2023-04-18T20:15:23.954000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 96, "hostname": 19, "domain": 5 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1139 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64176a0b939fc4d5ad1fbffc", "name": "CobaltStrikeC2s_1679256010", "description": "", "modified": "2023-04-18T20:03:52.877000", "created": "2023-03-19T20:01:15.158000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 6, "hostname": 24 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643da870e93b755fa425d9b1", "name": "CobaltStrikeC2s_1681762352", "description": "", "modified": "2023-04-17T20:13:35.927000", "created": "2023-04-17T20:13:35.927000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 89, "hostname": 21, "domain": 3 }, "indicator_count": 113, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1140 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641619c20d085d03b0b217eb", "name": "CobaltStrikeC2s_1679169923", "description": "", "modified": "2023-04-17T20:03:52.697000", "created": "2023-03-18T20:06:26.688000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 23, "domain": 6 }, "indicator_count": 29, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1140 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643d35360350825bffcd0cba", "name": "Cobalt Strike Servers & C2 | 04/10/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 04/10/2023.", "modified": "2023-04-17T12:01:58.821000", "created": "2023-04-17T12:01:58.821000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 820, "domain": 36, "hostname": 104 }, "indicator_count": 960, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "1141 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643c5400c3ed4e3643d3c740", "name": "CobaltStrikeC2s_1681675201", "description": "", "modified": "2023-04-16T20:01:04.371000", "created": "2023-04-16T20:01:04.371000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 95, "hostname": 20, "domain": 3 }, "indicator_count": 118, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1141 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6414c998485ff970efb05ee6", "name": "CobaltStrikeC2s_1679083865", "description": "", "modified": "2023-04-16T20:00:45.062000", "created": "2023-03-17T20:12:08.852000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 20, "domain": 4 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1141 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "643b044bd374a21a53d685fd", "name": "CobaltStrikeC2s_1681589260", "description": "", "modified": "2023-04-15T20:08:43.362000", "created": "2023-04-15T20:08:43.362000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 95, "hostname": 20, "domain": 3 }, "indicator_count": 118, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1142 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641375124a2e6d1ee808d6c5", "name": "CobaltStrikeC2s_1678996690", "description": "", "modified": "2023-04-15T19:03:07.257000", "created": "2023-03-16T19:59:14.121000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 25, "domain": 4 }, "indicator_count": 29, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1142 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6439b165b22a8846f8d0de38", "name": "CobaltStrikeC2s_1681502502", "description": "", "modified": "2023-04-14T20:02:45.394000", "created": "2023-04-14T20:02:45.394000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 91, "hostname": 20, "domain": 3 }, "indicator_count": 114, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1143 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641223396194cbf1c95287a7", "name": "CobaltStrikeC2s_1678910202", "description": "", "modified": "2023-04-14T19:01:01.946000", "created": "2023-03-15T19:57:45.634000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 22, "domain": 4 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1143 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64386174a7c323ed6021bcb7", "name": "CobaltStrikeC2s_1681416501", "description": "", "modified": "2023-04-13T20:09:24.733000", "created": "2023-04-13T20:09:24.733000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 95, "hostname": 20, "domain": 5 }, "indicator_count": 120, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1144 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Cobalt strike - s0154" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 50, "pulses": [ { "id": "64346babfbd170eba783cec6", "name": "CobaltStrikeC2s_1681156972", "description": "", "modified": "2023-05-10T20:00:32.823000", "created": "2023-04-10T20:03:55.705000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 17, "domain": 3 }, "indicator_count": 20, "is_author": false, "is_subscribing": null, "subscriber_count": 253, "modified_text": "1117 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6433fac756a7eae7f9add1d2", "name": "Cobalt Strike Servers & C2 | 04/03/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 04/03/2023.", "modified": "2023-05-10T00:05:09.736000", "created": "2023-04-10T12:02:14.989000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 28, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 233, "modified_text": "1118 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "64331aa9fb67696d5a666638", "name": "CobaltStrikeC2s_1681070698", "description": "", "modified": "2023-05-09T20:03:48.235000", "created": "2023-04-09T20:06:01.447000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 18, "domain": 4 }, "indicator_count": 22, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1118 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6431cab032151a1cc1a72471", "name": "CobaltStrikeC2s_1680984688", "description": "", "modified": "2023-05-08T20:02:01.231000", "created": "2023-04-08T20:12:32.732000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 20 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1119 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64307973a483c94e725c1ff9", "name": "CobaltStrikeC2s_1680898356", "description": "", "modified": "2023-05-07T20:00:31.257000", "created": "2023-04-07T20:13:39.056000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 20, "domain": 4 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1120 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642f263ebb73cd5a0d4c94b2", "name": "CobaltStrikeC2s_1680811519", "description": "", "modified": "2023-05-06T20:00:44.385000", "created": "2023-04-06T20:06:22.779000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 21, "domain": 4 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1121 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642dd6779fe0dbcfad32645c", "name": "CobaltStrikeC2s_1680725560", "description": "", "modified": "2023-05-05T20:01:31.955000", "created": "2023-04-05T20:13:43.877000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 20, "domain": 4 }, "indicator_count": 24, "is_author": false, "is_subscribing": null, "subscriber_count": 251, "modified_text": "1122 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642c82d889ff983bb157f5dd", "name": "CobaltStrikeC2s_1680638618", "description": "", "modified": "2023-05-04T20:03:41.018000", "created": "2023-04-04T20:04:40.897000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "hostname": 23 }, "indicator_count": 27, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1123 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6452be4c8859dd7b7a577652", "name": "CobaltStrikeC2s_1683144205", "description": "", "modified": "2023-05-03T20:04:28.409000", "created": "2023-05-03T20:04:28.409000", "tags": [ "cobaltstrike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cobaltstrikebot", "id": "161665", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_161665/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 121, "hostname": 18, "domain": 5 }, "indicator_count": 144, "is_author": false, "is_subscribing": null, "subscriber_count": 252, "modified_text": "1124 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "642ac08bb29fde85b6ea899a", "name": "Cobalt Strike Servers & C2 | 03/27/2023", "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 03/27/2023.", "modified": "2023-05-03T00:02:19.100000", "created": "2023-04-03T12:03:23.007000", "tags": [ "Cobalt Strike" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Cobalt Strike - S0154", "display_name": "Cobalt Strike - S0154", "target": null } ], "attack_ids": [ { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IronNetTR", "id": "135317", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 230, "modified_text": "1125 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "financeht.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "financeht.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780331611.5373044 }