{
  "type": "Domain",
  "indicator": "flsunpasspayhere.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/flsunpasspayhere.com",
    "alexa": "http://www.alexa.com/siteinfo/flsunpasspayhere.com",
    "indicator": "flsunpasspayhere.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3990732289,
      "indicator": "flsunpasspayhere.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6708da9cc69403936ffada62",
          "name": "\"Don't feed the toll troll\": New threat actor (IMP-1G) engaging in SMS phishing activities, targeting US and Canadian public services. 100+ IOFA domains discovered, with only 10% known to authorities.",
          "description": "A new threat actor, designated as IMP-1G, has been discovered engaging in SMS phishing activities targeting US and Canadian public services. The campaign focuses on toll roads, mass transit systems, postal services, court payments, municipal payments, and state-owned utility companies across multiple states and provinces. Over 100 Indicator of Future Attack (IOFA) domains have been identified, with only 10% known to authorities. The phishing domains impersonate government payment portals to steal credit card information and personal data. The threat actor also targets financial institutions and cryptocurrency users with similar tactics. Law enforcement agencies have seized some domains, but the majority remain active.",
          "modified": "2024-11-10T07:01:48.644000",
          "created": "2024-10-11T07:58:20.812000",
          "tags": [
            "public utilities",
            "government services",
            "toll fraud",
            "iofa domains",
            "sms phishing",
            "identity theft",
            "smishing"
          ],
          "references": [
            "https://www.silentpush.com/blog/imp-1g-smishing/"
          ],
          "public": 1,
          "adversary": "IMP-1G",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1608.004",
              "name": "Drive-by Target",
              "display_name": "T1608.004 - Drive-by Target"
            },
            {
              "id": "T1608.001",
              "name": "Upload Malware",
              "display_name": "T1608.001 - Upload Malware"
            },
            {
              "id": "T1589",
              "name": "Gather Victim Identity Information",
              "display_name": "T1589 - Gather Victim Identity Information"
            },
            {
              "id": "T1584",
              "name": "Compromise Infrastructure",
              "display_name": "T1584 - Compromise Infrastructure"
            },
            {
              "id": "T1586",
              "name": "Compromise Accounts",
              "display_name": "T1586 - Compromise Accounts"
            },
            {
              "id": "T1608.005",
              "name": "Link Target",
              "display_name": "T1608.005 - Link Target"
            },
            {
              "id": "T1585",
              "name": "Establish Accounts",
              "display_name": "T1585 - Establish Accounts"
            },
            {
              "id": "T1566.003",
              "name": "Spearphishing via Service",
              "display_name": "T1566.003 - Spearphishing via Service"
            }
          ],
          "industries": [
            "Government",
            "Transportation",
            "Energy",
            "Finance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 67,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 76
          },
          "indicator_count": 76,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386900,
          "modified_text": "569 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67429f73a3f45fa88890276d",
          "name": "StreamMining",
          "description": "",
          "modified": "2024-11-24T03:37:23.616000",
          "created": "2024-11-24T03:37:23.616000",
          "tags": [
            "eliminar",
            "leer ms",
            "wishlist vista",
            "poltica",
            "secadores",
            "vista",
            "sala",
            "vaporal",
            "utensilios",
            "belleza equipos",
            "ciudad"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "670f94e03014212e19fa5a77",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "rivocado",
            "id": "300960",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "URL": 170,
            "domain": 11158,
            "hostname": 3549
          },
          "indicator_count": 14883,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 25,
          "modified_text": "555 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67429f7224d433f384b935c8",
          "name": "StreamMining",
          "description": "",
          "modified": "2024-11-24T03:37:22.551000",
          "created": "2024-11-24T03:37:22.551000",
          "tags": [
            "eliminar",
            "leer ms",
            "wishlist vista",
            "poltica",
            "secadores",
            "vista",
            "sala",
            "vaporal",
            "utensilios",
            "belleza equipos",
            "ciudad"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "670f94e03014212e19fa5a77",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "rivocado",
            "id": "300960",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "URL": 170,
            "domain": 11158,
            "hostname": 3549
          },
          "indicator_count": 14883,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 20,
          "modified_text": "555 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "670f94e03014212e19fa5a77",
          "name": "Malicious-Dangerous-Domain&URL-New-IOC List",
          "description": "By Helaly",
          "modified": "2024-11-15T10:01:11.688000",
          "created": "2024-10-16T10:26:40.893000",
          "tags": [
            "eliminar",
            "leer ms",
            "wishlist vista",
            "poltica",
            "secadores",
            "vista",
            "sala",
            "vaporal",
            "utensilios",
            "belleza equipos",
            "ciudad"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 39659,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Eslam-ElHelaly",
            "id": "259630",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "URL": 170,
            "domain": 11158,
            "hostname": 3549
          },
          "indicator_count": 14883,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 80,
          "modified_text": "564 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.silentpush.com/blog/imp-1g-smishing/"
      ],
      "related": {
        "alienvault": {
          "adversary": [
            "IMP-1G"
          ],
          "malware_families": [],
          "industries": [
            "Transportation",
            "Energy",
            "Government",
            "Finance"
          ]
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6708da9cc69403936ffada62",
      "name": "\"Don't feed the toll troll\": New threat actor (IMP-1G) engaging in SMS phishing activities, targeting US and Canadian public services. 100+ IOFA domains discovered, with only 10% known to authorities.",
      "description": "A new threat actor, designated as IMP-1G, has been discovered engaging in SMS phishing activities targeting US and Canadian public services. The campaign focuses on toll roads, mass transit systems, postal services, court payments, municipal payments, and state-owned utility companies across multiple states and provinces. Over 100 Indicator of Future Attack (IOFA) domains have been identified, with only 10% known to authorities. The phishing domains impersonate government payment portals to steal credit card information and personal data. The threat actor also targets financial institutions and cryptocurrency users with similar tactics. Law enforcement agencies have seized some domains, but the majority remain active.",
      "modified": "2024-11-10T07:01:48.644000",
      "created": "2024-10-11T07:58:20.812000",
      "tags": [
        "public utilities",
        "government services",
        "toll fraud",
        "iofa domains",
        "sms phishing",
        "identity theft",
        "smishing"
      ],
      "references": [
        "https://www.silentpush.com/blog/imp-1g-smishing/"
      ],
      "public": 1,
      "adversary": "IMP-1G",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1608.004",
          "name": "Drive-by Target",
          "display_name": "T1608.004 - Drive-by Target"
        },
        {
          "id": "T1608.001",
          "name": "Upload Malware",
          "display_name": "T1608.001 - Upload Malware"
        },
        {
          "id": "T1589",
          "name": "Gather Victim Identity Information",
          "display_name": "T1589 - Gather Victim Identity Information"
        },
        {
          "id": "T1584",
          "name": "Compromise Infrastructure",
          "display_name": "T1584 - Compromise Infrastructure"
        },
        {
          "id": "T1586",
          "name": "Compromise Accounts",
          "display_name": "T1586 - Compromise Accounts"
        },
        {
          "id": "T1608.005",
          "name": "Link Target",
          "display_name": "T1608.005 - Link Target"
        },
        {
          "id": "T1585",
          "name": "Establish Accounts",
          "display_name": "T1585 - Establish Accounts"
        },
        {
          "id": "T1566.003",
          "name": "Spearphishing via Service",
          "display_name": "T1566.003 - Spearphishing via Service"
        }
      ],
      "industries": [
        "Government",
        "Transportation",
        "Energy",
        "Finance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 67,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 76
      },
      "indicator_count": 76,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386900,
      "modified_text": "569 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67429f73a3f45fa88890276d",
      "name": "StreamMining",
      "description": "",
      "modified": "2024-11-24T03:37:23.616000",
      "created": "2024-11-24T03:37:23.616000",
      "tags": [
        "eliminar",
        "leer ms",
        "wishlist vista",
        "poltica",
        "secadores",
        "vista",
        "sala",
        "vaporal",
        "utensilios",
        "belleza equipos",
        "ciudad"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "670f94e03014212e19fa5a77",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "rivocado",
        "id": "300960",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "URL": 170,
        "domain": 11158,
        "hostname": 3549
      },
      "indicator_count": 14883,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 25,
      "modified_text": "555 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67429f7224d433f384b935c8",
      "name": "StreamMining",
      "description": "",
      "modified": "2024-11-24T03:37:22.551000",
      "created": "2024-11-24T03:37:22.551000",
      "tags": [
        "eliminar",
        "leer ms",
        "wishlist vista",
        "poltica",
        "secadores",
        "vista",
        "sala",
        "vaporal",
        "utensilios",
        "belleza equipos",
        "ciudad"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "670f94e03014212e19fa5a77",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "rivocado",
        "id": "300960",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "URL": 170,
        "domain": 11158,
        "hostname": 3549
      },
      "indicator_count": 14883,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 20,
      "modified_text": "555 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "670f94e03014212e19fa5a77",
      "name": "Malicious-Dangerous-Domain&URL-New-IOC List",
      "description": "By Helaly",
      "modified": "2024-11-15T10:01:11.688000",
      "created": "2024-10-16T10:26:40.893000",
      "tags": [
        "eliminar",
        "leer ms",
        "wishlist vista",
        "poltica",
        "secadores",
        "vista",
        "sala",
        "vaporal",
        "utensilios",
        "belleza equipos",
        "ciudad"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 39659,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Eslam-ElHelaly",
        "id": "259630",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "URL": 170,
        "domain": 11158,
        "hostname": 3549
      },
      "indicator_count": 14883,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 80,
      "modified_text": "564 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "flsunpasspayhere.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "flsunpasspayhere.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780411764.8207517
}