{
  "type": "Domain",
  "indicator": "flyingcloudtech.link",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/flyingcloudtech.link",
    "alexa": "http://www.alexa.com/siteinfo/flyingcloudtech.link",
    "indicator": "flyingcloudtech.link",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3784699531,
      "indicator": "flyingcloudtech.link",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "658303b7e2b4417d9e24a7cc",
          "name": "Reddit Honeypot  | Cyber Defense Firm Attack",
          "description": "",
          "modified": "2024-01-19T12:02:13.495000",
          "created": "2023-12-20T15:09:43.783000",
          "tags": [
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha1",
            "sha256",
            "runtime process",
            "date",
            "unknown",
            "error",
            "path",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "accept",
            "url http",
            "filehashmd5",
            "url https",
            "search otx",
            "octoseek report",
            "spam author",
            "reddit",
            "tulach c2",
            "created",
            "minutes ago",
            "added active",
            "related pulses",
            "am",
            "no expiration",
            "indicator role",
            "pulses url",
            "showing",
            "entries",
            "dded active",
            "copyright",
            "reserved",
            "cve cve20170199",
            "win32 exe",
            "android",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "headers",
            "manager",
            "files",
            "detections type",
            "name",
            "lord krishna",
            "right",
            "tjprojmain",
            "windows",
            "secure",
            "headers nel",
            "ssl certificate",
            "whois whois",
            "historical ssl",
            "referrer",
            "logistics",
            "cyber defense",
            "firm collection",
            "ioc honeypot",
            "list for",
            "malware",
            "open",
            "attack",
            "contacted",
            "dropped",
            "bundled",
            "problems",
            "whois record",
            "domains",
            "execution",
            "agent tesla",
            "azorult",
            "project",
            "startpage",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "magic pe32",
            "installer",
            "compiler",
            "nsis",
            "serial number",
            "g4 code",
            "signing rsa4096",
            "sha384",
            "root g4",
            "valid from",
            "algorithm",
            "thumbprint",
            "fast corporate",
            "from",
            "pe resource",
            "collection",
            "vt graph",
            "paulsmith",
            "apple tv",
            "apple music",
            "$RTD4NQU.exe",
            "no data",
            "tag count",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "search",
            "iocs",
            "summary",
            "nisis",
            "executable",
            "ms windows",
            "trid win64",
            "generic",
            "sections",
            "sha256 file",
            "type type",
            "chi2",
            "dkey english",
            "xml rtmanifest",
            "english us",
            "overlay",
            "learn",
            "botnet",
            "honeypot",
            "ejkaej saBey k7-^Oa"
          ],
          "references": [
            "https://www.reddit.com/user/",
            "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
            "Gowi Live Bot.exe",
            "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
            "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
            "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
            "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
            "tv.apple.com [Apple Backdoor| Attack | Hacking]",
            "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
            "browser.events.data.msn.com | events-sandbox.data.msn.com",
            "https://tulach.cc/ [phishing attacks]",
            "tulach.cc [AM | phishing]",
            "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
            "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
            "3.163.189.120    [Tracking]",
            "86.140.232.148  [scanning_host]",
            "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
            "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
            "checkip.dyndns.org    [command_and_control]",
            "104.86.182.8          [command_and_control]",
            "103.224.182.253    [command_and_control]",
            "103.224.182.246    [command_and_control]",
            "www.supernetforme.com    [command_and_control]",
            "rp.downloadastrocdn.com   [command_and_control]",
            "ddos.dnsnb8.net   [command_and_control]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "AM",
              "display_name": "AM",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "adware.pcappstore/veryfast",
              "display_name": "adware.pcappstore/veryfast",
              "target": null
            },
            {
              "id": "NSIS",
              "display_name": "NSIS",
              "target": null
            },
            {
              "id": "Static AI - Malicious PE",
              "display_name": "Static AI - Malicious PE",
              "target": null
            },
            {
              "id": "HoneyPot",
              "display_name": "HoneyPot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 37,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 392,
            "FileHash-SHA1": 374,
            "FileHash-SHA256": 5560,
            "URL": 7433,
            "domain": 1461,
            "hostname": 2463,
            "CVE": 3,
            "email": 1
          },
          "indicator_count": 17687,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "821 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "655dafbe9ac9ac786fde45ad",
          "name": "http://malwaredomainlist.com/ \u2022 CNC \u2022 Spyware \u2022 Tracking",
          "description": "Network capture, dga domain, ecc domain, data collection, voicemail access, mail spammer, registrar abuse\n\n[Auto populated. I can't cannot confirm or deny the accuracy of the following information: A summary of key facts and information about a malicious web domain, hosted by the US government, has been released by Google.com and its parent company, Alphabet, for use on its website.]",
          "modified": "2023-12-22T06:03:01.993000",
          "created": "2023-11-22T07:37:34.595000",
          "tags": [
            "united",
            "as22612",
            "as2637",
            "creation date",
            "search",
            "moved",
            "expiration date",
            "date",
            "showing",
            "as397240",
            "next",
            "entries",
            "scan endpoints",
            "all octoseek",
            "dns replication",
            "win32 exe",
            "network capture",
            "android",
            "android adaway",
            "html",
            "files",
            "detections type",
            "name",
            "office open",
            "xml document",
            "namecheap",
            "namecheap inc",
            "whois lookups",
            "win32 dll",
            "text",
            "wextract",
            "text htaccess",
            "powershell",
            "detection list",
            "blacklist",
            "first",
            "ssl certificate",
            "whois record",
            "contacted",
            "december",
            "whois whois",
            "threat roundup",
            "historical ssl",
            "problems",
            "referrer",
            "pe resource",
            "startpage",
            "cyber threat",
            "redline stealer",
            "mail spammer",
            "hostname",
            "phishing site",
            "malicious site",
            "installcore",
            "http spammer",
            "malware site",
            "malware",
            "generic malware",
            "heur",
            "generic",
            "alexa top",
            "million",
            "site",
            "cisco umbrella",
            "alexa",
            "ip address",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cat cnzerossl",
            "ecc domain",
            "secure site",
            "ca ozerossl",
            "validity",
            "subject public",
            "server",
            "email",
            "code",
            "registrar abuse",
            "country",
            "privacy service",
            "withheld",
            "privacy",
            "domain name",
            "pattern match",
            "ascii text",
            "appdata",
            "file",
            "windows nt",
            "svg scalable",
            "vector graphics",
            "indicator",
            "gif image",
            "accept",
            "hybrid",
            "general",
            "local",
            "pixel",
            "click",
            "twitter",
            "strings",
            "class",
            "generator",
            "critical",
            "command_and_control",
            "spyware",
            "tracking",
            "voicemail access",
            "dga",
            "apple"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
            "\u2193Interesting\u2193",
            "IPv4 198.54.117.211 command_and_control",
            "IPv4 198.54.117.210 command_and_control",
            "IPv4 198.54.117.212 command_and_control",
            "IPv4 198.54.117.215 command_and_control",
            "IPv4 198.54.117.217 command_and_control",
            "IPv4 198.54.117.218 command_and_control",
            "apple-securityiphone-icloud.com",
            "tx-p2p-pull.video-voip.com.dorm.com",
            "http://updates.voicemailaccess.net/b0f6a00b15311023",
            "tvapp-server.de",
            "zeustracker.abuse.ch",
            "ransomwaretracker.abuse.ch",
            "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
            "louisianarooflawyers.com         [phishing]",
            "hasownproperty.call"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 105,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 3072,
            "domain": 1188,
            "email": 5,
            "URL": 7940,
            "hostname": 1925,
            "CVE": 1
          },
          "indicator_count": 14336,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "849 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "checkip.dyndns.org    [command_and_control]",
        "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
        "tulach.cc [AM | phishing]",
        "zeustracker.abuse.ch",
        "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
        "browser.events.data.msn.com | events-sandbox.data.msn.com",
        "86.140.232.148  [scanning_host]",
        "Gowi Live Bot.exe",
        "103.224.182.253    [command_and_control]",
        "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
        "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
        "louisianarooflawyers.com         [phishing]",
        "3.163.189.120    [Tracking]",
        "IPv4 198.54.117.211 command_and_control",
        "IPv4 198.54.117.218 command_and_control",
        "ddos.dnsnb8.net   [command_and_control]",
        "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
        "ransomwaretracker.abuse.ch",
        "rp.downloadastrocdn.com   [command_and_control]",
        "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
        "103.224.182.246    [command_and_control]",
        "tx-p2p-pull.video-voip.com.dorm.com",
        "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
        "IPv4 198.54.117.212 command_and_control",
        "IPv4 198.54.117.210 command_and_control",
        "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
        "apple-securityiphone-icloud.com",
        "https://tulach.cc/ [phishing attacks]",
        "www.supernetforme.com    [command_and_control]",
        "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
        "http://updates.voicemailaccess.net/b0f6a00b15311023",
        "tv.apple.com [Apple Backdoor| Attack | Hacking]",
        "https://www.reddit.com/user/",
        "104.86.182.8          [command_and_control]",
        "\u2193Interesting\u2193",
        "hasownproperty.call",
        "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
        "tvapp-server.de",
        "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
        "IPv4 198.54.117.215 command_and_control",
        "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
        "IPv4 198.54.117.217 command_and_control"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Generic",
            "Am",
            "Installcore",
            "Agent tesla",
            "Static ai - malicious pe",
            "Blacknet",
            "Tulach malware",
            "Adware.pcappstore/veryfast",
            "Nsis",
            "Honeypot",
            "Malware"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "658303b7e2b4417d9e24a7cc",
      "name": "Reddit Honeypot  | Cyber Defense Firm Attack",
      "description": "",
      "modified": "2024-01-19T12:02:13.495000",
      "created": "2023-12-20T15:09:43.783000",
      "tags": [
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha1",
        "sha256",
        "runtime process",
        "date",
        "unknown",
        "error",
        "path",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "accept",
        "url http",
        "filehashmd5",
        "url https",
        "search otx",
        "octoseek report",
        "spam author",
        "reddit",
        "tulach c2",
        "created",
        "minutes ago",
        "added active",
        "related pulses",
        "am",
        "no expiration",
        "indicator role",
        "pulses url",
        "showing",
        "entries",
        "dded active",
        "copyright",
        "reserved",
        "cve cve20170199",
        "win32 exe",
        "android",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "headers",
        "manager",
        "files",
        "detections type",
        "name",
        "lord krishna",
        "right",
        "tjprojmain",
        "windows",
        "secure",
        "headers nel",
        "ssl certificate",
        "whois whois",
        "historical ssl",
        "referrer",
        "logistics",
        "cyber defense",
        "firm collection",
        "ioc honeypot",
        "list for",
        "malware",
        "open",
        "attack",
        "contacted",
        "dropped",
        "bundled",
        "problems",
        "whois record",
        "domains",
        "execution",
        "agent tesla",
        "azorult",
        "project",
        "startpage",
        "vhash",
        "authentihash",
        "imphash",
        "rich pe",
        "ssdeep",
        "file type",
        "magic pe32",
        "installer",
        "compiler",
        "nsis",
        "serial number",
        "g4 code",
        "signing rsa4096",
        "sha384",
        "root g4",
        "valid from",
        "algorithm",
        "thumbprint",
        "fast corporate",
        "from",
        "pe resource",
        "collection",
        "vt graph",
        "paulsmith",
        "apple tv",
        "apple music",
        "$RTD4NQU.exe",
        "no data",
        "tag count",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "search",
        "iocs",
        "summary",
        "nisis",
        "executable",
        "ms windows",
        "trid win64",
        "generic",
        "sections",
        "sha256 file",
        "type type",
        "chi2",
        "dkey english",
        "xml rtmanifest",
        "english us",
        "overlay",
        "learn",
        "botnet",
        "honeypot",
        "ejkaej saBey k7-^Oa"
      ],
      "references": [
        "https://www.reddit.com/user/",
        "https://www.virustotal.com/gui/url/6a627ce5fd6be7b3c0b5637e6b1facfa92c279d25ff9b1f50fe131c91591d804/summary",
        "Gowi Live Bot.exe",
        "https://www.virustotal.com/gui/file/2ab9e32cd78f2b538c36f145b790f78f1262bcfcf1a5d6d019e7a2a151a24424/summary",
        "https://www.hybrid-analysis.com/sample/d4f0fd95f42482e96d982df3d538f67ee9c8756834486dd2cf33e1679c90af50/65812fd9a34bc52aac0b910f",
        "nr-data.net [New Relic Tracking | Apple Private Data Collection]",
        "[w and w.o https] applemusic-spotlight.myunidays.com [Multilingual Portable.exe Apple music compromise]",
        "tv.apple.com [Apple Backdoor| Attack | Hacking]",
        "name-playatoms-pa.googleapis.com [ nr-data Apple tv tracking]",
        "browser.events.data.msn.com | events-sandbox.data.msn.com",
        "https://tulach.cc/ [phishing attacks]",
        "tulach.cc [AM | phishing]",
        "$RTD4NQU.exe - Sigma Rule: Audit Policy Tampering Via Auditpolicy",
        "$RTD4NQU.exe - Yara rule: INDICATOR TOOL UAC NSISUAC",
        "3.163.189.120    [Tracking]",
        "86.140.232.148  [scanning_host]",
        "https://seedbeej.pk/tin/index.php?QBOT.zip. [ phishing plus]",
        "http://iyfsearch.com/&ap=67&be=203&fe=198&dc=198&perf=      [phishing]",
        "checkip.dyndns.org    [command_and_control]",
        "104.86.182.8          [command_and_control]",
        "103.224.182.253    [command_and_control]",
        "103.224.182.246    [command_and_control]",
        "www.supernetforme.com    [command_and_control]",
        "rp.downloadastrocdn.com   [command_and_control]",
        "ddos.dnsnb8.net   [command_and_control]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "AM",
          "display_name": "AM",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "adware.pcappstore/veryfast",
          "display_name": "adware.pcappstore/veryfast",
          "target": null
        },
        {
          "id": "NSIS",
          "display_name": "NSIS",
          "target": null
        },
        {
          "id": "Static AI - Malicious PE",
          "display_name": "Static AI - Malicious PE",
          "target": null
        },
        {
          "id": "HoneyPot",
          "display_name": "HoneyPot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 37,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 392,
        "FileHash-SHA1": 374,
        "FileHash-SHA256": 5560,
        "URL": 7433,
        "domain": 1461,
        "hostname": 2463,
        "CVE": 3,
        "email": 1
      },
      "indicator_count": 17687,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "821 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "655dafbe9ac9ac786fde45ad",
      "name": "http://malwaredomainlist.com/ \u2022 CNC \u2022 Spyware \u2022 Tracking",
      "description": "Network capture, dga domain, ecc domain, data collection, voicemail access, mail spammer, registrar abuse\n\n[Auto populated. I can't cannot confirm or deny the accuracy of the following information: A summary of key facts and information about a malicious web domain, hosted by the US government, has been released by Google.com and its parent company, Alphabet, for use on its website.]",
      "modified": "2023-12-22T06:03:01.993000",
      "created": "2023-11-22T07:37:34.595000",
      "tags": [
        "united",
        "as22612",
        "as2637",
        "creation date",
        "search",
        "moved",
        "expiration date",
        "date",
        "showing",
        "as397240",
        "next",
        "entries",
        "scan endpoints",
        "all octoseek",
        "dns replication",
        "win32 exe",
        "network capture",
        "android",
        "android adaway",
        "html",
        "files",
        "detections type",
        "name",
        "office open",
        "xml document",
        "namecheap",
        "namecheap inc",
        "whois lookups",
        "win32 dll",
        "text",
        "wextract",
        "text htaccess",
        "powershell",
        "detection list",
        "blacklist",
        "first",
        "ssl certificate",
        "whois record",
        "contacted",
        "december",
        "whois whois",
        "threat roundup",
        "historical ssl",
        "problems",
        "referrer",
        "pe resource",
        "startpage",
        "cyber threat",
        "redline stealer",
        "mail spammer",
        "hostname",
        "phishing site",
        "malicious site",
        "installcore",
        "http spammer",
        "malware site",
        "malware",
        "generic malware",
        "heur",
        "generic",
        "alexa top",
        "million",
        "site",
        "cisco umbrella",
        "alexa",
        "ip address",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cat cnzerossl",
        "ecc domain",
        "secure site",
        "ca ozerossl",
        "validity",
        "subject public",
        "server",
        "email",
        "code",
        "registrar abuse",
        "country",
        "privacy service",
        "withheld",
        "privacy",
        "domain name",
        "pattern match",
        "ascii text",
        "appdata",
        "file",
        "windows nt",
        "svg scalable",
        "vector graphics",
        "indicator",
        "gif image",
        "accept",
        "hybrid",
        "general",
        "local",
        "pixel",
        "click",
        "twitter",
        "strings",
        "class",
        "generator",
        "critical",
        "command_and_control",
        "spyware",
        "tracking",
        "voicemail access",
        "dga",
        "apple"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
        "\u2193Interesting\u2193",
        "IPv4 198.54.117.211 command_and_control",
        "IPv4 198.54.117.210 command_and_control",
        "IPv4 198.54.117.212 command_and_control",
        "IPv4 198.54.117.215 command_and_control",
        "IPv4 198.54.117.217 command_and_control",
        "IPv4 198.54.117.218 command_and_control",
        "apple-securityiphone-icloud.com",
        "tx-p2p-pull.video-voip.com.dorm.com",
        "http://updates.voicemailaccess.net/b0f6a00b15311023",
        "tvapp-server.de",
        "zeustracker.abuse.ch",
        "ransomwaretracker.abuse.ch",
        "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
        "louisianarooflawyers.com         [phishing]",
        "hasownproperty.call"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 105,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 3072,
        "domain": 1188,
        "email": 5,
        "URL": 7940,
        "hostname": 1925,
        "CVE": 1
      },
      "indicator_count": 14336,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "849 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "flyingcloudtech.link",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "flyingcloudtech.link",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776647596.5535076
}