{ "type": "Domain", "indicator": "fontsgstatic.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/fontsgstatic.com", "alexa": "http://www.alexa.com/siteinfo/fontsgstatic.com", "indicator": "fontsgstatic.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2936105120, "indicator": "fontsgstatic.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 7, "pulses": [ { "id": "60afd2d5ce95a296d0f9323e", "name": "MobileInter: Magecart Skimmer for your phone", "description": "A new modified version of Inter\u2014the precursor to MobileInter\u2014was first reported in March 2020. Since then, Magecart operators have altered it even more. MobileInter, first reported in April 2021, focuses solely on mobile users and targets login credentials and payment data. \nThe first iteration of MobileInter downloaded exfil URLs hidden in images from GitHub repositories. In contrast, this new MobileInter contains the exfiltration URLs within the skimmer code itself and uses WebSockets for data exfil. Hiding its code by injecting it into images on the compromised websites is yet another new wrinkle added by operators.\n\nMobileInter also disguises itself and its infrastructure, leaning heavily on Google to do so. It hides as Google tracking services, uses domains that mimic Google, and abuses Google IPs.", "modified": "2021-05-27T17:11:49.194000", "created": "2021-05-27T17:11:49.194000", "tags": [ "magecart", "mobileinter", "inter skimmer", "skimmer" ], "references": [ "https://www.riskiq.com/blog/external-threat-management/mobile-inter/" ], "public": 1, "adversary": "Magecart", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 247, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "email": 1, "domain": 39, "hostname": 3, "FileHash-MD5": 4, "FileHash-SHA256": 1, "FileHash-SHA1": 1 }, "indicator_count": 49, "is_author": false, "is_subscribing": null, "subscriber_count": 386500, "modified_text": "1829 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a0d760557004620f409f", "name": "Kelowna Mental Health", "description": "", "modified": "2023-12-06T16:27:03.467000", "created": "2023-12-06T16:27:03.467000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 715, "CVE": 20, "FileHash-MD5": 8943, "FileHash-SHA256": 37374, "FileHash-SHA1": 8939, "JA3": 11, "domain": 497, "URL": 408, "email": 38, "FilePath": 1 }, "indicator_count": 56946, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64e9896df7ea5c41750e6aac", "name": "Kelowna Mental Health", "description": "", "modified": "2023-10-14T00:01:59.166000", "created": "2023-08-26T05:11:09.863000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 785, "domain": 550, "email": 38, "URL": 511, "CVE": 21, "FileHash-MD5": 15725, "FileHash-SHA1": 15719, "FileHash-SHA256": 67914, "JA3": 11, "FilePath": 1 }, "indicator_count": 101275, "is_author": false, "is_subscribing": null, "subscriber_count": 88, "modified_text": "960 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62cbdddd1fc2e2956bfacda5", "name": "vvvvv", "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.", "modified": "2022-08-10T00:00:07.214000", "created": "2022-07-11T08:22:53.511000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "leiwen15", "id": "157128", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3662, "URL": 250, "domain": 1592, "FileHash-MD5": 4, "email": 2 }, "indicator_count": 5510, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62cbdde0447b9617f24a8901", "name": "vvvvv", "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.", "modified": "2022-08-10T00:00:07.214000", "created": "2022-07-11T08:22:56.693000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "leiwen15", "id": "157128", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3662, "URL": 250, "domain": 1592, "FileHash-MD5": 4, "email": 2 }, "indicator_count": 5510, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62cbddf0c4709eb7b4d0fb94", "name": "data of hhh", "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.", "modified": "2022-08-10T00:00:07.214000", "created": "2022-07-11T08:23:12.624000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "leiwen15", "id": "157128", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3662, "URL": 250, "domain": 1592, "FileHash-MD5": 4, "email": 2 }, "indicator_count": 5510, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629779d3b6ef17c22b432a37", "name": "NewDom-1-20220601", "description": "ICANN-Dom", "modified": "2022-07-16T00:01:49.209000", "created": "2022-06-01T14:38:11.210000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1415 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "references": [ "https://www.riskiq.com/blog/external-threat-management/mobile-inter/" ], "related": { "alienvault": { "adversary": [ "Magecart" ], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 7, "pulses": [ { "id": "60afd2d5ce95a296d0f9323e", "name": "MobileInter: Magecart Skimmer for your phone", "description": "A new modified version of Inter\u2014the precursor to MobileInter\u2014was first reported in March 2020. Since then, Magecart operators have altered it even more. MobileInter, first reported in April 2021, focuses solely on mobile users and targets login credentials and payment data. \nThe first iteration of MobileInter downloaded exfil URLs hidden in images from GitHub repositories. In contrast, this new MobileInter contains the exfiltration URLs within the skimmer code itself and uses WebSockets for data exfil. Hiding its code by injecting it into images on the compromised websites is yet another new wrinkle added by operators.\n\nMobileInter also disguises itself and its infrastructure, leaning heavily on Google to do so. It hides as Google tracking services, uses domains that mimic Google, and abuses Google IPs.", "modified": "2021-05-27T17:11:49.194000", "created": "2021-05-27T17:11:49.194000", "tags": [ "magecart", "mobileinter", "inter skimmer", "skimmer" ], "references": [ "https://www.riskiq.com/blog/external-threat-management/mobile-inter/" ], "public": 1, "adversary": "Magecart", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 247, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "email": 1, "domain": 39, "hostname": 3, "FileHash-MD5": 4, "FileHash-SHA256": 1, "FileHash-SHA1": 1 }, "indicator_count": 49, "is_author": false, "is_subscribing": null, "subscriber_count": 386500, "modified_text": "1829 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a0d760557004620f409f", "name": "Kelowna Mental Health", "description": "", "modified": "2023-12-06T16:27:03.467000", "created": "2023-12-06T16:27:03.467000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 715, "CVE": 20, "FileHash-MD5": 8943, "FileHash-SHA256": 37374, "FileHash-SHA1": 8939, "JA3": 11, "domain": 497, "URL": 408, "email": 38, "FilePath": 1 }, "indicator_count": 56946, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64e9896df7ea5c41750e6aac", "name": "Kelowna Mental Health", "description": "", "modified": "2023-10-14T00:01:59.166000", "created": "2023-08-26T05:11:09.863000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 785, "domain": 550, "email": 38, "URL": 511, "CVE": 21, "FileHash-MD5": 15725, "FileHash-SHA1": 15719, "FileHash-SHA256": 67914, "JA3": 11, "FilePath": 1 }, "indicator_count": 101275, "is_author": false, "is_subscribing": null, "subscriber_count": 88, "modified_text": "960 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62cbdddd1fc2e2956bfacda5", "name": "vvvvv", "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.", "modified": "2022-08-10T00:00:07.214000", "created": "2022-07-11T08:22:53.511000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "leiwen15", "id": "157128", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3662, "URL": 250, "domain": 1592, "FileHash-MD5": 4, "email": 2 }, "indicator_count": 5510, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62cbdde0447b9617f24a8901", "name": "vvvvv", "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.", "modified": "2022-08-10T00:00:07.214000", "created": "2022-07-11T08:22:56.693000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "leiwen15", "id": "157128", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3662, "URL": 250, "domain": 1592, "FileHash-MD5": 4, "email": 2 }, "indicator_count": 5510, "is_author": false, "is_subscribing": null, "subscriber_count": 41, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62cbddf0c4709eb7b4d0fb94", "name": "data of hhh", "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.", "modified": "2022-08-10T00:00:07.214000", "created": "2022-07-11T08:23:12.624000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "leiwen15", "id": "157128", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 3662, "URL": 250, "domain": 1592, "FileHash-MD5": 4, "email": 2 }, "indicator_count": 5510, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "629779d3b6ef17c22b432a37", "name": "NewDom-1-20220601", "description": "ICANN-Dom", "modified": "2022-07-16T00:01:49.209000", "created": "2022-06-01T14:38:11.210000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ZENDataGELowC", "id": "152785", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": {}, "indicator_count": 0, "is_author": false, "is_subscribing": null, "subscriber_count": 201, "modified_text": "1415 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "fontsgstatic.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "fontsgstatic.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780211804.1386523 }