{ "type": "Domain", "indicator": "fotolap.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/fotolap.com", "alexa": "http://www.alexa.com/siteinfo/fotolap.com", "indicator": "fotolap.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4031460249, "indicator": "fotolap.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 30, "pulses": [ { "id": "6799119dbf5f688d9fc9f344", "name": "Security Brief: Threat Actors Take Taxes Into Account", "description": "Proofpoint researchers have identified an increase in campaigns and malicious domains impersonating tax agencies and financial organizations. This aligns with the annual increase in tax-related content observed from December through April. Phishing lures impersonate government agencies and financial services organizations involved in tax filing. Campaigns targeting the UK, US, Switzerland, and Australia have been observed, using various tactics such as credential harvesting, fraudulent payment requests, and malware delivery. Threat actors exploit tax themes to make their lures more convincing, especially during filing seasons. Organizations are advised to educate users about common techniques and lures used by attackers.", "modified": "2025-02-27T17:02:22.064000", "created": "2025-01-28T17:19:25.074000", "tags": [ "intuit", "mygov", "venomrat", "hmrc", "rhadamanthys", "tax-themed phishing", "xworm", "government impersonation", "credential harvesting", "asyncrat", "financial fraud", "malware delivery", "revolut", "metastealer", "zgrat" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Switzerland", "United Kingdom of Great Britain and Northern Ireland" ], "malware_families": [ { "id": "Rhadamanthys", "display_name": "Rhadamanthys", "target": null }, { "id": "zgRAT", "display_name": "zgRAT", "target": null }, { "id": "MetaStealer", "display_name": "MetaStealer", "target": null }, { "id": "XWorm", "display_name": "XWorm", "target": null }, { "id": "AsyncRAT", "display_name": "AsyncRAT", "target": null }, { "id": "VenomRAT", "display_name": "VenomRAT", "target": null } ], "attack_ids": [ { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1102.003", "name": "One-Way Communication", "display_name": "T1102.003 - One-Way Communication" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 5 }, "indicator_count": 5, "is_author": false, "is_subscribing": null, "subscriber_count": 386770, "modified_text": "459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b02dc1e6e29d8504ad7b9a", "name": "Phishing | Mar 11, 2026 | Part 166/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 166/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:42:09.069000", "created": "2026-03-10T14:42:09.069000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1155, "domain": 845 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aeda5a947bfc8d8d0817f1", "name": "Phishing | Mar 10, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:34:02.397000", "created": "2026-03-09T14:34:02.397000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1005, "domain": 995 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8707accf3ef7258167bf", "name": "Phishing | Mar 9, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:26:15.236000", "created": "2026-03-08T14:26:15.236000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1173, "domain": 827 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac36281dc93f25cb20f5d8", "name": "Phishing | Mar 8, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:28:56.690000", "created": "2026-03-07T14:28:56.690000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1173, "domain": 827 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae399d4d3bf83a1dd3a98", "name": "Phishing | Mar 7, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:24:25.959000", "created": "2026-03-06T14:24:25.959000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99834d6cccf941ba3d0e0", "name": "Phishing | Mar 6, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T14:50:28.424000", "created": "2026-03-05T14:50:28.424000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a8418116a53af80059f5b4", "name": "Phishing | Mar 5, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:28:17.245000", "created": "2026-03-04T14:28:17.245000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6ee98e5235157ffcbcc5f", "name": "Phishing | Mar 4, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:22:16.331000", "created": "2026-03-03T14:22:16.331000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b4832b7aa9a3d2cd163c", "name": "Phishing | Mar 3, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:02:11.734000", "created": "2026-03-02T16:02:11.734000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a512bde84294fe0f8b9c27", "name": "Phishing | Mar 2, 2026 | Part 135/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 135/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:31:57.829000", "created": "2026-03-02T04:31:57.829000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 982, "hostname": 1018 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a43f29c1fbfec7e4f69d06", "name": "Phishing | Mar 2, 2026 | Part 137/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 137/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:29:13.879000", "created": "2026-03-01T13:29:13.879000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1131, "domain": 869 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a404e710c52bcc39e4e769", "name": "Phishing | Mar 1, 2026 | Part 137/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 137/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:20:39.467000", "created": "2026-03-01T09:20:39.467000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1131, "domain": 869 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a3833a43ad179737c78c75", "name": "Phishing | Mar 1, 2026 | Part 137/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 137/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:07:22.765000", "created": "2026-03-01T00:07:22.765000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 976, "hostname": 1024 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997fa0858e996960f64fc51", "name": "Phishing | Feb 20, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:07:04.395000", "created": "2026-02-20T06:07:04.395000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997679ee1c68e6ecf898c10", "name": "Phishing | Feb 20, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T19:42:22.688000", "created": "2026-02-19T19:42:22.688000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997286b2a936fc5d05a3320", "name": "Phishing | Feb 20, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:12:43.331000", "created": "2026-02-19T15:12:43.331000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69970934896c431e253c2196", "name": "Phishing | Feb 19, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T12:59:32.218000", "created": "2026-02-19T12:59:32.218000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699633078048c2b213202977", "name": "Phishing | Feb 19, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T21:45:43.654000", "created": "2026-02-18T21:45:43.654000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699573ffa734524adec058d0", "name": "Phishing | Feb 18, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:10:39.447000", "created": "2026-02-18T08:10:39.447000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6994cb139c6353e91f70b04c", "name": "Phishing | Feb 18, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T20:09:55.869000", "created": "2026-02-17T20:09:55.869000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6994986f6149741b08d97570", "name": "Phishing | Feb 18, 2026 | Part 138/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 138/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T16:33:50.993000", "created": "2026-02-17T16:33:50.993000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 975, "domain": 1025 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699296807a5c2aade3092514", "name": "Phishing | Feb 16, 2026 | Part 140/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 140/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:01:04.927000", "created": "2026-02-16T04:01:04.927000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 976, "domain": 1024 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6991573346aade9d36be4af5", "name": "Phishing | Feb 15, 2026 | Part 143/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 143/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:18:43.220000", "created": "2026-02-15T05:18:43.220000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 864, "hostname": 1136 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "106 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699088a4ba430167048ff58c", "name": "Phishing | Feb 15, 2026 | Part 144/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 144/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T14:37:24.290000", "created": "2026-02-14T14:37:24.290000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1002, "hostname": 998 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "107 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c5b01d7a121eb2abb1291", "name": "Phishing | Feb 11, 2026 | Part 162/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 162/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T10:33:37.413000", "created": "2026-02-11T10:33:37.413000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1053, "domain": 947 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "110 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981a91995446c1be4e35624", "name": "Phishing | 2026-01-31 | Part 48/163", "description": "Phishing indicators. Date: 2026-01-31. Part 48/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T07:51:53.655000", "created": "2026-02-03T07:51:53.655000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 6524, "domain": 3475 }, "indicator_count": 9999, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "118 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67a20bc9e4e92e8c642002f2", "name": "Security Brief: Threat Actors Take Taxes Into Account | Proofpoint US", "description": "Proofpoint researchers have identified an uptick in campaigns and malicious domains impersonating tax agencies and related financial organizations. This activity aligns with the general increase in tax-related content our researchers typically observe every year from December through April, especially as tax deadlines in the United Kingdom and United States are top of mind for businesses. \n\nGenerally, phishing lures leveraging tax themes impersonate government agencies or financial services organizations that users would engage with to file taxes or submit business relevant documentation.", "modified": "2025-03-06T12:00:18.621000", "created": "2025-02-04T12:44:57.286000", "tags": [ "proofpoint", "january", "hmrc", "urls", "december", "intuit", "revolut account", "april", "united kingdom", "united", "powershell", "rhadamanthys", "aggah", "metastealer", "xworm", "asyncrat", "venomrat", "zgrat", "threat" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account?utm_source=social_organic&utm_social_network=twitter&utm_campaign=2025&utm_post_id=ea59ad2c-af76-4242-9e8d-3947e3db8856" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "Rhadamanthys", "display_name": "Rhadamanthys", "target": null }, { "id": "zgRAT", "display_name": "zgRAT", "target": null }, { "id": "Threat", "display_name": "Threat", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Government", "Higher Education", "Financial", "Financial Services", "Taxation" ], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "URL": 11, "domain": 6, "email": 1, "hostname": 1 }, "indicator_count": 21, "is_author": false, "is_subscribing": null, "subscriber_count": 864, "modified_text": "452 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "679a3dfae2c6a0653df29743", "name": "Security Brief: Threat Actors Take Taxes Into Account | Proofpoint US", "description": "Find out more about Proofpoint, the world's leading cybersecurity provider, at the Guardian World Conference in London, which takes place from 7-12 January 2017 to 9-18 March 2017.", "modified": "2025-02-28T14:02:13.817000", "created": "2025-01-29T14:40:58.897000", "tags": [ "proofpoint", "january", "hmrc", "urls", "december", "intuit", "revolut account", "april", "united kingdom", "united", "powershell", "rhadamanthys", "aggah", "metastealer", "xworm", "asyncrat", "venomrat", "zgrat", "threat" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "Rhadamanthys", "display_name": "Rhadamanthys", "target": null }, { "id": "zgRAT", "display_name": "zgRAT", "target": null }, { "id": "Threat", "display_name": "Threat", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Government", "Higher Education", "Financial", "Financial Services", "Taxation" ], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "URL": 10, "domain": 6, "email": 1, "hostname": 1 }, "indicator_count": 20, "is_author": false, "is_subscribing": null, "subscriber_count": 863, "modified_text": "458 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67991b9fdb089b3c4cde95c2", "name": "Security Brief: Threat Actors Take Taxes Into Account | Proofpoint US", "description": "", "modified": "2025-02-27T18:01:23.367000", "created": "2025-01-28T18:02:07.598000", "tags": [ "proofpoint", "january", "hmrc", "urls", "december", "intuit", "revolut account", "april", "united kingdom", "united", "powershell", "rhadamanthys", "aggah", "metastealer", "xworm", "asyncrat", "venomrat", "zgrat", "threat" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia" ], "malware_families": [ { "id": "Rhadamanthys", "display_name": "Rhadamanthys", "target": null }, { "id": "zgRAT", "display_name": "zgRAT", "target": null }, { "id": "Threat", "display_name": "Threat", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Government", "Higher Education", "Financial", "Financial Services", "Taxation" ], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AustinBH", "id": "147442", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1, "FileHash-SHA1": 1, "URL": 16, "domain": 6, "email": 1, "hostname": 4 }, "indicator_count": 29, "is_author": false, "is_subscribing": null, "subscriber_count": 58, "modified_text": "459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account?utm_source=social_organic&utm_social_network=twitter&utm_campaign=2025&utm_post_id=ea59ad2c-af76-4242-9e8d-3947e3db8856", "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account", "https://ltna.com.au/cyber" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Xworm", "Zgrat", "Rhadamanthys", "Asyncrat", "Metastealer", "Venomrat" ], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Threat", "Rhadamanthys", "Zgrat" ], "industries": [ "Financial services", "Financial", "Taxation", "Government", "Higher education" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 30, "pulses": [ { "id": "6799119dbf5f688d9fc9f344", "name": "Security Brief: Threat Actors Take Taxes Into Account", "description": "Proofpoint researchers have identified an increase in campaigns and malicious domains impersonating tax agencies and financial organizations. This aligns with the annual increase in tax-related content observed from December through April. Phishing lures impersonate government agencies and financial services organizations involved in tax filing. Campaigns targeting the UK, US, Switzerland, and Australia have been observed, using various tactics such as credential harvesting, fraudulent payment requests, and malware delivery. Threat actors exploit tax themes to make their lures more convincing, especially during filing seasons. Organizations are advised to educate users about common techniques and lures used by attackers.", "modified": "2025-02-27T17:02:22.064000", "created": "2025-01-28T17:19:25.074000", "tags": [ "intuit", "mygov", "venomrat", "hmrc", "rhadamanthys", "tax-themed phishing", "xworm", "government impersonation", "credential harvesting", "asyncrat", "financial fraud", "malware delivery", "revolut", "metastealer", "zgrat" ], "references": [ "https://www.proofpoint.com/us/blog/threat-insight/security-brief-threat-actors-take-taxes-account" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Australia", "Switzerland", "United Kingdom of Great Britain and Northern Ireland" ], "malware_families": [ { "id": "Rhadamanthys", "display_name": "Rhadamanthys", "target": null }, { "id": "zgRAT", "display_name": "zgRAT", "target": null }, { "id": "MetaStealer", "display_name": "MetaStealer", "target": null }, { "id": "XWorm", "display_name": "XWorm", "target": null }, { "id": "AsyncRAT", "display_name": "AsyncRAT", "target": null }, { "id": "VenomRAT", "display_name": "VenomRAT", "target": null } ], "attack_ids": [ { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1102.003", "name": "One-Way Communication", "display_name": "T1102.003 - One-Way Communication" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1078", "name": "Valid Accounts", "display_name": "T1078 - Valid Accounts" }, { "id": "T1102.002", "name": "Bidirectional Communication", "display_name": "T1102.002 - Bidirectional Communication" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1102.001", "name": "Dead Drop Resolver", "display_name": "T1102.001 - Dead Drop Resolver" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "domain": 5 }, "indicator_count": 5, "is_author": false, "is_subscribing": null, "subscriber_count": 386770, "modified_text": "459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b02dc1e6e29d8504ad7b9a", "name": "Phishing | Mar 11, 2026 | Part 166/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 166/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T14:42:09.069000", "created": "2026-03-10T14:42:09.069000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1155, "domain": 845 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aeda5a947bfc8d8d0817f1", "name": "Phishing | Mar 10, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:34:02.397000", "created": "2026-03-09T14:34:02.397000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1005, "domain": 995 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8707accf3ef7258167bf", "name": "Phishing | Mar 9, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:26:15.236000", "created": "2026-03-08T14:26:15.236000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1173, "domain": 827 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac36281dc93f25cb20f5d8", "name": "Phishing | Mar 8, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:28:56.690000", "created": "2026-03-07T14:28:56.690000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1173, "domain": 827 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae399d4d3bf83a1dd3a98", "name": "Phishing | Mar 7, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:24:25.959000", "created": "2026-03-06T14:24:25.959000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99834d6cccf941ba3d0e0", "name": "Phishing | Mar 6, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T14:50:28.424000", "created": "2026-03-05T14:50:28.424000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a8418116a53af80059f5b4", "name": "Phishing | Mar 5, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:28:17.245000", "created": "2026-03-04T14:28:17.245000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6ee98e5235157ffcbcc5f", "name": "Phishing | Mar 4, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:22:16.331000", "created": "2026-03-03T14:22:16.331000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 93, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b4832b7aa9a3d2cd163c", "name": "Phishing | Mar 3, 2026 | Part 134/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 134/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:02:11.734000", "created": "2026-03-02T16:02:11.734000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 828, "hostname": 1172 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "fotolap.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "fotolap.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780355744.1769955 }