{ "type": "Domain", "indicator": "hbws.cc", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/hbws.cc", "alexa": "http://www.alexa.com/siteinfo/hbws.cc", "indicator": "hbws.cc", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4069987659, "indicator": "hbws.cc", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "683202092d4ff2099430b6d3", "name": "urlhaus 30days", "description": "", "modified": "2026-02-09T00:11:12.303000", "created": "2025-05-24T17:29:45.368000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 61, "FileHash-SHA1": 4, "FileHash-SHA256": 31, "URL": 28057, "domain": 435, "hostname": 423 }, "indicator_count": 29011, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "111 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688973fddee47eb1d82d4e85", "name": "geoplugin", "description": "", "modified": "2026-02-05T04:58:36.086000", "created": "2025-07-30T01:23:09.184000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 90, "FileHash-SHA1": 90, "FileHash-SHA256": 201, "URL": 11, "domain": 4, "hostname": 1 }, "indicator_count": 397, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "115 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6860904230575bc1c69eb97a", "name": "URLHaus data - 28-06-2025", "description": "", "modified": "2025-07-29T01:04:32.844000", "created": "2025-06-29T01:00:50.710000", "tags": [ "opendir", "sh", "elf", "mirai", "WsgiDAV", "botnetdomain", "gafgyt", "censys", "CobaltStrike", "hajime", "backdoor", "sshdkit", "ascii", "Encoded", "xworm", "c2-monitor-auto", "dropped-by-amadey", "dcrat", "PlugX", "exe", "MassLogger", "hta", "RemcosRAT", "Formbook", "rat", "base64-loader", "rev-base64-loader", "bash", "Mozi", "netgear", "wget", "donutloader", "LummaStealer", "RedLineStealer", "01782414544", "ua-wget", "opendir", "CoinMiner", "bash botnet-backend publicsrc mirai", "botnet-backend", "publicsrc", "moobot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 305, "hostname": 6, "domain": 2 }, "indicator_count": 313, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "306 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68463505b9e803694da3628c", "name": "Microsoft.Win32.TaskScheduler.dll", "description": "8c66d9087118b17ccaa62eb83f3542c1", "modified": "2025-07-09T01:02:01.470000", "created": "2025-06-09T01:12:37.802000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 124, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 15, "hostname": 45 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "326 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6844abbf066f7402bce2a61c", "name": "Katz Stealer", "description": "", "modified": "2025-07-07T21:00:15.349000", "created": "2025-06-07T21:14:39.087000", "tags": [ "KatzStealer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Katz Stealer", "display_name": "Katz Stealer", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 125, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 14, "hostname": 43 }, "indicator_count": 314, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "327 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682e689e78133f59cf1ca918", "name": "URLHaus data - 21-05-2025", "description": "", "modified": "2025-06-20T23:02:09.595000", "created": "2025-05-21T23:58:22.623000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ClearFake", "ua-wget", "connectwise", "sh", "CoinMiner", "opendir", "vjw0rm", "screenconnect", "gafgyt", "booking", "ClickFix", "FakeCaptcha", "NetSupport", "BlankGrabber", "CryptOne", "jaik", "malware", "eld", "AsyncRAT", "jpg-base64-loader", "stego", "ascii", "Encoded", "rat", "RemcosRAT", "rev-base64-loader", "powershell", "ps1", "MassLogger", "AveMariaRAT", "MetaStealer", "msi", "encrypted", "GuLoader", "AgentTesla", "rustystealer", "base64-loader", "WsgiDAV", "exe", "github", "Vidar", "xworm", "arrowrat", "LummaStealer", "gcleaner", "xenorat", "VenomRAT", "Rhadamanthys", "censys", "CobaltStrike", "hajime", "backdoor", "sshdkit" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 70, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 828, "hostname": 48, "domain": 17 }, "indicator_count": 893, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "344 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Katz stealer" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "683202092d4ff2099430b6d3", "name": "urlhaus 30days", "description": "", "modified": "2026-02-09T00:11:12.303000", "created": "2025-05-24T17:29:45.368000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 61, "FileHash-SHA1": 4, "FileHash-SHA256": 31, "URL": 28057, "domain": 435, "hostname": 423 }, "indicator_count": 29011, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "111 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688973fddee47eb1d82d4e85", "name": "geoplugin", "description": "", "modified": "2026-02-05T04:58:36.086000", "created": "2025-07-30T01:23:09.184000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 90, "FileHash-SHA1": 90, "FileHash-SHA256": 201, "URL": 11, "domain": 4, "hostname": 1 }, "indicator_count": 397, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "115 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6860904230575bc1c69eb97a", "name": "URLHaus data - 28-06-2025", "description": "", "modified": "2025-07-29T01:04:32.844000", "created": "2025-06-29T01:00:50.710000", "tags": [ "opendir", "sh", "elf", "mirai", "WsgiDAV", "botnetdomain", "gafgyt", "censys", "CobaltStrike", "hajime", "backdoor", "sshdkit", "ascii", "Encoded", "xworm", "c2-monitor-auto", "dropped-by-amadey", "dcrat", "PlugX", "exe", "MassLogger", "hta", "RemcosRAT", "Formbook", "rat", "base64-loader", "rev-base64-loader", "bash", "Mozi", "netgear", "wget", "donutloader", "LummaStealer", "RedLineStealer", "01782414544", "ua-wget", "opendir", "CoinMiner", "bash botnet-backend publicsrc mirai", "botnet-backend", "publicsrc", "moobot" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 305, "hostname": 6, "domain": 2 }, "indicator_count": 313, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "306 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68463505b9e803694da3628c", "name": "Microsoft.Win32.TaskScheduler.dll", "description": "8c66d9087118b17ccaa62eb83f3542c1", "modified": "2025-07-09T01:02:01.470000", "created": "2025-06-09T01:12:37.802000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 124, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 15, "hostname": 45 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "326 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6844abbf066f7402bce2a61c", "name": "Katz Stealer", "description": "", "modified": "2025-07-07T21:00:15.349000", "created": "2025-06-07T21:14:39.087000", "tags": [ "KatzStealer" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Katz Stealer", "display_name": "Katz Stealer", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 125, "FileHash-MD5": 23, "FileHash-SHA1": 21, "FileHash-SHA256": 88, "domain": 14, "hostname": 43 }, "indicator_count": 314, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "327 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "682e689e78133f59cf1ca918", "name": "URLHaus data - 21-05-2025", "description": "", "modified": "2025-06-20T23:02:09.595000", "created": "2025-05-21T23:58:22.623000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ClearFake", "ua-wget", "connectwise", "sh", "CoinMiner", "opendir", "vjw0rm", "screenconnect", "gafgyt", "booking", "ClickFix", "FakeCaptcha", "NetSupport", "BlankGrabber", "CryptOne", "jaik", "malware", "eld", "AsyncRAT", "jpg-base64-loader", "stego", "ascii", "Encoded", "rat", "RemcosRAT", "rev-base64-loader", "powershell", "ps1", "MassLogger", "AveMariaRAT", "MetaStealer", "msi", "encrypted", "GuLoader", "AgentTesla", "rustystealer", "base64-loader", "WsgiDAV", "exe", "github", "Vidar", "xworm", "arrowrat", "LummaStealer", "gcleaner", "xenorat", "VenomRAT", "Rhadamanthys", "censys", "CobaltStrike", "hajime", "backdoor", "sshdkit" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 70, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 828, "hostname": 48, "domain": 17 }, "indicator_count": 893, "is_author": false, "is_subscribing": null, "subscriber_count": 1620, "modified_text": "344 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "hbws.cc", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "hbws.cc", "found": true, "verdict": "malicious", "url_count": 7, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "listed" }, "urls": [ { "url": "http://hbws.cc/RRC_204_Lrrpgyfrayj", "status": "offline", "threat": "malware_download", "date_added": "2025-07-15", "tags": [] }, { "url": "https://hbws.cc/RRC_200_Cgdqgnvkfcp", "status": "offline", "threat": "malware_download", "date_added": "2025-07-12", "tags": [ "ascii", "DBatLoader", "Encoded", "ModiLoader", "rat", "RemcosRAT" ] }, { "url": "http://hbws.cc/RRC_154_Bwesftmkgmz", "status": "offline", "threat": "malware_download", "date_added": "2025-07-12", "tags": [ "ascii", "Encoded", "rat", "RemcosRAT" ] }, { "url": "https://hbws.cc/king.cmd", "status": "offline", "threat": "malware_download", "date_added": "2025-06-28", "tags": [ "ascii", "Encoded", "RemcosRAT" ] }, { "url": "https://hbws.cc/grace.cmd", "status": "offline", "threat": "malware_download", "date_added": "2025-06-28", "tags": [ "ascii", "Encoded", "rat", "RemcosRAT" ] }, { "url": "http://hbws.cc/scri.txt", "status": "offline", "threat": "malware_download", "date_added": "2025-05-24", "tags": [] }, { "url": "https://hbws.cc/king.txt", "status": "offline", "threat": "malware_download", "date_added": "2025-05-21", "tags": [ "ascii", "Encoded", "rat", "RemcosRAT", "rev-base64-loader" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780206339.334342 }