{
  "type": "Domain",
  "indicator": "hellokittycraft.net",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/hellokittycraft.net",
    "alexa": "http://www.alexa.com/siteinfo/hellokittycraft.net",
    "indicator": "hellokittycraft.net",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4271625951,
      "indicator": "hellokittycraft.net",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "69ba817a667265c550e1ce4a",
          "name": "Minecraft: Dark Tale of Scams, Malware & Extortion",
          "description": "The article exposes a sophisticated scam targeting Minecraft players through fake 'grief-free' server communities. The SugarSMP website, promising a safe gaming experience, was found to distribute malware-infected mod packs. The malware, named Spark stealer, steals sensitive data including Discord tokens, browser credentials, and crypto wallet information. The threat actors employ social engineering tactics to maintain their fake community's reputation and remove warnings about their activities. Multiple similar websites were discovered, all hosting various types of malware. The scam's persistence mechanisms and social engineering techniques are detailed, along with remediation steps for affected users.",
          "modified": "2026-03-18T11:13:11.087000",
          "created": "2026-03-18T10:42:02.188000",
          "tags": [
            "minecraft",
            "scam",
            "mod packs",
            "stealer",
            "discord",
            "malware",
            "social engineering",
            "spark stealer",
            "sugarsmp",
            "data theft"
          ],
          "references": [
            "https://blog.gdatasoftware.com/2026/03/38390-minecraft-mod-sugarsmp-malware"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Spark stealer",
              "display_name": "Spark stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053.005",
              "name": "Scheduled Task",
              "display_name": "T1053.005 - Scheduled Task"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1542.003",
              "name": "Bootkit",
              "display_name": "T1542.003 - Bootkit"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1219",
              "name": "Remote Access Software",
              "display_name": "T1219 - Remote Access Software"
            },
            {
              "id": "T1553.006",
              "name": "Code Signing Policy Modification",
              "display_name": "T1553.006 - Code Signing Policy Modification"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1552.001",
              "name": "Credentials In Files",
              "display_name": "T1552.001 - Credentials In Files"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 51,
            "domain": 51
          },
          "indicator_count": 106,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 377817,
          "modified_text": "33 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69dbb13a0b2e563dd43bce83",
          "name": "Payload_Delivery | Apr 13, 2026 | Part 2/2",
          "description": "Payload_Delivery indicators. Date: Apr 13, 2026. Part 2/2. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-12T14:50:34.232000",
          "created": "2026-04-12T14:50:34.232000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 91,
            "URL": 81,
            "domain": 86,
            "FileHash-SHA256": 6
          },
          "indicator_count": 264,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "8 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69da5f25d67ec66156e7c52f",
          "name": "Payload_Delivery | Apr 12, 2026 | Part 1/2",
          "description": "Payload_Delivery indicators. Date: Apr 12, 2026. Part 1/2. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-11T14:48:05.522000",
          "created": "2026-04-11T14:48:05.522000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1386,
            "URL": 357,
            "domain": 234,
            "FileHash-SHA256": 12,
            "FileHash-MD5": 1
          },
          "indicator_count": 1990,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "9 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d90e48bac58fe84ff3fded",
          "name": "Payload_Delivery | Apr 11, 2026 | Part 1/2",
          "description": "Payload_Delivery indicators. Date: Apr 11, 2026. Part 1/2. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-10T14:50:48.668000",
          "created": "2026-04-10T14:50:48.668000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1233,
            "domain": 264,
            "URL": 455,
            "FileHash-MD5": 9,
            "FileHash-SHA256": 17
          },
          "indicator_count": 1978,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "10 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d7bcf2e126cc63870c76e1",
          "name": "Payload_Delivery | Apr 10, 2026",
          "description": "Payload_Delivery indicators. Date: Apr 10, 2026. Total: 1755 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-09T14:51:30.567000",
          "created": "2026-04-09T14:51:30.567000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 971,
            "domain": 262,
            "URL": 468,
            "FileHash-MD5": 9,
            "FileHash-SHA256": 24
          },
          "indicator_count": 1734,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "11 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d66af5041f0d321523b4fc",
          "name": "Payload_Delivery | Apr 9, 2026",
          "description": "Payload_Delivery indicators. Date: Apr 9, 2026. Total: 1599 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-08T14:49:25.176000",
          "created": "2026-04-08T14:49:25.176000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 483,
            "hostname": 776,
            "domain": 274,
            "FileHash-SHA256": 26,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 6
          },
          "indicator_count": 1579,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "12 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d51895fa006eed5cb3bcbe",
          "name": "Payload_Delivery | Apr 8, 2026",
          "description": "Payload_Delivery indicators. Date: Apr 8, 2026. Total: 1538 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-07T14:45:40.981000",
          "created": "2026-04-07T14:45:40.981000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 781,
            "URL": 449,
            "domain": 237,
            "FileHash-SHA256": 32,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 6
          },
          "indicator_count": 1519,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "13 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d3c846df94a185eebc8d2a",
          "name": "Payload_Delivery | Apr 7, 2026",
          "description": "Payload_Delivery indicators. Date: Apr 7, 2026. Total: 1542 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-06T14:50:46.327000",
          "created": "2026-04-06T14:50:46.327000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 768,
            "domain": 222,
            "URL": 463,
            "FileHash-SHA256": 45,
            "FileHash-MD5": 18,
            "FileHash-SHA1": 6
          },
          "indicator_count": 1522,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "14 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d274766445122f50c1555b",
          "name": "Payload_Delivery | Apr 6, 2026",
          "description": "Payload_Delivery indicators. Date: Apr 6, 2026. Total: 1665 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-04-05T14:40:54.779000",
          "created": "2026-04-05T14:40:54.779000",
          "tags": [
            "payload_delivery"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 218,
            "URL": 432,
            "hostname": 926,
            "FileHash-SHA256": 42,
            "FileHash-MD5": 18,
            "FileHash-SHA1": 6
          },
          "indicator_count": 1642,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "15 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bb25f31dc2ce15fe0f9712",
          "name": "Minecraft: Dark Tale of Scams, Malware & Extortion",
          "description": "",
          "modified": "2026-03-18T22:23:47.294000",
          "created": "2026-03-18T22:23:47.294000",
          "tags": [
            "minecraft",
            "scam",
            "mod packs",
            "stealer",
            "discord",
            "malware",
            "social engineering",
            "spark stealer",
            "sugarsmp",
            "data theft"
          ],
          "references": [
            "https://blog.gdatasoftware.com/2026/03/38390-minecraft-mod-sugarsmp-malware"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Spark stealer",
              "display_name": "Spark stealer",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053.005",
              "name": "Scheduled Task",
              "display_name": "T1053.005 - Scheduled Task"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1542.003",
              "name": "Bootkit",
              "display_name": "T1542.003 - Bootkit"
            },
            {
              "id": "T1555",
              "name": "Credentials from Password Stores",
              "display_name": "T1555 - Credentials from Password Stores"
            },
            {
              "id": "T1219",
              "name": "Remote Access Software",
              "display_name": "T1219 - Remote Access Software"
            },
            {
              "id": "T1553.006",
              "name": "Code Signing Policy Modification",
              "display_name": "T1553.006 - Code Signing Policy Modification"
            },
            {
              "id": "T1555.003",
              "name": "Credentials from Web Browsers",
              "display_name": "T1555.003 - Credentials from Web Browsers"
            },
            {
              "id": "T1552.001",
              "name": "Credentials In Files",
              "display_name": "T1552.001 - Credentials In Files"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69ba817a667265c550e1ce4a",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 51,
            "domain": 51
          },
          "indicator_count": 106,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 264,
          "modified_text": "32 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://blog.gdatasoftware.com/2026/03/38390-minecraft-mod-sugarsmp-malware",
        "https://ltna.com.au/cyber"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [
            "Spark stealer"
          ],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Spark stealer"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "69ba817a667265c550e1ce4a",
      "name": "Minecraft: Dark Tale of Scams, Malware & Extortion",
      "description": "The article exposes a sophisticated scam targeting Minecraft players through fake 'grief-free' server communities. The SugarSMP website, promising a safe gaming experience, was found to distribute malware-infected mod packs. The malware, named Spark stealer, steals sensitive data including Discord tokens, browser credentials, and crypto wallet information. The threat actors employ social engineering tactics to maintain their fake community's reputation and remove warnings about their activities. Multiple similar websites were discovered, all hosting various types of malware. The scam's persistence mechanisms and social engineering techniques are detailed, along with remediation steps for affected users.",
      "modified": "2026-03-18T11:13:11.087000",
      "created": "2026-03-18T10:42:02.188000",
      "tags": [
        "minecraft",
        "scam",
        "mod packs",
        "stealer",
        "discord",
        "malware",
        "social engineering",
        "spark stealer",
        "sugarsmp",
        "data theft"
      ],
      "references": [
        "https://blog.gdatasoftware.com/2026/03/38390-minecraft-mod-sugarsmp-malware"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Spark stealer",
          "display_name": "Spark stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053.005",
          "name": "Scheduled Task",
          "display_name": "T1053.005 - Scheduled Task"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1542.003",
          "name": "Bootkit",
          "display_name": "T1542.003 - Bootkit"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1219",
          "name": "Remote Access Software",
          "display_name": "T1219 - Remote Access Software"
        },
        {
          "id": "T1553.006",
          "name": "Code Signing Policy Modification",
          "display_name": "T1553.006 - Code Signing Policy Modification"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1552.001",
          "name": "Credentials In Files",
          "display_name": "T1552.001 - Credentials In Files"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 51,
        "domain": 51
      },
      "indicator_count": 106,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 377817,
      "modified_text": "33 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69dbb13a0b2e563dd43bce83",
      "name": "Payload_Delivery | Apr 13, 2026 | Part 2/2",
      "description": "Payload_Delivery indicators. Date: Apr 13, 2026. Part 2/2. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-12T14:50:34.232000",
      "created": "2026-04-12T14:50:34.232000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 91,
        "URL": 81,
        "domain": 86,
        "FileHash-SHA256": 6
      },
      "indicator_count": 264,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "8 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69da5f25d67ec66156e7c52f",
      "name": "Payload_Delivery | Apr 12, 2026 | Part 1/2",
      "description": "Payload_Delivery indicators. Date: Apr 12, 2026. Part 1/2. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-11T14:48:05.522000",
      "created": "2026-04-11T14:48:05.522000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1386,
        "URL": 357,
        "domain": 234,
        "FileHash-SHA256": 12,
        "FileHash-MD5": 1
      },
      "indicator_count": 1990,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "9 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d90e48bac58fe84ff3fded",
      "name": "Payload_Delivery | Apr 11, 2026 | Part 1/2",
      "description": "Payload_Delivery indicators. Date: Apr 11, 2026. Part 1/2. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-10T14:50:48.668000",
      "created": "2026-04-10T14:50:48.668000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1233,
        "domain": 264,
        "URL": 455,
        "FileHash-MD5": 9,
        "FileHash-SHA256": 17
      },
      "indicator_count": 1978,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "10 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d7bcf2e126cc63870c76e1",
      "name": "Payload_Delivery | Apr 10, 2026",
      "description": "Payload_Delivery indicators. Date: Apr 10, 2026. Total: 1755 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-09T14:51:30.567000",
      "created": "2026-04-09T14:51:30.567000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 971,
        "domain": 262,
        "URL": 468,
        "FileHash-MD5": 9,
        "FileHash-SHA256": 24
      },
      "indicator_count": 1734,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "11 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d66af5041f0d321523b4fc",
      "name": "Payload_Delivery | Apr 9, 2026",
      "description": "Payload_Delivery indicators. Date: Apr 9, 2026. Total: 1599 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-08T14:49:25.176000",
      "created": "2026-04-08T14:49:25.176000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 483,
        "hostname": 776,
        "domain": 274,
        "FileHash-SHA256": 26,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 6
      },
      "indicator_count": 1579,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "12 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d51895fa006eed5cb3bcbe",
      "name": "Payload_Delivery | Apr 8, 2026",
      "description": "Payload_Delivery indicators. Date: Apr 8, 2026. Total: 1538 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-07T14:45:40.981000",
      "created": "2026-04-07T14:45:40.981000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 781,
        "URL": 449,
        "domain": 237,
        "FileHash-SHA256": 32,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 6
      },
      "indicator_count": 1519,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "13 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d3c846df94a185eebc8d2a",
      "name": "Payload_Delivery | Apr 7, 2026",
      "description": "Payload_Delivery indicators. Date: Apr 7, 2026. Total: 1542 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-06T14:50:46.327000",
      "created": "2026-04-06T14:50:46.327000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 768,
        "domain": 222,
        "URL": 463,
        "FileHash-SHA256": 45,
        "FileHash-MD5": 18,
        "FileHash-SHA1": 6
      },
      "indicator_count": 1522,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "14 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d274766445122f50c1555b",
      "name": "Payload_Delivery | Apr 6, 2026",
      "description": "Payload_Delivery indicators. Date: Apr 6, 2026. Total: 1665 indicators. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-04-05T14:40:54.779000",
      "created": "2026-04-05T14:40:54.779000",
      "tags": [
        "payload_delivery"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 218,
        "URL": 432,
        "hostname": 926,
        "FileHash-SHA256": 42,
        "FileHash-MD5": 18,
        "FileHash-SHA1": 6
      },
      "indicator_count": 1642,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "15 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bb25f31dc2ce15fe0f9712",
      "name": "Minecraft: Dark Tale of Scams, Malware & Extortion",
      "description": "",
      "modified": "2026-03-18T22:23:47.294000",
      "created": "2026-03-18T22:23:47.294000",
      "tags": [
        "minecraft",
        "scam",
        "mod packs",
        "stealer",
        "discord",
        "malware",
        "social engineering",
        "spark stealer",
        "sugarsmp",
        "data theft"
      ],
      "references": [
        "https://blog.gdatasoftware.com/2026/03/38390-minecraft-mod-sugarsmp-malware"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Spark stealer",
          "display_name": "Spark stealer",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053.005",
          "name": "Scheduled Task",
          "display_name": "T1053.005 - Scheduled Task"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1542.003",
          "name": "Bootkit",
          "display_name": "T1542.003 - Bootkit"
        },
        {
          "id": "T1555",
          "name": "Credentials from Password Stores",
          "display_name": "T1555 - Credentials from Password Stores"
        },
        {
          "id": "T1219",
          "name": "Remote Access Software",
          "display_name": "T1219 - Remote Access Software"
        },
        {
          "id": "T1553.006",
          "name": "Code Signing Policy Modification",
          "display_name": "T1553.006 - Code Signing Policy Modification"
        },
        {
          "id": "T1555.003",
          "name": "Credentials from Web Browsers",
          "display_name": "T1555.003 - Credentials from Web Browsers"
        },
        {
          "id": "T1552.001",
          "name": "Credentials In Files",
          "display_name": "T1552.001 - Credentials In Files"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69ba817a667265c550e1ce4a",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 51,
        "domain": 51
      },
      "indicator_count": 106,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 264,
      "modified_text": "32 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "hellokittycraft.net",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "hellokittycraft.net",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776723490.8685024
}