{
  "type": "Domain",
  "indicator": "hostsailor.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/hostsailor.com",
    "alexa": "http://www.alexa.com/siteinfo/hostsailor.com",
    "indicator": "hostsailor.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2656300865,
      "indicator": "hostsailor.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6846a5a6772558179e97fafc",
          "name": "Pakistan Telecommunication Company (PTCL) Targeted by Bitter APT During Heightened Regional Conflict",
          "description": "A report from EclecticIQ and Hudson Rock on a spear phishing attack targeting Pakistan's telecommunications sector in May 2025 shows that Bitter APT, a South Asian state-sponsored actor, very likely used stolen email credentials to carry out cyber-enabled espionage.",
          "modified": "2025-07-09T09:00:16.142000",
          "created": "2025-06-09T09:13:10.011000",
          "tags": [
            "bitter apt",
            "wmrat",
            "online",
            "pakistan",
            "proofpoint",
            "ptcl",
            "virustotal",
            "ta397",
            "c2 server",
            "file",
            "august",
            "powershell",
            "april",
            "spear",
            "bitter"
          ],
          "references": [
            "https://blog.eclecticiq.com/pakistan-telecommunication-company-ptcl-targeted-by-bitter-apt-during-heightened-regional-conflict"
          ],
          "public": 1,
          "adversary": "Bitter",
          "targeted_countries": [
            "Pakistan",
            "India"
          ],
          "malware_families": [
            {
              "id": "Bitter",
              "display_name": "Bitter",
              "target": null
            },
            {
              "id": "WmRAT",
              "display_name": "WmRAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1569",
              "name": "System Services",
              "display_name": "T1569 - System Services"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [
            "Telecommunication",
            "Defence",
            "Telecom"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 22,
            "URL": 63,
            "domain": 33,
            "email": 1,
            "hostname": 22
          },
          "indicator_count": 141,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 543,
          "modified_text": "328 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6838ec44f751e28b21d75406",
          "name": "Pakistan Telecommunication Company (PTCL) Targeted by Bitter APT During Heightened Regional Conflict",
          "description": "A report from EclecticIQ and Hudson Rock on a spear phishing attack targeting Pakistan's telecommunications sector in May 2025 shows that Bitter APT, a South Asian state-sponsored actor, very likely used stolen email credentials to carry out cyber-enabled espionage.",
          "modified": "2025-06-28T23:00:35.131000",
          "created": "2025-05-29T23:22:44.442000",
          "tags": [
            "bitter apt",
            "wmrat",
            "online",
            "pakistan",
            "proofpoint",
            "ptcl",
            "virustotal",
            "ta397",
            "c2 server",
            "file",
            "august",
            "powershell",
            "april",
            "spear",
            "bitter"
          ],
          "references": [
            "https://blog.eclecticiq.com/pakistan-telecommunication-company-ptcl-targeted-by-bitter-apt-during-heightened-regional-conflict"
          ],
          "public": 1,
          "adversary": "Bitter",
          "targeted_countries": [
            "Pakistan",
            "India"
          ],
          "malware_families": [
            {
              "id": "Bitter",
              "display_name": "Bitter",
              "target": null
            },
            {
              "id": "WmRAT",
              "display_name": "WmRAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1569",
              "name": "System Services",
              "display_name": "T1569 - System Services"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [
            "Telecommunication",
            "Defence",
            "Telecom"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 21,
            "URL": 38,
            "domain": 33,
            "email": 1,
            "hostname": 4
          },
          "indicator_count": 97,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 544,
          "modified_text": "339 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6775b17c488523ee9d290afd",
          "name": "agressive extra",
          "description": "",
          "modified": "2025-03-17T22:57:49.933000",
          "created": "2025-01-01T21:19:56.847000",
          "tags": [],
          "references": [
            "https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.rules"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 35208,
            "URL": 79504,
            "domain": 19527,
            "hostname": 28058,
            "CVE": 9
          },
          "indicator_count": 162306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 207,
          "modified_text": "442 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65920b30442ea541f2d906fb",
          "name": "Guardicore - 31-12-2023",
          "description": "",
          "modified": "2024-01-31T00:03:52.799000",
          "created": "2024-01-01T00:45:36.019000",
          "tags": [],
          "references": [
            "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 14
          },
          "indicator_count": 14,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "854 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "627565069e58458ddbcb923d",
          "name": "Hostsailor.com - UAE",
          "description": "function(e,t) is a new type of word, and if you can get it by adding it to a single page, you will get the same result as the other, or as you want.",
          "modified": "2022-06-05T00:03:45.266000",
          "created": "2022-05-06T18:12:22.565000",
          "tags": [
            "u10ecu10d8u10dc",
            "typeof define",
            "date",
            "u00e5r siden",
            "instanceof",
            "typeof e",
            "rplginitsvg",
            "rplglang",
            "true",
            "sound icon",
            "click",
            "android",
            "span",
            "reduceright",
            "regexp",
            "typeof t",
            "class",
            "attr",
            "pseudo",
            "child",
            "function",
            "typeof module",
            "error",
            "number",
            "string",
            "copyright",
            "uint8array",
            "fnumber",
            "gtmnxs92ns",
            "host",
            "path",
            "void",
            "code",
            "image",
            "typeof atrkopts",
            "object",
            "typeerror",
            "array",
            "symbol",
            "bound",
            "typeof window",
            "invalid path",
            "unknown method",
            "null",
            "window",
            "phonenumber",
            "ninja",
            "form",
            "addcookiedomain",
            "hubspot",
            "xmlhttprequest",
            "fban",
            "twitter",
            "hstc",
            "trident",
            "helvetica neue",
            "helvetica",
            "arial",
            "n nn",
            "setapibaseurl",
            "hubspot cookie",
            "accept",
            "done"
          ],
          "references": [
            "xfe-URL-Hostsailor.com-stix2-2.1-export.json",
            "https://js.hs-banner.com/6261317.js",
            "https://js.usemessages.com/conversations-embed.js",
            "https://js.hs-analytics.net/analytics/1651860300000/6261317.js",
            "https://js.hscollectedforms.net/collectedforms.js",
            "https://certify-js.alexametrics.com/atrk.js",
            "https://www.googletagmanager.com/gtm.js?id=GTM-NXS92NS",
            "https://hostsailor.com/wp-content/cache/minify/9de48.js",
            "https://hostsailor.com/wp-content/cache/minify/cc4b1.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 625,
            "URL": 1809,
            "domain": 543,
            "FileHash-SHA256": 245
          },
          "indicator_count": 3222,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1459 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.rules",
        "https://www.googletagmanager.com/gtm.js?id=GTM-NXS92NS",
        "https://blog.eclecticiq.com/pakistan-telecommunication-company-ptcl-targeted-by-bitter-apt-during-heightened-regional-conflict",
        "xfe-URL-Hostsailor.com-stix2-2.1-export.json",
        "https://js.hs-analytics.net/analytics/1651860300000/6261317.js",
        "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html",
        "https://js.hs-banner.com/6261317.js",
        "https://hostsailor.com/wp-content/cache/minify/cc4b1.js",
        "https://js.hscollectedforms.net/collectedforms.js",
        "https://hostsailor.com/wp-content/cache/minify/9de48.js",
        "https://js.usemessages.com/conversations-embed.js",
        "https://certify-js.alexametrics.com/atrk.js"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Bitter"
          ],
          "malware_families": [
            "Reduceright",
            "Bitter",
            "Wmrat"
          ],
          "industries": [
            "Telecommunication",
            "Telecom",
            "Defence"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6846a5a6772558179e97fafc",
      "name": "Pakistan Telecommunication Company (PTCL) Targeted by Bitter APT During Heightened Regional Conflict",
      "description": "A report from EclecticIQ and Hudson Rock on a spear phishing attack targeting Pakistan's telecommunications sector in May 2025 shows that Bitter APT, a South Asian state-sponsored actor, very likely used stolen email credentials to carry out cyber-enabled espionage.",
      "modified": "2025-07-09T09:00:16.142000",
      "created": "2025-06-09T09:13:10.011000",
      "tags": [
        "bitter apt",
        "wmrat",
        "online",
        "pakistan",
        "proofpoint",
        "ptcl",
        "virustotal",
        "ta397",
        "c2 server",
        "file",
        "august",
        "powershell",
        "april",
        "spear",
        "bitter"
      ],
      "references": [
        "https://blog.eclecticiq.com/pakistan-telecommunication-company-ptcl-targeted-by-bitter-apt-during-heightened-regional-conflict"
      ],
      "public": 1,
      "adversary": "Bitter",
      "targeted_countries": [
        "Pakistan",
        "India"
      ],
      "malware_families": [
        {
          "id": "Bitter",
          "display_name": "Bitter",
          "target": null
        },
        {
          "id": "WmRAT",
          "display_name": "WmRAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1569",
          "name": "System Services",
          "display_name": "T1569 - System Services"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [
        "Telecommunication",
        "Defence",
        "Telecom"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 22,
        "URL": 63,
        "domain": 33,
        "email": 1,
        "hostname": 22
      },
      "indicator_count": 141,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 543,
      "modified_text": "328 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6838ec44f751e28b21d75406",
      "name": "Pakistan Telecommunication Company (PTCL) Targeted by Bitter APT During Heightened Regional Conflict",
      "description": "A report from EclecticIQ and Hudson Rock on a spear phishing attack targeting Pakistan's telecommunications sector in May 2025 shows that Bitter APT, a South Asian state-sponsored actor, very likely used stolen email credentials to carry out cyber-enabled espionage.",
      "modified": "2025-06-28T23:00:35.131000",
      "created": "2025-05-29T23:22:44.442000",
      "tags": [
        "bitter apt",
        "wmrat",
        "online",
        "pakistan",
        "proofpoint",
        "ptcl",
        "virustotal",
        "ta397",
        "c2 server",
        "file",
        "august",
        "powershell",
        "april",
        "spear",
        "bitter"
      ],
      "references": [
        "https://blog.eclecticiq.com/pakistan-telecommunication-company-ptcl-targeted-by-bitter-apt-during-heightened-regional-conflict"
      ],
      "public": 1,
      "adversary": "Bitter",
      "targeted_countries": [
        "Pakistan",
        "India"
      ],
      "malware_families": [
        {
          "id": "Bitter",
          "display_name": "Bitter",
          "target": null
        },
        {
          "id": "WmRAT",
          "display_name": "WmRAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1569",
          "name": "System Services",
          "display_name": "T1569 - System Services"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [
        "Telecommunication",
        "Defence",
        "Telecom"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 21,
        "URL": 38,
        "domain": 33,
        "email": 1,
        "hostname": 4
      },
      "indicator_count": 97,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 544,
      "modified_text": "339 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6775b17c488523ee9d290afd",
      "name": "agressive extra",
      "description": "",
      "modified": "2025-03-17T22:57:49.933000",
      "created": "2025-01-01T21:19:56.847000",
      "tags": [],
      "references": [
        "https://sslbl.abuse.ch/blacklist/sslipblacklist_aggressive.rules"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 35208,
        "URL": 79504,
        "domain": 19527,
        "hostname": 28058,
        "CVE": 9
      },
      "indicator_count": 162306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 207,
      "modified_text": "442 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65920b30442ea541f2d906fb",
      "name": "Guardicore - 31-12-2023",
      "description": "",
      "modified": "2024-01-31T00:03:52.799000",
      "created": "2024-01-01T00:45:36.019000",
      "tags": [],
      "references": [
        "https://threatintelligence.guardicore.com/download-guardicore-cyber-threat-intelligence-data.html"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 14
      },
      "indicator_count": 14,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "854 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "627565069e58458ddbcb923d",
      "name": "Hostsailor.com - UAE",
      "description": "function(e,t) is a new type of word, and if you can get it by adding it to a single page, you will get the same result as the other, or as you want.",
      "modified": "2022-06-05T00:03:45.266000",
      "created": "2022-05-06T18:12:22.565000",
      "tags": [
        "u10ecu10d8u10dc",
        "typeof define",
        "date",
        "u00e5r siden",
        "instanceof",
        "typeof e",
        "rplginitsvg",
        "rplglang",
        "true",
        "sound icon",
        "click",
        "android",
        "span",
        "reduceright",
        "regexp",
        "typeof t",
        "class",
        "attr",
        "pseudo",
        "child",
        "function",
        "typeof module",
        "error",
        "number",
        "string",
        "copyright",
        "uint8array",
        "fnumber",
        "gtmnxs92ns",
        "host",
        "path",
        "void",
        "code",
        "image",
        "typeof atrkopts",
        "object",
        "typeerror",
        "array",
        "symbol",
        "bound",
        "typeof window",
        "invalid path",
        "unknown method",
        "null",
        "window",
        "phonenumber",
        "ninja",
        "form",
        "addcookiedomain",
        "hubspot",
        "xmlhttprequest",
        "fban",
        "twitter",
        "hstc",
        "trident",
        "helvetica neue",
        "helvetica",
        "arial",
        "n nn",
        "setapibaseurl",
        "hubspot cookie",
        "accept",
        "done"
      ],
      "references": [
        "xfe-URL-Hostsailor.com-stix2-2.1-export.json",
        "https://js.hs-banner.com/6261317.js",
        "https://js.usemessages.com/conversations-embed.js",
        "https://js.hs-analytics.net/analytics/1651860300000/6261317.js",
        "https://js.hscollectedforms.net/collectedforms.js",
        "https://certify-js.alexametrics.com/atrk.js",
        "https://www.googletagmanager.com/gtm.js?id=GTM-NXS92NS",
        "https://hostsailor.com/wp-content/cache/minify/9de48.js",
        "https://hostsailor.com/wp-content/cache/minify/cc4b1.js"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ReduceRight",
          "display_name": "ReduceRight",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "adjadex1@gmail.com",
        "id": "187163",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 625,
        "URL": 1809,
        "domain": 543,
        "FileHash-SHA256": 245
      },
      "indicator_count": 3222,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "1459 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "hostsailor.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "hostsailor.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780466830.8667903
}