{ "type": "URL", "indicator": "https://a.b.style", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://a.b.style", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3212243864, "indicator": "https://a.b.style", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 37, "pulses": [ { "id": "67a7f06a5d0f22ad92684646", "name": "WebForm.com.gov.pl/CEIDG/ScriptResource.axd", "description": "The following is the full text of the WebForm.com.gov.pl/CEIDG/ScriptResource.axd, following the following:.au, for the first time.", "modified": "2025-05-14T21:27:17.040000", "created": "2025-02-09T00:01:46.054000", "tags": [ "null", "nie mona", "array", "input", "nonmsdombrowser", "object", "html", "component", "body", "horizontal", "date", "calendar", "february", "april", "june", "august", "iframe", "form", "friday", "explorer", "target", "error", "legend", "this", "type", "regexp", "elem", "index", "function", "handle", "check", "safari", "expando", "android", "false", "hooks", "copy", "prop", "class", "mark", "window", "code", "capture", "accept", "seed", "override", "hook", "look", "loop", "install", "pass", "enough", "bind", "core", "local", "verify", "done", "find", "internal", "inject", "possible", "hold", "middle", "guard", "fall", "stop", "panic", "back", "restrict", "speed", "turn", "grab", "getclass", "jquery", "bubble", "anchor", "shift" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1143, "domain": 155, "hostname": 523, "FileHash-SHA256": 151 }, "indicator_count": 1972, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "381 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "594 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709632333f37e8de4185e9", "name": "whitelisted angular.js", "description": "", "modified": "2023-12-06T15:41:38.498000", "created": "2023-12-06T15:41:38.498000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 245, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 424, "hostname": 466, "URL": 1805 }, "indicator_count": 3193, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ed8f7d4b5483117bb66", "name": "abuse.ch", "description": "", "modified": "2023-12-06T15:10:16.397000", "created": "2023-12-06T15:10:16.397000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 223, "domain": 383, "URL": 1639, "hostname": 560, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d657f0895a860febf8f", "name": "SafeFrame Container", "description": "", "modified": "2023-12-06T15:04:05.932000", "created": "2023-12-06T15:04:05.932000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1416, "domain": 2979, "URL": 8250, "hostname": 2262 }, "indicator_count": 14907, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c13ee010f81d3f9b3af", "name": "Malware hosting - hostrocket.com", "description": "", "modified": "2023-12-06T14:58:27.115000", "created": "2023-12-06T14:58:27.115000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 232, "hostname": 963, "domain": 412, "URL": 2337, "email": 3, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3949, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d20f7e10c1e37fcf89", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2023-12-06T14:10:26.301000", "created": "2023-12-06T14:10:26.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1078, "domain": 838, "hostname": 1607, "URL": 4134, "email": 3, "FileHash-SHA1": 2, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fe17dfdfe16066d16de", "name": "Bexar.org", "description": "", "modified": "2023-12-06T14:06:25.800000", "created": "2023-12-06T14:06:25.800000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1735, "hostname": 1833, "domain": 1025, "URL": 4668, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9409, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f8475d8a8785dfc5a2f", "name": "Zetalytics API", "description": "", "modified": "2023-12-06T14:04:52.250000", "created": "2023-12-06T14:04:52.250000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 754, "hostname": 833, "domain": 441, "URL": 2375, "CIDR": 5, "FileHash-MD5": 2, "email": 1 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6426dda295502d82e6e6ef7f", "name": "v4 - Hybrid scan uploaded + all suggested ioc's - vendor.3a0e728a.js another gem in edge on twitter.com/i/flow/login source code", "description": "WebpackChunk_Twitter-responsive_web is built on a single web address, which will allow users to upload images, tweets and videos to be stored in the same place as the hashtag.", "modified": "2023-03-31T13:18:26.733000", "created": "2023-03-31T13:18:26.733000", "tags": [ "trojan", "apt", "ansi", "memoryfile scan", "error", "runtime data", "typeof e", "regexp", "array", "object", "typeof t", "void", "null", "unknown", "path", "facebook", "4096", "suspicious", "meta", "lazy", "entity", "union", "body", "idkey", "scroll", "backspace", "insert", "roboto", "target", "stack", "hybrid", "model", "click", "stream", "strings", "qakbot", "pattern match", "ud801", "ud804", "ud805", "ud806", "ud81a", "ud835", "ud800", "ud802", "sha1", "sha256", "vendor.3a0e728a.js" ], "references": [ "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1353, "hostname": 222, "domain": 221, "FileHash-SHA256": 85, "FileHash-MD5": 3, "FileHash-SHA1": 1 }, "indicator_count": 1885, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1157 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63c8e04d8e7541291b89f4a1", "name": "whitelisted angular.js", "description": "", "modified": "2023-02-18T15:00:23.103000", "created": "2023-01-19T06:16:45.770000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1843, "hostname": 471, "domain": 246, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 444, "CVE": 1 }, "indicator_count": 3257, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1198 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63c8e04f8962fa3ac0c7eb77", "name": "whitelisted angular.js", "description": "", "modified": "2023-01-19T06:16:47.672000", "created": "2023-01-19T06:16:47.672000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 408, "hostname": 48, "domain": 59, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 518, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1228 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "634b4481d97a69446b750e82", "name": "adsbygoogle.js hybrid-A ts 55/100 seems mych worse here", "description": "", "modified": "2022-10-15T23:52:08.907000", "created": "2022-10-15T23:38:41.311000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "memoryfile scan", "error", "null", "string", "runtime data", "number", "object", "chrome", "void", "date", "android", "path", "iframe", "window", "this", "trident", "meta", "suspicious", "infinity", "hybrid", "close", "click", "general", "strings", "malicious", "august" ], "references": [ "https://hybrid-analysis.com/sample/fbba6129666c709aae5bcc8f49cffc28ad0d0c6d5b22fb4ee69da66e5d5fd7d9/634753ff96b237006c46584e" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 62, "URL": 835, "domain": 65, "FileHash-SHA256": 81, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 1045, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1323 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628ce74526894454664e1bab", "name": "cloudron.io", "description": "function ar(aw,av,au,at) is a new version of the Matomo tracker, which allows users to track where a tracker has been located, and when it is activated.", "modified": "2022-06-23T00:03:28.624000", "created": "2022-05-24T14:10:13.562000", "tags": [ "span", "type", "href", "tbody", "tfoot", "thead", "input", "helvetica neue", "helvetica", "arial", "twitter", "date", "docviewtop", "shadow", "rocketchat", "sogo", "gitlab", "wordpress", "matomo", "kanboard", "taiga", "ninja", "slow", "scroll", "dom exception", "google", "regexp", "mmm d", "mmmm d", "null", "this", "number", "destroy", "controller", "array", "error", "android", "false", "function", "index", "slickcenter", "slick", "object", "translate", "translate3d", "jquery", "typeof c", "copyright", "bootstrap", "javascript", "azaz", "popover", "typeof f", "typeof b", "width", "pseudo", "child", "sufeffxa0", "class", "accept", "string", "please", "blob", "post", "link", "license" ], "references": [ "https://analytics.cloudron.io/piwik.js", "https://www.cloudron.io/3rdparty/jquery-1.11.0.js", "https://www.cloudron.io/3rdparty/bootstrap.min.js", "https://www.cloudron.io/3rdparty/slick.js", "https://www.cloudron.io/3rdparty/angular.min.js", "https://www.cloudron.io/3rdparty/angular-loader.min.js", "https://www.cloudron.io/3rdparty/angular-route.min.js", "https://www.cloudron.io/3rdparty/angular-base64.min.js", "https://www.cloudron.io/index.js", "https://www.cloudron.io/3rdparty/bootstrap.min.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 541, "URL": 1300, "domain": 180, "FileHash-SHA256": 72, "FileHash-SHA1": 1 }, "indicator_count": 2094, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1438 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6280aa12040a569d19f6285f", "name": "possibly a central bank", "description": "Tobias Ahlin,", "modified": "2022-06-14T00:00:05.659000", "created": "2022-05-15T07:21:54.499000", "tags": [ "regexp", "typeof e", "function", "typeof t", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "reduceright", "number", "string", "l420", "g8m7ft2s1tv", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeerror", "symbol", "generator", "typeof n", "array", "promise", "weakmap", "typeof f", "natb", "409764", "animation", "suspense", "context", "forwardref", "deleted", "10252", "meta", "facebook", "unknown", "scroll", "backspace", "insert", "typeof symbol", "typeof c", "typeof s", "sprintf", "syntaxerror", "vhyj", "diefg", "bcdiefguxx", "constructor", "param", "rockn", "createclass", "source", "super", "infinity", "false", "contact", "internal", "phonenumber", "middle", "path", "redemption", "pass", "click", "cont", "albania", "armenia", "burma", "belarus", "cuba", "panama", "paraguay", "slovakia", "chad", "uruguay", "prop", "invert", "flip", "close", "small", "green", "union", "indonesia", "lucia", "martin", "mexico", "code", "apache", "blin", "slave", "gondi", "icelandic", "ganda", "zulu", "christmas", "burkina", "czech", "ukraine", "android", "format", "updater", "next", "hooks", "harmony", "trim", "python", "push", "shift", "slice", "shadowsizzle", "domdata", "hexchars", "agent", "launcher", "fail", "bind", "trident", "getclass", "body", "widget", "areasmodule", "duip", "hlwq", "fz5i", "dehu", "tbh0", "fwir", "x7am", "pcnd", "valr", "boolean", "portal", "partner", "ascio partner", "ascio", "tlds", "login en", "en de", "join today", "idns", "skip", "ascio domains", "tlds offered", "global whois", "checker", "helvetica neue", "arial", "d67a60", "inter", "baskerville", "15px", "180deg", "135deg", "video", "init", "wrap", "flip direction", "stop animation", "scale", "htmlelement", "hide", "typeof", "property", "fill", "noscroll", "matrix", "skew", "look", "julian garnier", "mit license", "typeof define", "typeof module", "htmlcollection", "255a", "qnull", "float32array", "nfunction", "tobias ahlin", "github", "spotify", "hyper island", "strong", "tobias", "read", "view", "ahlin bjerrome", "minecraft", "view project", "spinkit", "lookback", "ruby", "hello" ], "references": [ "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "https://tobiasahlin.com/js/app.js?v=1", "https://tobiasahlin.com/js/portfolio.js", "https://tobiasahlin.com/css/site.css", "https://ascio.com", "https://portal.ascio.com/login", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://js.hs-scripts.com/20704235.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "hostname": 1221, "domain": 2558, "FileHash-SHA256": 622, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1447 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627ee9ff7d36c1432328ebe7", "name": "\u041b\u0438\u043d\u0438\u044f \u043f\u043e\u043c\u043e\u0449\u0438 \u00ab\u0414\u0435\u0442\u0438 \u043e\u043d\u043b\u0430\u0439\u043d\u00bb \u2014 \u0424\u043e\u043d\u0434 \u0420\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442 FID.SU", "description": "Foundation for Internet development \u2013 Soviet Union", "modified": "2022-06-12T00:06:23.557000", "created": "2022-05-13T23:30:07.788000", "tags": [ "cecece", "e9031d", "domen su", "font awesome", "license", "bootstrap", "sil open", "font license", "less", "sass", "mit license", "cc by", "dave gandy", "contact", "twitter", "class", "regexp", "null", "array", "pseudo", "child", "x20trnf", "name", "attr", "cfunction", "error", "block", "last", "parent", "blogger", "diary", "digg", "evernote", "facebook", "google plus", "juick", "linkedin", "liveinternet", "livejournal", "youtube", "function", "width", "date", "accept", "gc", "65535", "boolean", "counter", "typeof c", "segoe ui", "typeerror", "lucida", "ecommerce", "ext link", "form", "impact", "light" ], "references": [ "http://www.fid.su/projects/detionline", "http://mc.yandex.ru/metrika/watch.js", "xfe-IP-172.247.55.179-stix2-2.1-export.json", "xfe-URL-cnservers.com-stix2-2.1-export.json", "xfe-URL-Ceranetworks.com-stix2-2.1-export 2.json", "http://www.youtube.com/embed/Bo_238D72rw?rel=0", "http://yandex.st/share/share.js", "http://www.fid.su/js/toggleTree.js", "http://www.fid.su/js/show.js", "http://www.fid.su/js/jquery-1.8.2.min.js", "http://cdnjs.cloudflare.com/ajax/libs/font-awesome/3.1.0/css/font-awesome.css", "http://www.fid.su/css/index.css" ], "public": 1, "adversary": "", "targeted_countries": [ "New Caledonia" ], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1817, "hostname": 705, "domain": 381, "FileHash-SHA256": 201, "email": 2 }, "indicator_count": 3106, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1449 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "627a3399312417bb7f844a55", "name": "hoster.kz", "description": "WebPacker.ru is a web-based tool designed to help people find and find the best way to get through the web, but only if you are a browser user or an administrator.", "modified": "2022-06-09T00:00:13.607000", "created": "2022-05-10T09:42:49.434000", "tags": [ "regexp", "null", "shift", "function", "click", "bksp", "width", "body", "namedepartment", "altgr", "span", "date", "error", "class", "this", "refresh", "prop", "close", "accept", "jquery", "iframe", "embed", "inputmask", "void", "chrs", "alternation", "seeknext", "type", "input", "masktoken", "window", "mask", "form", "backspace", "insert", "qe", "copyright", "closure library", "trackevent", "number", "string", "version", "uint8array", "gtmn3zrpw", "host", "path", "derek", "code", "bapunycode", "s700", "index", "label", "link", "stylesheet", "textcss", "script", "array", "10000", "style", "xmlhttprequest", "load", "virtualpageview", "ymuid", "post" ], "references": [ "xfe-IP-185.100.65.26-stix2-2.1-export.json", "xfe-URL-Hoster.kz-stix2-2.1-export.json", "https://almapbx.hoster.kz/hoster_v2/widget/lead_hunter/?code=75455&protocol=https://&url=https://hoster.kz/", "https://bitrix.info/ba.js", "https://www.googletagmanager.com/gtm.js?id=GTM-N3ZRPW", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1055680023/?random=1652174969236&cv=9&fst=1652174969236&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg590&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fhoster.kz%2F&ref=https%3A%2F%2Fhoster.kz%2F&tiba=%D0%A5%D0%BE%D1%81%D1%82%D0%B8%D0%BD%D0%B3%20%D0%B2%20%D0%9A%D0%B0%D0%B7%D0%B0%D1%85%D1%81%D1%82%D0%B0%D0%BD%D0%B5%2C%20%D0%BA%D1%83%D0%BF%D0", "https://almapbx.hoster.kz/hoster_v2/widget/lead_hunter/js/jquery.inputmask.bundle.js", "https://hoster.kz/js/html5.js", "https://hoster.kz/js/jcarousellite_1.0.1.pack.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Qe", "display_name": "Qe", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3010, "hostname": 1225, "domain": 1427, "FileHash-SHA256": 136, "CVE": 1, "email": 2 }, "indicator_count": 5801, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1452 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62752a3d78ce35783bfc85cc", "name": "SafeFrame Container", "description": "If you want to know what is going to happen when you create a non-iterable object, try these three pieces of code in the form of a new \"word\" or \"phrase\".", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T14:01:33.267000", "tags": [ "public", "typeof", "typeof define", "array", "typeerror", "typeof symbol", "error", "typeof enulle", "sdkversion", "internal", "date", "cnzzdata", "czuuid", "umdistinctid", "typeof e", "typeof t", "version", "swiper", "most", "copyright", "mit license", "april", "trident", "win32", "class", "lh", "vd", "function", "overlaylevel", "zdhxiong", "customevent", "symbol", "object", "string", "number", "null", "uint8array", "typeof b", "iframe", "android", "embed", "meta", "0x14a", "0x104", "0x97", "0xe1", "0x228", "0x12b", "0x14e", "0xf5", "0x11a", "0xc6", "sxa0", "typeof d", "closure library", "array int8array", "b1342177279", "regexp", "typeof r", "pseudo", "child", "typeof n", "template", "void", "this", "ienew ca", "quota", "aafunction", "dafunction", "gc", "trackpageview", "trackevent", "gtmmdcvhgd", "node", "element", "path", "reduceright", "p420", "gc3w7t6h5qw", "kafunction", "fafafa", "xlfunction", "kkfunction", "nkfunction", "qkfunction", "rkfunction", "skfunction", "span", "edge", "bad idp", "bad event", "crios", "invalid attempt", "afunction", "ufunction", "kfunction" ], "references": [ "xfe-URL-himado.com-stix2-2.1-export.json", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "xfe-URL-Psychz.net-stix2-2.1-export.json", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://himado.com/heihei/layui/layui.all.js", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "https://himado.com/heihei/js/swiper.min.js", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "xfe-URL-Aliyun.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lh", "display_name": "Lh", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2262, "URL": 8251, "FileHash-SHA256": 1416, "domain": 2979 }, "indicator_count": 14908, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1456 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62751d6e20ce7971fe122760", "name": "layerhost.com", "description": "function ra(a,b,c,d,e,f, a new type of node, which can only be defined by its own type, is the same as its current type.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T13:06:54.626000", "tags": [ "typeerror", "function", "string", "urlsearchparams", "array", "object", "typeof t", "incorrect", "boolean", "iterator", "target", "error", "typeof o", "date", "typeof symbol", "window", "promise", "iere", "typeof ne", "null", "body", "this", "regexp", "please", "blob", "matomo", "post", "javascript", "link", "license", "info", "campaigns", "storagetest", "typeof json", "sufeffxa0", "typeof c", "document", "invalid attempt", "chat", "search", "language", "feel", "file", "call", "strongstart", "address", "again", "attrs", "cparseint", "dparseint", "bparseint", "9999px", "fparseint", "eparseint", "bnull", "gparseint", "iparseint", "blank", "trident", "fixedpos", "fixedheader", "click", "rotate", "dataslider", "eventtarget", "basicstructure", "moztransition", "gthis", "preventdefault", "bthis", "regexcss", "xthis", "true", "filterizr api", "filterizr", "value", "ease", "steps", "idle", "classcallcheck", "reveal", "init", "drilldown", "dropdown", "dropdownmenu", "orbit", "slider", "burn", "sticky", "keyboard", "eventkey", "apple cmd", "mapping", "mouse", "input", "cache", "button", "checkbox", "shift", "typeof b", "pseudo", "child", "class", "attr", "void", "secure", "result" ], "references": [ "xfe-IP-134.73.11.118-stix2-2.1-export.json", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "https://www.powr.io/powr.js?platform=html", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://www.layerhost.com/assets/js/vendor/what-input.js", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://www.layerhost.com/assets/js/yui.js", "https://www.layerhost.com/assets/js/app.js", "https://www.layerhost.com/assets/js/slider.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://tag.aticdn.net/616708/smarttag.js", "https://analytics.gandi.net/piwik.js", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "EventTarget", "display_name": "EventTarget", "target": null }, { "id": "Filterizr API", "display_name": "Filterizr API", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 350, "URL": 2035, "hostname": 718, "FileHash-SHA256": 355, "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3461, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1456 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626b070ed44bcc9ad7b76bab", "name": "PSI Software AG - Software f\u00fcr Energieversorger, Industrieunternehmen und Infrastrukturbetreiber", "description": "PSI Software AG (PSI) is best known for its smart city software, which is also its Smart City software and a range of other product-enhancing technologies, such as smart cities.", "modified": "2022-05-28T00:03:46.141000", "created": "2022-04-28T21:28:46.014000", "tags": [ "span", "tbody", "tfoot", "thead", "fontawesome", "multiple", "woff", "truetype", "type", "href", "alpha", "twitter", "false", "parsley", "error", "typeof t", "fieldmultiple", "function", "regexp", "select", "typeof", "validator", "typeof n", "form", "datavalidation", "user", "return", "body", "cursor", "validate", "checkbox", "write", "selectedindex", "date", "true", "value", "index", "null", "name", "prop", "class", "hooks", "this", "jquery", "open", "scroll", "click", "seed", "target", "code", "accept", "local", "speed", "back", "bounce", "february", "april", "june", "august", "next", "string", "number", "trackevent", "copyright", "path", "host", "uint8array", "xhfunction", "download", "void", "softwarel\u00f6sungen", "prozesssteuerung", "leitsystem", "branchensoftware", "erp", "mes", "pps", "netzleittechnik", "fertigungsleitsystem", "automatisierung", "psi software", "psi blog", "toggle dropdown", "aktienrckkauf", "news", "umsatzwachstum", "formwechsel", "software", "versorger und", "english deutsch", "green", "messen" ], "references": [ "xfe-URL-Psi.de-stix2-2.1-export.json", "https://www.googletagmanager.com/gtm.js?id=GTM-NF2ZT3", "https://www.psi.de/typo3temp/scriptmerger/uncompressed/head-e2b75d5cfe54ba9b7d678cb1c848421f.merged.js", "https://www.psi.de/typo3temp/scriptmerger/uncompressed/head-bd4b8119586687574cf8f8529359d678.merged.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "selectedIndex", "display_name": "selectedIndex", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 232, "URL": 425, "FileHash-SHA256": 157, "domain": 225, "FileHash-MD5": 4 }, "indicator_count": 1043, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1464 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626b06ae6171c5d04f1bab38", "name": "PSI Software AG - Software f\u00fcr Energieversorger, Industrieunternehmen und Infrastrukturbetreiber", "description": "PSI Software AG (PSI) is best known for its smart city software, which is also its Smart City software and a range of other product-enhancing technologies, such as smart cities.", "modified": "2022-05-28T00:03:46.141000", "created": "2022-04-28T21:27:10.738000", "tags": [ "span", "tbody", "tfoot", "thead", "fontawesome", "multiple", "woff", "truetype", "type", "href", "alpha", "twitter", "false", "parsley", "error", "typeof t", "fieldmultiple", "function", "regexp", "select", "typeof", "validator", "typeof n", "form", "datavalidation", "user", "return", "body", "cursor", "validate", "checkbox", "write", "selectedindex", "date", "true", "value", "index", "null", "name", "prop", "class", "hooks", "this", "jquery", "open", "scroll", "click", "seed", "target", "code", "accept", "local", "speed", "back", "bounce", "february", "april", "june", "august", "next", "string", "number", "trackevent", "copyright", "path", "host", "uint8array", "xhfunction", "download", "void", "softwarel\u00f6sungen", "prozesssteuerung", "leitsystem", "branchensoftware", "erp", "mes", "pps", "netzleittechnik", "fertigungsleitsystem", "automatisierung", "psi software", "psi blog", "toggle dropdown", "aktienrckkauf", "news", "umsatzwachstum", "formwechsel", "software", "versorger und", "english deutsch", "green", "messen" ], "references": [ "xfe-URL-Psi.de-stix2-2.1-export.json", "https://www.googletagmanager.com/gtm.js?id=GTM-NF2ZT3", "https://www.psi.de/typo3temp/scriptmerger/uncompressed/head-e2b75d5cfe54ba9b7d678cb1c848421f.merged.js", "https://www.psi.de/typo3temp/scriptmerger/uncompressed/head-bd4b8119586687574cf8f8529359d678.merged.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "selectedIndex", "display_name": "selectedIndex", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 232, "URL": 425, "FileHash-SHA256": 157, "domain": 225, "FileHash-MD5": 4 }, "indicator_count": 1043, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1464 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6266c416c4598fa139868c64", "name": "\u05de\u05e9\u05e8\u05d3 \u05e4\u05e8\u05e1\u05d5\u05dd \u05d5\u05d1\u05e0\u05d9\u05d9\u05ea \u05d0\u05ea\u05e8\u05d9\u05dd | TOPWEB - \u05d8\u05d5\u05e4 \u05d5\u05d5\u05d1- \u05d4\u05d5\u05e4\u05db\u05d9\u05dd \u05e2\u05e1\u05e7\u05d9\u05dd \u05dc\u05de\u05d5\u05ea\u05d2\u05d9\u05dd \u05d1\u05d3\u05d9\u05d2\u05d9\u05d8\u05dc", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-25T15:53:58.206000", "tags": [ "init", "803911410135716", "pageview", "date", "datalayer", "gtmnqnvc6k", "copyright", "closure library", "facebook", "google", "linkedin", "reddit", "tumblr", "digg", "stumbleupon", "telegram", "whatsapp", "email", "kfunction", "u05deu05dcu05d0", "aw363516812", "error", "promise", "inull", "webfontconfig", "webfont", "gc", "number", "string", "uint8array", "regexp", "xhfunction", "yhfunction", "host", "path", "code", "topweb", "top web", "beyond", "forex", "hackeru", "one stop", "shop", "bgroup", "typesubmit", "datasecret", "shape", "html", "span", "false", "scrl", "haschildren", "zoomindown", "show hide", "dark", "checkbox", "back", "light", "typeof e", "formdata", "typeof symbol", "customevent", "post", "refill", "wpcf7", "wpcf7locale", "wpcf7unittag", "reflect", "math", "array", "object", "typeerror", "symbol", "function", "null", "title", "body", "click", "lecount", "count", "typeof define", "typeof t", "this", "close", "twitter", "open", "next", "blank", "xpercent0", "failure", "xpercent50", "essential grid", "blackberry", "author", "themepunch", "android", "typeof module", "tweenlite", "version", "onull", "updates and", "tools", "linear", "ticker", "bounce", "alpha", "fancybox", "plugin", "janis skarnelis", "100n", "right", "bottom", "left", "html tags", "ox20trnf", "dom element", "class", "attr", "pseudo", "child", "js foundation", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "source", "image", "ud83dudc6cud83c" ], "references": [ "xfe-URL-anyweb.co.il-stix2-2.1-export.json", "https://anyweb.co.il/wp-includes/js/wp-emoji-release.min.js?ver=5.7.3", "https://anyweb.co.il/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "https://anyweb.co.il/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/lightbox.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.tools.min.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.essential.min.js?ver=2.0.9.1", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/assets.js?ver=5.7.3", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/post-like.min.js?ver=1.0", "https://anyweb.co.il/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://anyweb.co.il/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/script.js", "https://anyweb.co.il/wp-includes/js/wp-embed.min.js?ver=5.7.3", "https://anyweb.co.il/wp-includes/css/dist/block-library/style.min.css?ver=5.7.3", "https://topweb.co.il/", "https://www.googletagmanager.com/gtm.js?id=GTM-NQNVC6K", "https://topweb.co.il/wp-content/plugins/litespeed-cache/assets/js/webfontloader.min.js", "https://topweb.co.il/wp-content/litespeed/js/c3a18f91ebd798da3e120a12aec7c615.js?ver=7c615", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/363516812/?random=1650901467024&cv=9&fst=1650901467024&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4k0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Ftopweb.co.il%2F&tiba=%D7%9E%D7%A9%D7%A8%D7%93%20%D7%A4%D7%A8%D7%A1%D7%95%D7%9D%20%D7%95%D7%91%D7%A0%D7%99%D7%99%D7%AA%20%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%7C%20TOPWEB%20-%20%D7%98%D" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1158, "FileHash-SHA256": 671, "hostname": 304, "domain": 329, "email": 2 }, "indicator_count": 2464, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1467 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628d21a4558f3ccf49c07931", "name": "abuse.ch", "description": "Looking for wizard spider. Some domains have .ru and .su (Soviet Union)", "modified": "2022-05-24T18:19:16.027000", "created": "2022-05-24T18:19:16.027000", "tags": [ "twitter follow", "button follow", "reduceright", "number", "string", "regexp", "error", "f420", "gmzsj4f05dr", "copyright", "deviceandgeo", "googlesignals", "json", "date", "void", "sxa0", "typeerror", "cbfunction", "deferred", "closure library", "b1342177279", "this", "infinity", "iframe", "trident", "show", "typeof e", "version", "hidden", "bootstrap", "click", "javascript", "clickdataapi", "collapse", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "button", "tridentmsieedge", "linux", "twttr", "area", "false", "twitter", "blank", "gvjsj", "gvjsyt", "license", "small batch", "apache license", "unless", "as is", "basis", "without", "warranties or", "null", "node", "dan vanderkam", "dygraph", "gc", "gvjs8s", "mmm dd", "infinity0", "gvjs6s", "mmm d", "axis", "cell", "column", "arial", "drawingframe", "select", "textarea", "line", "inside", "gvjsih", "rnrn", "roboto", "body", "template", "outside", "rial", "gvjsob", "azaz09", "array", "april", "june", "august", "february", "span", "android", "christ", "bbfunction", "twitter tweet", "font awesome", "free", "cc by", "sil ofl", "code", "mit license", "brands", "segoe ui", "emoji", "helvetica neue", "noto", "apple color", "symbol", "noto color", "typebutton", "sprymedia ltd", "datatables", "typeof f", "without any", "warranty", "merchantability", "fitness", "a particular", "adata", "first", "next", "typeof", "typeof n", "hide", "focusin", "focusout", "shown", "js foundation", "g5gqv3cj17n" ], "references": [ "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://bazaar.abuse.ch/js/datatables.min.js", "https://bazaar.abuse.ch/css/bootstrap.min.css", "https://bazaar.abuse.ch/css/all.min.css", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://www.gstatic.com/charts/50/loader.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://abuse.ch/js/twitter_widget.js", "https://abuse.ch/js/jquery-3.6.0.min.js", "https://abuse.ch/js/bootstrap.min.js", "https://abuse.ch/js/google-charts.js", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 560, "URL": 1639, "FileHash-SHA256": 223, "domain": 383, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1468 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62616627ee302d24b23523c3", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T14:11:51.629000", "tags": [ "tbody", "span", "thead", "tfoot", "multiple", "type", "href", "input", "halflings", "gradienttype1", "twitter", "false", "fontface", "fatface", "woff2", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "typesubmit", "function", "typeof c", "formdata", "this", "typeof define", "null", "typeof f", "object", "boolean", "typeof module", "error", "reflect", "math", "regexp", "number", "array", "typeerror", "string", "symbol", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "account", "open", "navitem", "text", "mainnav", "click", "blank", "copyright", "u0027", "value", "body", "firefox", "enum", "html", "msie", "applewebkit", "traceconsole", "form", "iframe", "legend", "nonmsdombrowser", "callbackindex", "callbackframeid", "eventtarget", "eventargument", "validation", "explorer", "target", "plugin", "bootstrap", "https", "conflict", "focus", "next", "trigger", "checkbox", "delta", "scroll", "sourceid", "date", "sessiontoken", "sessionexpires", "void", "rangeerror", "utf16", "illegal input", "global", "chrome", "opredge", "opera", "safari", "version", "sxa0", "browser", "typeof require", "dom node", "typeof d", "component", "typeof h", "bubble", "reduceright", "script", "typeof n", "jhnew ia", "gtm5sn6brv", "path", "host", "trackpageview", "gw8yd4p2eny", "select", "strong", "uint8array", "android", "verify", "stop", "enterprise", "widget", "window", "generator", "reload", "r300", "caca", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "please", "typeemail", "email", "jarallaxinner", "webkit", "property", "transform", "trident", "edge", "ipodi", "ipadi", "androidi", "blackberryi", "windows phonei", "xfunction", "pfunction", "wfunction", "show navigation", "mjquery", "typeof", "defaulttype", "hidden", "show", "shown", "startr", "endr", "federico zivolo", "distributed", "mit license", "statict", "flip" ], "references": [ "xfe-IP-78.142.35.163-stix2-2.1-export.json", "xfe-URL-Enom.com-stix2-2.1-export.json", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "https://4vendeta.com/assets/js/popper.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/js/global-functions.js", "https://cp.enom.com/js/punycode.min.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/js/cart.minicart.min.js", "https://cp.enom.com/js/openWin.min.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://cp.enom.com/scripts/Session.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://cdn.optimizely.com/js/26241557.js", "https://cp.enom.com/verisign-seal.htm", "https://cp.enom.com/global/TopMenu.ascx.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2989, "hostname": 1208, "domain": 634, "FileHash-SHA256": 302 }, "indicator_count": 5133, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1471 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626224efc28c918470fa07ed", "name": "inflect.com - malware", "description": "var e,t, r.o, is a new type of code, which can be used to build a website, but can't do so without a special code.. and the following:", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-22T03:45:51.681000", "tags": [ "object", "typeof symbol", "typeerror", "html", "body", "software", "pops", "width", "error", "provider", "null", "code", "trident", "trcomponent", "typeof t", "referenceerror", "component", "date", "array", "header", "contact", "backspace", "next", "footer", "copy", "february", "april", "june", "august", "open", "project", "this", "unknown", "heapdeps", "number", "hki3", "ogr1", "function", "regexp", "typeof self", "typeof", "facebook pixel", "pixel code", "symbol", "iterator", "constantvalue", "globalvariable", "facebook", "string", "boolean", "service", "phonenumber", "meta", "typeof e", "sesprops", "nthis", "href", "image", "input", "class", "logger", "download", "target", "form", "push" ], "references": [ "xfe-URL-inflect.com-stix2-2.1-export.json", "https://cdn.heapanalytics.com/js/heap-2001511295.js", "https://connect.facebook.net/signals/config/534474930374151?v=2.9.57&r=stable", "https://connect.facebook.net/en_US/fbevents.js", "https://cdn.segment.com/next-integrations/integrations/vendor/commons.54701049fd6fb8497e9e.js.gz", "https://cdn.segment.com/next-integrations/integrations/heap/2.1.2/heap.dynamic.js.gz", "https://storage.googleapis.com/inflect-frontend-assets/adb460de2098568d4c3580de1fde2f6690bcbd04/_next/static/s0TytVz2d0zNgb~bjg~~D/pages/search.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TrComponent", "display_name": "TrComponent", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1064, "FileHash-SHA256": 222, "hostname": 162, "domain": 294 }, "indicator_count": 1742, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1471 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62601d5f1c8672141d3c2afb", "name": "Malware hosting - rackip.com = astutemedia.asia", "description": "New RegExp:function(a,b), a new type, has its own built-up property, as well as an ability to store information in place when it is not already available.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-20T14:49:03.781000", "tags": [ "datasecret", "easeoutcubic", "jquery", "select", "span", "class js", "html", "topsearch", "menu", "mobile", "menu dropdown", "class", "retinaimagepath", "copyright", "imulus", "mit license", "retina", "function", "xmlhttprequest", "head", "contenttype", "imagei", "viljamis", "navigation", "date", "typeof h", "woothemes", "tyler smith", "documenttouch", "number", "knumber", "previous", "next", "supersubs", "joel birch", "dual", "google group", "fontsize", "whitespace", "nowrap", "float", "superfish", "changelog", "visibility", "hidden", "setposition", "isset", "srcyoutube", "srcvimeo", "image", "lightbox clone", "stephane caron", "typeof therel", "regexp", "play", "close", "isotope", "commercial use", "http", "david desandro", "metafizzy", "moz webkit", "o ms", "reset", "null", "value", "clamp", "nullrgba", "nullhsla", "execresult", "cache", "local", "right", "including", "this software", "but not", "limited to", "terms of", "open", "bsd license", "redistribution", "redistributions", "neither", "direct", "placeheld", "form", "wpcf7", "alert", "minimum", "tooshort", "unittag", "false", "fast", "typesubmit", "form plugin", "version", "requires jquery", "examples", "typeof define", "typeimage", "formdata", "stop", "modernizr", "custom build", "build", "afunction", "cfunction", "typeerror", "object", "kfunction", "pseudo", "child", "typeof b", "array", "error", "sufeffxa0", "attr", "void", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "source", "ud83dudc6cud83c", "secure", "result" ], "references": [ "http://www.powr.io/powr.js", "http://astutemedia.asia/rackip/wp-includes/js/wp-emoji-release.min.js?ver=5.5.9", "xfe-URL-astutemedia.asia-stix2-2.1-export.json", "http://astutemedia.asia/rackip/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/modernizr.js?ver=2.5.3", "http://astutemedia.asia/rackip/wp-includes/js/comment-reply.min.js?ver=5.5.9", "http://astutemedia.asia/rackip/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=3.51.0-2014.06.20", "http://astutemedia.asia/rackip/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=4.5.1", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.easing.js?ver=1.2", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.color.js?ver=2.0", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.isotope.min.js?ver=1.0", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.prettyPhoto.js?ver=3.0", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/superfish.js?ver=1.4.8", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/supersubs.js?ver=0.2", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.flexslider-min.js?ver=1.8", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/tinynav.min.js?ver=1.03", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/retina.min.js?ver=1.1.0", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/custom.js?ver=1.0", "http://astutemedia.asia/rackip/wp-includes/js/wp-embed.min.js?ver=5.5.9", "xfe-URL-Powr.io-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 515, "URL": 1487, "domain": 242, "FileHash-SHA256": 351, "CVE": 1 }, "indicator_count": 2596, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1472 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625f492a0581b2eb202e47c9", "name": "Malware hosting - hostrocket.com", "description": "ChunkLoadError, a new type of error, failed to load a chunk of JavaScript, according to the web browser operator, E.noconflict.com, as well as the website itself.", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T23:43:38.539000", "tags": [ "jxuiwidget", "null", "function", "jxuihtmldiv", "date", "jxuilabel", "zendesk chat", "regexp", "api update", "jxuihtmla", "window", "chat", "void", "error", "loader", "back", "click", "close", "agent", "hello", "form", "banned", "cookie", "small", "legacy", "direct", "colorbox core", "style", "user style", "colorbox", "html", "6deg", "e5e5e5", "dbdbdb", "d2d2d2", "eaedef", "michael farrell", "home", "helvetica", "ssd shared", "page", "formnum", "hidden", "current", "hostrocket", "dotblock", "fast", "href", "price slider", "tooltip", "dotblock popup", "callback", "rect", "cycle plugin", "number", "auto", "shuffle", "manual", "roll", "speed", "stop", "false", "first", "look", "copyright", "gpl version", "http", "document", "ui effects", "width", "left", "bottom", "this", "atom", "html id", "price", "timer", "value", "processor", "example", "storage", "string", "class", "thecookie", "create", "thevalue", "param", "type", "pluginscookie", "author", "jquery", "u00a0", "option", "body", "optgroup", "multiple", "selectboxhover", "selectbox", "label", "control", "slideshow", "jack moore", "mit license", "overlay", "wrapper", "content", "loadedcontent", "loadingoverlay", "next", "iframe", "array", "attr", "tools", "ui library", "no copyrights", "or licenses", "like", "media", "john resig", "dual", "gtmkw8b5l", "classes", "host", "path", "element", "trackpageview", "typeerror", "typeof symbol", "typeof e", "typeof t", "referenceerror", "promise", "script", "boolean", "typeof n" ], "references": [ "xfe-URL-hostrocket.com-stix2-2.1-export 2.json", "https://www.googletagmanager.com/gtm.js?id=GTM-KW8B5L", "https://www.hostrocket.com/js/jquery-1.6.1.min.js", "https://www.hostrocket.com/js/jquery.tools.min.js", "https://www.hostrocket.com/js/jquery.colorbox-min.js", "https://www.hostrocket.com/js/jquery.selectBox.min.js", "https://www.hostrocket.com/js/jquery.cookie.js", "https://www.hostrocket.com/js/jquery.price_slider.js", "https://www.hostrocket.com/js/jquery-ui-1.8.13.custom.min.js", "https://www.hostrocket.com/js/jquery.cycle.all.js", "https://www.hostrocket.com/js/jquery.behavior.js", "https://www.hostrocket.com/contact-files/contact-form.js", "https://www.hostrocket.com/css/style.css", "https://www.hostrocket.com/css/colorbox.css", "https://www.hostrocket.com/css/style-nophone.css", "https://v2.zopim.com/bin/v/widget_v2.329.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 963, "email": 3, "domain": 412, "URL": 2338, "FileHash-SHA256": 232, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3950, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62549aabb033e7afc5069f98", "name": "Malware - victim=fr", "description": "Mme, Mlle, M. Compte, yn \u00f4l \u00c2\u00a31.5m (\u20ac2.4m; \u00e2\u201a\u00ac1m)", "modified": "2022-05-11T21:04:45.103000", "created": "2022-04-11T21:16:27.786000", "tags": [ "freebox", "free", "mois pendant", "sabonner voir", "fibre free", "la fibre", "votre", "wifi", "freebox en", "offre", "delta", "face", "prix", "date", "this", "typeof e", "true", "function", "left", "bottom", "html", "nullt", "false", "next", "february", "april", "june", "august", "atom", "cookie", "close", "null", "back", "bounce", "kolab", "target", "object", "tcfuiservice", "reflect", "typeof proxy", "boolean", "agree", "disagree", "select", "save", "learn", "click", "gnu gpl", "copyright", "javascript code", "license", "extwin1", "framed1", "roundcube", "webmail client", "script", "team", "format", "regexp", "software", "error", "pseudo", "child", "the software", "sufeffxa0", "class", "attr", "javascript", "express", "nous", "didomi", "typeof t", "hmuvfyyh", "sekindo", "lkqd", "aol cdn", "ffffff", "montserrat", "adsl", "offres adsl", "internet", "t\u00e9l\u00e9phone", "t\u00e9l\u00e9phonie", "mobiles", "forfaits mobiles", "tv", "t\u00e9l\u00e9vision", "vod", "vid\u00e9o \u00e0 la demande", "multiposte", "radio", "routeur", "freeplayer", "multiplay", "d\u00e9groupage", "total", "partiel", "e-mail", "mail", "m\u00e9l", "fournisseur d'acc\u00e8s", "i.s.p.", "isp", "internaute", "internautes", "france", "fran\u00e7ais", "zimbra", "le webmail", "free fait", "webmail imp", "cela n", "webmail zimbra", "stockage", "pour migrer", "accder", "testteltext", "sans", "testziptext", "testziptext i", "testteltext i", "typenumber", "screenh", "tvbycanal", "tvbycanal147", "tvbycanal204", "tvbycanal83", "tvbycanal80", "tvbycanal34", "4000", "typeof console", "console", "nullc", "nulld", "customevent", "msanimationend", "typeof n", "typeof r", "x20trnf", "width", "accept", "json", "moz o", "custom build", "https", "xmlhttprequest", "typeof module", "webkit", "android", "flash", "span", "un espace", "phpmysql", "helvetica" ], "references": [ "xfe-IP-212.27.63.109-stix2-2.1-export.json", "http://pageperso.free.fr/im/css/free.css", "http://passback.free.fr/pub/pp_300x250.html", "https://subscribe.free.fr/accesgratuit/index.html", "https://subscribe.free.fr/assets/js/vendor/modernizr.custom.js", "https://subscribe.free.fr/assets/js/vendor/jquery-1.9.1.min.js", "https://subscribe.free.fr/assets/js/plugins.min.js", "https://subscribe.free.fr/assets/js/vendor/wow.min.js", "https://subscribe.free.fr/assets/js/main.min.js", "https://subscribe.free.fr/assets/css/accesgratuit.min.css", "https://subscribe.free.fr/assets/css/app2.min.css", "https://webmail.free.fr/", "https://sdk.privacy-center.org/87df2f8d-232a-4617-8efc-3764b3bbd0c0/loader.js?target=webmail.free.fr", "https://webmail.free.fr/program/js/jquery.min.js?s=1510166541", "https://webmail.free.fr/program/js/app.min.js?s=1510166525", "https://sdk.privacy-center.org/ui-gdpr-en.a96c69ed0cb8f37a2deea6c49dd453517875ac60.js", "https://webmail.free.fr/plugins/jqueryui/js/jquery-ui.min.js?s=1510166524", "https://www.free.fr/freebox/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1078, "URL": 2104, "domain": 290, "FileHash-SHA256": 117, "FileHash-MD5": 4, "FileHash-SHA1": 2 }, "indicator_count": 3595, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625088e80292028d4e82311c", "name": "Botnet-malware -lgmhgjm.com", "description": "The full list of names and names of people who have taken part in the 2016 Olympics and Paralympics in Rio de Janeiro, Brazil, as part of the Rio Games, and as well as the 2017 Olympics in Brazil.", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T19:11:36.165000", "tags": [ "function", "param", "object", "return", "webpackrequire", "constructor", "clipboard", "typeof", "symbol", "typeerror", "error", "click", "null", "copy", "factory", "super", "date", "target", "mustflag", "html", "applewebkit", "ipad", "mqqbrowser", "base", "trident", "presto", "gecko", "khtml", "ios android", "android", "array", "2f2f2i2i0f", "eh0g", "exptable", "logtable", "typeof h", "typeof e", "regexp", "typeof n", "typeof t", "width", "typeof r", "pseudo", "class", "this", "accept", "false", "https", "zeno rocha", "typeof define", "select", "input", "textarea", "0x455d", "0x34260b", "0x4ce9d1", "avge", "tung", "3ctz", "n33m", "0x514351", "hn4d", "0x70c2f4", "push", "shift", "baidu", "instanceof", "adjust", "body", "nulli", "windowi", "typeof jquery", "tthis", "mspointerdown", "child", "sfunction", "microsoft yahei", "arial", "x20trnf", "version", "swiper", "most", "copyright", "mit license", "october", "win32", "meta", "parsefloat", "androidgi", "iphonegi", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "wifi", "saol", "fc2ppv12518005", "oretd633riana01", "hodv sex", "orec37502", "06inn01", "siro2661ol2401", "garea742kou01", "175cm9av", "attr", "typeof symbol", "root", "length", "indexof", "x0ax20x20x20x20", "location", "math", "0x10", "0x18", "history", "config", "slice", "cookie", "open", "onload", "adunit", "refresh", "style", "position", "creativetplid", "show", "tcmod", "tcheight", "height", "yahei", "truetype", "f8f8f8", "typeof module", "reserved", "18hdxxxx\u4e2d\u56fd", "\u5973\u4e3b\u7a7f\u8d8a\u88ab\u8089\u6765\u8089\u53bbnp", "\u7537\u753718\u7981\u6c61\u8089\u56fe\u65e0\u7801", "\u65e0\u7801\u4e9a\u6d32\u6210a\u4eba\u7247\u5728\u7ebf\u89c2\u770b", "ore572s04", "ore572s03", "ore572s02", "ore572s01", "fc2ppv117430501", "cmi1513707", "cmi1513706", "cmi1513705", "cmi1513704", "cmi1513703", "\u514d\u8d39\u89c6\u9891\u7231\u7231\u592a\u723d\u4e86\u7f51\u7ad9_\u8001\u8272\u9b3c\u5728\u7ebf\u7cbe\u54c1\u89c6\u9891\u5728\u7ebf\u89c2\u770b_\u767d\u6d01\u4e00\u591c\u88ab\u723d\u4e86\u4e03\u6b21_\u5fd8\u4e86\u6234\u80f8\u7f69\u88ab\u540c\u5b66\u6478\u4e86\u4e00\u8282\u8bfe", "viewport" ], "references": [ "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "http://www.lgmhgjm.com/common.js", "http://www.lgmhgjm.com/tj.js", "http://www.sp385.com/", "http://avtv10.com", "http://9766.tv", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "https://xc.6xc.tv/css/index.css", "https://xctg07.cc/?channelCode=xiaosu03_8", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "http://sdk.51.la/js-sdk-pro.min.js", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "http://kniveb.info/template/9c/ads/gonggao.js", "http://kniveb.info/", "https://koban360.com/ky/?shareName=1736.com", "https://koban360.com/ky/js/flexible.js", "https://koban360.com/ky/js/swiper.min.js", "https://koban360.com/ky/js/jquery.min.js", "https://koban360.com/ky/css/m.css?vs=1.7", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "https://xbt.0lunwen.com/3/js/flexible.js", "https://xbt.0lunwen.com/boinstall.js", "https://miaouuuc.com/?channelCode=852890&aid=852890", "https://miaouuuc.com/template/static/js/clipborad.min.js", "https://am96.vip/", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 482, "URL": 1383, "FileHash-SHA256": 104, "domain": 199, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2171, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1484 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62276abfaa65cd33f64331f8", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2022-04-07T00:04:02.553000", "created": "2022-03-08T14:39:59.235000", "tags": [ "march", "lookup go", "rescan add", "verdict report", "de summary", "http", "redirects links", "behaviour", "similar dom", "content api", "value", "search url", "search domain", "scan url", "url search", "domain scan", "url url", "motor vehicle", "aqb1", "eventsevent10", "meta", "show", "download go", "full url", "reverse dns", "resource", "windows nt", "win64", "khtml", "gecko", "response", "main", "milan", "apache", "paris", "accept" ], "references": [ "TarrantCounty3df.pdf", "TarantCounty2df.pdf", "TarrantCounty4df.pdf", "TarrantCounty5df.pdf", "tarrant23df.pdf", "TarrantCounty1df.pdf", "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf", "TarrantCounty6df.pdf", "TarrantCounty7df.pdf", "TarrantCounty10df.pdf", "TarrantCounty9df.pdf", "TarrantCounty17df.pdf", "TarrantCounty15df.pdf", "TarrantCounty12df.pdf", "TarrantCounty14df.pdf", "tarrantcounty8df.pdf", "TarrantCounty18df.pdf", "TarrantCounty19df.pdf", "TarrantCounty21df.pdf", "tarrantcounty22df.pdf", "TarrantCounty20df.pdf", "tarrantcountydf.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4134, "hostname": 1607, "domain": 838, "FileHash-SHA256": 1078, "FileHash-SHA1": 2, "email": 3, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1515 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6249a9e497137f9627e5a794", "name": "\u7f8e\u9ad8\u6885\u2014botnet", "description": "At.ts.t, At.com, is the new version of HTML, which can now be viewed in full on Google's web browser and on Apple's mobile app for the first time.", "modified": "2022-04-03T14:09:48.093000", "created": "2022-04-03T14:06:28.503000", "tags": [ "event", "null", "promise", "html", "width", "hasclass", "loadx20error", "ajaxcomplete", "unique", "609237fvvpkt", "push", "first", "open", "checkbox", "trigger", "jquery", "write", "blackberry", "android", "androidos", "firefox", "chrome", "skyfire", "opera", "opera mobi", "dolfin", "kindle", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "window", "shift", "date", "canvas", "tencent", "barrio", "slice", "regexp", "function", "typeof b", "error", "pseudo", "child", "array", "sufeffxa0", "class", "accept", "testflight", "typeof e", "typeof n", "typeof t", "typeof r", "x20trnf", "this" ], "references": [ "http://slulutz02.com/", "https://mgttse001.vip/static/js/jquery.js", "https://mgttse001.vip/template/m1938pc/pic/hf1", "https://m2855.com:35003/", "https://m9277.com/tsnew-download/index.html", "https://www.7631.app:8755/js/jquery-1.11.3.min.js", "https://www.7631.app:8755/js/xinstall_inner_e.min.js?v=1004", "https://www.7631.app:8755/js/mobile-detect.min.js?v=1004", "https://m9277.com/tsnew-download/js/jquery.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1048, "domain": 132, "hostname": 311 }, "indicator_count": 1491, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1519 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6249a9e3fcaee2fb956ffacc", "name": "\u7f8e\u9ad8\u6885\u2014botnet", "description": "At.ts.t, At.com, is the new version of HTML, which can now be viewed in full on Google's web browser and on Apple's mobile app for the first time.", "modified": "2022-04-03T14:06:27.271000", "created": "2022-04-03T14:06:27.271000", "tags": [ "event", "null", "promise", "html", "width", "hasclass", "loadx20error", "ajaxcomplete", "unique", "609237fvvpkt", "push", "first", "open", "checkbox", "trigger", "jquery", "write", "blackberry", "android", "androidos", "firefox", "chrome", "skyfire", "opera", "opera mobi", "dolfin", "kindle", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "window", "shift", "date", "canvas", "tencent", "barrio", "slice", "regexp", "function", "typeof b", "error", "pseudo", "child", "array", "sufeffxa0", "class", "accept", "testflight", "typeof e", "typeof n", "typeof t", "typeof r", "x20trnf", "this" ], "references": [ "http://slulutz02.com/", "https://mgttse001.vip/static/js/jquery.js", "https://mgttse001.vip/template/m1938pc/pic/hf1", "https://m2855.com:35003/", "https://m9277.com/tsnew-download/index.html", "https://www.7631.app:8755/js/jquery-1.11.3.min.js", "https://www.7631.app:8755/js/xinstall_inner_e.min.js?v=1004", "https://www.7631.app:8755/js/mobile-detect.min.js?v=1004", "https://m9277.com/tsnew-download/js/jquery.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1047, "domain": 132, "hostname": 311 }, "indicator_count": 1490, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1519 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621fff12d2c54f70fea90576", "name": "Bexar.org", "description": "", "modified": "2022-04-01T00:01:54.852000", "created": "2022-03-02T23:34:42.531000", "tags": [], "references": [ "www.bexar.org - urlscan.io.pdf", "bexar api 4.pdf", "bexar api 8.pdf", "bexar 6.pdf", "bexar api 2.pdf", "bexar api 7.pdf", "bexar api 3.pdf", "bexar api 9.pdf", "bexar api 12.pdf", "bexar api 17.pdf", "bexar api 15.pdf", "bexar api 18.pdf", "bexar api 10.pdf", "bexar api 19.pdf", "bexar api 20.pdf", "bexar api 13.pdf", "bexar api 21.pdf", "bexar api 14.pdf", "bexar api 22.pdf", "bexar1.pdf", "bexar api5.pdf", "bexar2.pdf", "bexar3.pdf", "bexar.org 3.2.22.pdf", "bexar6.pdf", "bexar5.pdf", "bexar api_1.pdf", "bexar10.pdf", "bexar api.pdf", "bexar_v1df.pdf", "bexarv4df.pdf", "bexarv2df.pdf", "bexarv6df.pdf", "bexasv3df.pdf", "bexarv7df.pdf", "bear_v apidf.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1833, "URL": 4669, "domain": 1025, "FileHash-SHA256": 1735, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9410, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1521 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621bc3aa050a6c5693595f25", "name": "Zetalytics API", "description": "", "modified": "2022-03-29T00:03:34.773000", "created": "2022-02-27T18:32:10.542000", "tags": [ "google", "google llc", "detected", "expand overall", "http", "amazonaes", "openssl", "lookup go", "rescan add", "verdict report", "behaviour", "june", "apache", "search url", "search domain", "scan url", "url search", "domain scan", "url url", "us summary", "line", "google maps", "api warning", "redirects links", "similar dom", "content api", "domains", "Ransomware" ], "references": [ "zetalytics .pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Win32:Cryptor", "display_name": "Win32:Cryptor", "target": null }, { "id": "TELPER:CERT:SoftwareBundler:Win32/Bunpredelt", "display_name": "TELPER:CERT:SoftwareBundler:Win32/Bunpredelt", "target": null }, { "id": "Trojan:Win32/Danabot.G", "display_name": "Trojan:Win32/Danabot.G", "target": "/malware/Trojan:Win32/Danabot.G" }, { "id": "Backdoor:Win32/Poison.E", "display_name": "Backdoor:Win32/Poison.E", "target": "/malware/Backdoor:Win32/Poison.E" }, { "id": "ALF:PUA:Block:IObit.R!MTB", "display_name": "ALF:PUA:Block:IObit.R!MTB", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 754, "URL": 2375, "domain": 441, "hostname": 833, "CIDR": 5, "FileHash-MD5": 2, "email": 1 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621ff16c60a508e18bbeeb9e", "name": "Webb County, TX", "description": "", "modified": "2022-03-02T22:36:28.218000", "created": "2022-03-02T22:36:28.218000", "tags": [], "references": [ "Webb County, TX 3.pdf", "Webb County, TX 1 .pdf", "Webb County, TX 2.pdf", "Webb County, TX 5 pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 364, "URL": 913, "domain": 104, "FileHash-SHA256": 126 }, "indicator_count": 1507, "is_author": false, "is_subscribing": null, "subscriber_count": 405, "modified_text": "1550 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf", "https://subscribe.free.fr/assets/js/plugins.min.js", "xfe-URL-ascio.com-stix2-2.1-export.json", "https://www.hostrocket.com/css/style.css", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "bexar.org 3.2.22.pdf", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://www.7631.app:8755/js/mobile-detect.min.js?v=1004", "http://www.fid.su/js/toggleTree.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c", "https://www.hostrocket.com/js/jquery-ui-1.8.13.custom.min.js", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/tinynav.min.js?ver=1.03", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://subscribe.free.fr/assets/js/main.min.js", "http://astutemedia.asia/rackip/wp-includes/js/wp-embed.min.js?ver=5.5.9", "TarrantCounty7df.pdf", "bexar2.pdf", "tarrantcountydf.pdf", "https://anyweb.co.il/wp-includes/js/wp-embed.min.js?ver=5.7.3", "TarrantCounty19df.pdf", "bexar1.pdf", "https://www.hostrocket.com/js/jquery.behavior.js", "https://www.cloudron.io/3rdparty/angular-loader.min.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "Webb County, TX 1 .pdf", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/363516812/?random=1650901467024&cv=9&fst=1650901467024&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4k0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Ftopweb.co.il%2F&tiba=%D7%9E%D7%A9%D7%A8%D7%93%20%D7%A4%D7%A8%D7%A1%D7%95%D7%9D%20%D7%95%D7%91%D7%A0%D7%99%D7%99%D7%AA%20%D7%90%D7%AA%D7%A8%D7%99%D7%9D%20%7C%20TOPWEB%20-%20%D7%98%D", "bexarv4df.pdf", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "bexar api 13.pdf", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "https://4vendeta.com/assets/js/popper.min.js", "bexar10.pdf", "http://www.fid.su/js/jquery-1.8.2.min.js", "https://topweb.co.il/", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "https://ascio.com", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.flexslider-min.js?ver=1.8", "TarrantCounty5df.pdf", "https://hybrid-analysis.com/sample/fbba6129666c709aae5bcc8f49cffc28ad0d0c6d5b22fb4ee69da66e5d5fd7d9/634753ff96b237006c46584e", "http://avtv10.com", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://www.psi.de/typo3temp/scriptmerger/uncompressed/head-bd4b8119586687574cf8f8529359d678.merged.css", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://am96.vip/", "bexar api5.pdf", "https://webmail.free.fr/program/js/app.min.js?s=1510166525", "Webb County, TX 3.pdf", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://hoster.kz/js/html5.js", "https://koban360.com/ky/?shareName=1736.com", "https://cdn.segment.com/next-integrations/integrations/vendor/commons.54701049fd6fb8497e9e.js.gz", "bexar api 22.pdf", "https://webmail.free.fr/plugins/jqueryui/js/jquery-ui.min.js?s=1510166524", "TarrantCounty6df.pdf", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.powr.io/powr.js?platform=html", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "bear_v apidf.pdf", "TarrantCounty9df.pdf", "https://www.layerhost.com/assets/js/vendor/what-input.js", "http://www.powr.io/powr.js", "https://connect.facebook.net/signals/config/534474930374151?v=2.9.57&r=stable", "https://www.cloudron.io/3rdparty/bootstrap.min.js", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "xfe-URL-anyweb.co.il-stix2-2.1-export.json", "bexar api 14.pdf", "bexar api 2.pdf", "xfe-URL-Ceranetworks.com-stix2-2.1-export 2.json", "xfe-IP-185.100.65.26-stix2-2.1-export.json", "xfe-URL-astutemedia.asia-stix2-2.1-export.json", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://www.cloudron.io/index.js", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "bexar api 18.pdf", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "TarantCounty2df.pdf", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/post-like.min.js?ver=1.0", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/modernizr.js?ver=2.5.3", "bexar_v1df.pdf", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "xfe-URL-Powr.io-stix2-2.1-export.json", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742", "bexar api 12.pdf", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://www.7631.app:8755/js/xinstall_inner_e.min.js?v=1004", "bexar api 15.pdf", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "bexar5.pdf", "https://abuse.ch/js/bootstrap.min.js", "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "bexar api 4.pdf", "https://bitrix.info/ba.js", "bexar api 19.pdf", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.isotope.min.js?ver=1.0", "https://anyweb.co.il/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/script.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://www.layerhost.com/assets/js/slider.js", "https://tobiasahlin.com", "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "TarrantCounty1df.pdf", "TarrantCounty14df.pdf", "http://www.youtube.com/embed/Bo_238D72rw?rel=0", "TarrantCounty15df.pdf", "bexarv7df.pdf", "https://cp.enom.com/js/global-functions.js", "https://abuse.ch/js/jquery-3.6.0.min.js", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "https://www.googletagmanager.com/gtm.js?id=GTM-NF2ZT3", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://bazaar.abuse.ch/css/all.min.css", "https://koban360.com/ky/js/swiper.min.js", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "xfe-URL-Hoster.kz-stix2-2.1-export.json", "xfe-URL-Psi.de-stix2-2.1-export.json", "https://xbt.0lunwen.com/boinstall.js", "https://www.7631.app:8755/js/jquery-1.11.3.min.js", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://bazaar.abuse.ch/css/bootstrap.min.css", "https://4vendeta.com/assets/js/jquery.min.js", "https://analytics.cloudron.io/piwik.js", "bexar3.pdf", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.essential.min.js?ver=2.0.9.1", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "bexar api 8.pdf", "xfe-URL-Psychz.net-stix2-2.1-export.json", "https://cp.enom.com/js/cart.minicart.min.js", "https://www.hostrocket.com/css/colorbox.css", "https://4vendeta.com/assets/js/bootstrap.min.js", "http://slulutz02.com/", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "http://www.fid.su/css/index.css", "https://storage.googleapis.com/inflect-frontend-assets/adb460de2098568d4c3580de1fde2f6690bcbd04/_next/static/s0TytVz2d0zNgb~bjg~~D/pages/search.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "http://kniveb.info/template/9c/ads/gonggao.js", "https://www.cloudron.io/3rdparty/angular-route.min.js", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://analytics.gandi.net/piwik.js", "https://subscribe.free.fr/assets/js/vendor/modernizr.custom.js", "https://www.hostrocket.com/js/jquery-1.6.1.min.js", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/lightbox.js?ver=2.0.9.1", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://miaouuuc.com/template/static/js/clipborad.min.js", "https://miaouuuc.com/?channelCode=852890&aid=852890", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.prettyPhoto.js?ver=3.0", "tarrantcounty22df.pdf", "https://www.hostrocket.com/js/jquery.cycle.all.js", "https://mgttse001.vip/template/m1938pc/pic/hf1", "www.bexar.org - urlscan.io.pdf", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.hostrocket.com/js/jquery.tools.min.js", "https://anyweb.co.il/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://abuse.ch/js/twitter_widget.js", "https://cdn.segment.com/next-integrations/integrations/heap/2.1.2/heap.dynamic.js.gz", "https://www.hostrocket.com/css/style-nophone.css", "https://anyweb.co.il/wp-content/plugins/contact-form-7/includes/js/index.js?ver=5.4.1", "http://yandex.st/share/share.js", "Webb County, TX 2.pdf", "xfe-URL-Aliyun.com-stix2-2.1-export.json", "https://sdk.privacy-center.org/87df2f8d-232a-4617-8efc-3764b3bbd0c0/loader.js?target=webmail.free.fr", "https://www.cloudron.io/3rdparty/angular.min.js", "https://www.psi.de/typo3temp/scriptmerger/uncompressed/head-e2b75d5cfe54ba9b7d678cb1c848421f.merged.js", "https://webmail.free.fr/program/js/jquery.min.js?s=1510166541", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://subscribe.free.fr/assets/css/app2.min.css", "https://cdn.heapanalytics.com/js/heap-2001511295.js", "https://almapbx.hoster.kz/hoster_v2/widget/lead_hunter/js/jquery.inputmask.bundle.js", "xfe-IP-212.27.63.109-stix2-2.1-export.json", "https://koban360.com/ky/js/flexible.js", "https://www.layerhost.com/assets/js/app.js", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "xfe-IP-172.247.55.179-stix2-2.1-export.json", "https://xctg07.cc/?channelCode=xiaosu03_8", "https://himado.com/heihei/layui/layui.all.js", "bexar api 9.pdf", "http://astutemedia.asia/rackip/wp-includes/js/wp-emoji-release.min.js?ver=5.5.9", "https://anyweb.co.il/wp-includes/css/dist/block-library/style.min.css?ver=5.7.3", "bienvenidosnewyork.com/app.php", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://cdn.optimizely.com/js/26241557.js", "https://www.free.fr/freebox/", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "bexar api 7.pdf", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/supersubs.js?ver=0.2", "https://almapbx.hoster.kz/hoster_v2/widget/lead_hunter/?code=75455&protocol=https://&url=https://hoster.kz/", "https://m9277.com/tsnew-download/js/jquery.min.js", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://subscribe.free.fr/assets/js/vendor/wow.min.js", "https://www.hostrocket.com/js/jquery.price_slider.js", "bexar api_1.pdf", "xfe-URL-cnservers.com-stix2-2.1-export.json", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.hostrocket.com/js/jquery.selectBox.min.js", "https://cp.enom.com/js/openWin.min.js", "https://tag.aticdn.net/616708/smarttag.js", "xfe-URL-hostrocket.com-stix2-2.1-export 2.json", "http://www.sp385.com/", "https://tobiasahlin.com/js/portfolio.js", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "https://anyweb.co.il/wp-content/themes/superfine/assets/js/assets.js?ver=5.7.3", "https://cp.enom.com/responsive/_js/bootstrap.js", "http://www.fid.su/projects/detionline", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "https://m9277.com/tsnew-download/index.html", "https://mgttse001.vip/static/js/jquery.js", "TarrantCounty20df.pdf", "bexar api 3.pdf", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://www.cloudron.io/3rdparty/jquery-1.11.0.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "bexar api.pdf", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0", "https://cp.enom.com/js/punycode.min.js", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.easing.js?ver=1.2", "https://www.hostrocket.com/js/jquery.colorbox-min.js", "https://xbt.0lunwen.com/3/js/flexible.js", "https://webmail.free.fr/", "https://www.cloudron.io/3rdparty/angular-base64.min.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1055680023/?random=1652174969236&cv=9&fst=1652174969236&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635470&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg590&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fhoster.kz%2F&ref=https%3A%2F%2Fhoster.kz%2F&tiba=%D0%A5%D0%BE%D1%81%D1%82%D0%B8%D0%BD%D0%B3%20%D0%B2%20%D0%9A%D0%B0%D0%B7%D0%B0%D1%85%D1%81%D1%82%D0%B0%D0%BD%D0%B5%2C%20%D0%BA%D1%83%D0%BF%D0", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://www.gstatic.com/charts/50/loader.js", "https://tobiasahlin.com/css/site.css", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "xfe-IP-78.142.35.163-stix2-2.1-export.json", "http://www.lgmhgjm.com/common.js", "http://astutemedia.asia/rackip/wp-content/plugins/contact-form-7/includes/js/jquery.form.min.js?ver=3.51.0-2014.06.20", "https://xc.6xc.tv/css/index.css", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "tarrantcounty8df.pdf", "https://koban360.com/ky/js/jquery.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-KW8B5L", "https://v2.zopim.com/bin/v/widget_v2.329.js", "http://kniveb.info/", "xfe-URL-himado.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/parallax.min.js", "bexar api 17.pdf", "https://hybrid-analysis.com/sample/9bf30967dfbf84d91ff4a1ca66dcd6c3383e679917e8b7aa4f659ff9f4e848d7/6426cf48655f94b6b303704c", "https://www.googletagmanager.com/gtm.js?id=GTM-NQNVC6K", "https://cp.enom.com/scripts/Session.min.js", "http://www.lgmhgjm.com/tj.js", "bexasv3df.pdf", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "https://www.hostrocket.com/contact-files/contact-form.js", "http://passback.free.fr/pub/pp_300x250.html", "https://www.cloudron.io/3rdparty/slick.js", "https://hoster.kz/js/jcarousellite_1.0.1.pack.js", "https://js.hs-scripts.com/20704235.js", "TarrantCounty3df.pdf", "https://subscribe.free.fr/assets/js/vendor/jquery-1.9.1.min.js", "https://anyweb.co.il/wp-content/plugins/essential-grid/public/assets/js/jquery.themepunch.tools.min.js?ver=2.0.9.1", "https://anyweb.co.il/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://9766.tv", "http://sdk.51.la/js-sdk-pro.min.js", "https://tobiasahlin.com/js/anime.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "TarrantCounty17df.pdf", "http://www.fid.su/js/show.js", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/superfish.js?ver=1.4.8", "xfe-URL-inflect.com-stix2-2.1-export.json", "TarrantCounty21df.pdf", "Webb County, TX 5 pdf", "http://astutemedia.asia/rackip/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=4.5.1", "https://sdk.privacy-center.org/ui-gdpr-en.a96c69ed0cb8f37a2deea6c49dd453517875ac60.js", "https://tobiasahlin.com/js/app.js?v=1", "https://www.layerhost.com/assets/js/yui.js", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://www.cloudron.io/3rdparty/bootstrap.min.css", "tarrant23df.pdf", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/jquery.color.js?ver=2.0", "bexar api 20.pdf", "https://connect.facebook.net/en_US/fbevents.js", "bexarv2df.pdf", "https://www.googletagmanager.com/gtm.js?id=GTM-N3ZRPW", "https://cp.enom.com/verisign-seal.htm", "https://www.hostrocket.com/js/jquery.cookie.js", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "TarrantCounty18df.pdf", "bexar 6.pdf", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://bazaar.abuse.ch/js/datatables.min.js", "bexar6.pdf", "bexar api 10.pdf", "https://portal.ascio.com/login", "https://koban360.com/ky/css/m.css?vs=1.7", "http://astutemedia.asia/rackip/wp-includes/js/comment-reply.min.js?ver=5.5.9", "bexar api 21.pdf", "TarrantCounty12df.pdf", "TarrantCounty4df.pdf", "http://pageperso.free.fr/im/css/free.css", "https://himado.com/heihei/js/swiper.min.js", "https://topweb.co.il/wp-content/plugins/litespeed-cache/assets/js/webfontloader.min.js", "bexarv6df.pdf", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "xfe-IP-134.73.11.118-stix2-2.1-export.json", "https://subscribe.free.fr/assets/css/accesgratuit.min.css", "http://mc.yandex.ru/metrika/watch.js", "http://astutemedia.asia/rackip/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js", "xfe-URL-Enom.com-stix2-2.1-export.json", "https://topweb.co.il/wp-content/litespeed/js/c3a18f91ebd798da3e120a12aec7c615.js?ver=7c615", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://cp.enom.com/global/TopMenu.ascx.js", "https://abuse.ch/js/google-charts.js", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/retina.min.js?ver=1.1.0", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "https://anyweb.co.il/wp-includes/js/wp-emoji-release.min.js?ver=5.7.3", "http://astutemedia.asia/rackip/wp-content/themes/servereza/js/custom.js?ver=1.0", "http://cdnjs.cloudflare.com/ajax/libs/font-awesome/3.1.0/css/font-awesome.css", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://subscribe.free.fr/accesgratuit/index.html", "https://m2855.com:35003/", "TarrantCounty10df.pdf", "zetalytics .pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Vd", "Eventtarget", "Reduceright", "Backdoor:win32/poison.e", "Lh", "Alf:pua:block:iobit.r!mtb", "Qe", "Gc", "Trcomponent", "Win.virus.polyransom-5704625-0", "Trojan:win32/danabot.g", "Selectedindex", "Telper:cert:softwarebundler:win32/bunpredelt", "Filterizr api", "Win32:cryptor" ], "industries": [ "Government" ], "unique_indicators": 87232 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/b.style", "whois": "http://whois.domaintools.com/b.style", "domain": "b.style", "hostname": "a.b.style" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 37, "pulses": [ { "id": "67a7f06a5d0f22ad92684646", "name": "WebForm.com.gov.pl/CEIDG/ScriptResource.axd", "description": "The following is the full text of the WebForm.com.gov.pl/CEIDG/ScriptResource.axd, following the following:.au, for the first time.", "modified": "2025-05-14T21:27:17.040000", "created": "2025-02-09T00:01:46.054000", "tags": [ "null", "nie mona", "array", "input", "nonmsdombrowser", "object", "html", "component", "body", "horizontal", "date", "calendar", "february", "april", "june", "august", "iframe", "form", "friday", "explorer", "target", "error", "legend", "this", "type", "regexp", "elem", "index", "function", "handle", "check", "safari", "expando", "android", "false", "hooks", "copy", "prop", "class", "mark", "window", "code", "capture", "accept", "seed", "override", "hook", "look", "loop", "install", "pass", "enough", "bind", "core", "local", "verify", "done", "find", "internal", "inject", "possible", "hold", "middle", "guard", "fall", "stop", "panic", "back", "restrict", "speed", "turn", "grab", "getclass", "jquery", "bubble", "anchor", "shift" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1143, "domain": 155, "hostname": 523, "FileHash-SHA256": 151 }, "indicator_count": 1972, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "381 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "594 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65709632333f37e8de4185e9", "name": "whitelisted angular.js", "description": "", "modified": "2023-12-06T15:41:38.498000", "created": "2023-12-06T15:41:38.498000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 245, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 424, "hostname": 466, "URL": 1805 }, "indicator_count": 3193, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ed8f7d4b5483117bb66", "name": "abuse.ch", "description": "", "modified": "2023-12-06T15:10:16.397000", "created": "2023-12-06T15:10:16.397000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 223, "domain": 383, "URL": 1639, "hostname": 560, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d657f0895a860febf8f", "name": "SafeFrame Container", "description": "", "modified": "2023-12-06T15:04:05.932000", "created": "2023-12-06T15:04:05.932000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1416, "domain": 2979, "URL": 8250, "hostname": 2262 }, "indicator_count": 14907, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c13ee010f81d3f9b3af", "name": "Malware hosting - hostrocket.com", "description": "", "modified": "2023-12-06T14:58:27.115000", "created": "2023-12-06T14:58:27.115000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 232, "hostname": 963, "domain": 412, "URL": 2337, "email": 3, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3949, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d20f7e10c1e37fcf89", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2023-12-06T14:10:26.301000", "created": "2023-12-06T14:10:26.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1078, "domain": 838, "hostname": 1607, "URL": 4134, "email": 3, "FileHash-SHA1": 2, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fe17dfdfe16066d16de", "name": "Bexar.org", "description": "", "modified": "2023-12-06T14:06:25.800000", "created": "2023-12-06T14:06:25.800000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1735, "hostname": 1833, "domain": 1025, "URL": 4668, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9409, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://a.b.style", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://a.b.style", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780257059.250412 }