{ "type": "URL", "indicator": "https://a.f.h.next", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://a.f.h.next", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3166238627, "indicator": "https://a.f.h.next", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 26, "pulses": [ { "id": "684c65464466dd19b089f325", "name": "Zesp\u00f3\u0142 Profilaktyki i Rehabilitacji w Janowicach Wielkich - YouTube", "description": "If d=void 0===c,w(\"trustedResourceUrl\",d: \"Trusted resourceUrl,\" thend=c.src,d, c.js, then d:", "modified": "2025-06-13T17:56:28.689000", "created": "2025-06-13T17:52:06.399000", "tags": [ "rehabilitacji w", "youtube tv", "dami jelenia", "tv dami", "jelenia gra", "zakupy wycz", "jeli", "nie korzystasz", "filmy", "aby tego", "copyright", "closure library", "argument", "ifunction", "error", "null", "type", "cast", "webchannel", "su2028u2029", "chrome", "xmlhttp", "kkvoid", "remotecontrol", "android", "unknown", "screen", "desktop", "function", "string", "array", "number", "vfunction", "f8192", "n432", "true", "j2048", "this", "window", "void", "date", "pokau017c", "pytfunction", "fe8function", "qgzfunction", "afunction", "hb28", "r150", "promise", "bigint", "post", "edge", "swhealthlog", "symbol", "trident", "infinity", "embed", "webkitkeyframes", "zoomin", "zoominx", "zoomoutx", "zoominy", "zoomouty", "2000px", "90deg", "20px", "30deg", "30px", "10px", "10deg", "3deg", "5deg", "djmegamenu", "use license", "tabindex", "menu", "close", "msie", "beforechange", "imagehassize", "buildcontrols", "magnific popup", "dmitry semenov", "http", "beforeclose", "afterclose", "open", "next", "open source", "bsd license", "george mcginley", "smith", "djimageslider", "subpackage", "webkit", "khtml", "icab", "countto", "callback", "handler", "object", "typeof", "method", "gnugplv2", "website", "set module", "height script", "regexp", "screenheight", "highcontrast2", "highcontrast3", "highcontrast", "wide", "night", "body", "normalbutton", "cookie plugin", "https", "klaus hartl", "mit license", "register", "nodecommonjs", "factory", "jquery", "write", "sticky bar", "stickybar", "count", "offcanvas", "html", "noscroll", "offcanvas var", "toggle nav", "click jquery", "ajax", "autocomplete", "tomas kirda", "typeof define", "esc27", "tab9", "return13", "left37", "up38", "twitter", "custom version", "joomla", "rolemenu", "boolean", "get adobe", "flash player", "title", "text", "typeof data", "typeof s", "accept", "width", "foundation", "backspace8", "comma188", "delete46", "down40", "end35", "enter13", "escape27", "value", "migrate", "backcompat", "quirks mode", "typeof f", "xtablet768", "document", "ui sortable", "leftright", "gnu general", "public license", "dddddd", "ffffcc", "eeeeee", "verdana", "geneva", "arial", "helvetica", "f0f0f0", "sans", "charset", "utf8", "fontawesome", "typeof b", "pseudo", "child", "sufeffxa0", "class", "attr", "general slider", "slide", "rgba", "navigation", "15deg", "300px", "20deg", "transition", "scale", "baskerville", "main image", "bdbdbd", "f3f3f3", "remove", "fontface", "woff2", "u0131", "u01520153", "u02bb02bc", "u02c6", "u02da", "u02dc", "u0304", "dirrtl", "msviewport", "href", "span", "legend", "halflings", "fieldset", "typeimage", "f2f2f2", "d9edf7", "dff0d8", "f2dede", "thead", "tbody", "tahoma", "00a0", "video", "script", "2500", "xnew ita", "dnew jta", "dataset", "orfunction", "prfunction", "nsafunction", "xsafunction", "vrfunction", "cakes", "ovbfunction", "pvbfunction", "rvbfunction", "qvbfunction", "tvbfunction", "uvbfunction", "vvbclass", "xvbclass", "yvbclass", "svbclass", "lvafunction", "ggfunction", "mvafunction", "ovafunction", "pvafunction", "uvafunction", "tvafunction", "qvafunction", "vvafunction", "nvaclass", "dark", "vector", "yy49", "raster", "roboto", "new tk", "qael", "przechyl", "mars", "mercury", "venus", "pluto", "titan", "weakset", "wfclass", "googlelayer", "uint8array", "weakmap", "5001", "mouseevent", "webassembly", "180180", "9090", "google maps", "javascript api", "internal", "small", "lightrail", "false", "february", "light", "hybrid", "bounce", "drop", "inside", "outside", "marker", "gc" ], "references": [ "embed.html", "ad_status.js.pobrane", "f5Y41t9wqY4.html", "cast_sender.js.pobrane", "remote.js.pobrane", "sw3VTUzeRvWIVwvWSyk6S5gHWPxOOwU1OxerozmN4Hw.js.pobrane", "embed.js.pobrane", "www-embed-player.js.pobrane", "animate.ext.css", "animate.min.css", "jquery.djmegamenu.js.pobrane", "jquery.djmobilemenu.js.pobrane", "magnific.js.pobrane", "jquery.easing.min.js.pobrane", "slider.js.pobrane", "jquery.countTo.js.pobrane", "scripts.js.pobrane", "magnific-init.js.pobrane", "pagesettings.js.pobrane", "jquery.cookie.js.pobrane", "stickybar.js.pobrane", "fontswitcher.js.pobrane", "offcanvas.js.pobrane", "jquery.autocomplete.min.js.pobrane", "bootstrap.min.js.pobrane", "jcemediabox.js.pobrane", "jquery.ui.core.min.js.pobrane", "jquery-migrate.min.js.pobrane", "layout.min.js.pobrane", "jquery.ui.sortable.min.js.pobrane", "caption.js.pobrane", "finder.css", "jquery-noconflict.js.pobrane", "djmegamenu.26.css", "animations.css", "djmobilemenu.css", "jquery.min.js.pobrane", "djimageslider.css", "offcanvas.css", "magnific.css", "font_switcher.26.css", "css", "template_responsive.26.css", "offcanvas.26.css", "bootstrap_responsive.26.css", "extended_layouts.26.css", "style.css", "content.css", "template.26.css", "bootstrap.26.css", "jcemediabox.css", "js", "onion.js.pobrane", "search_impl.js.pobrane", "overlay.js.pobrane", "map.js.pobrane", "util.js.pobrane", "search.js.pobrane", "common.js.pobrane", "geometry.js.pobrane", "main.js.pobrane" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2779, "hostname": 661, "domain": 684, "email": 4, "FileHash-MD5": 1, "FileHash-SHA256": 689 }, "indicator_count": 4818, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "310 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "552 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d657f0895a860febf8f", "name": "SafeFrame Container", "description": "", "modified": "2023-12-06T15:04:05.932000", "created": "2023-12-06T15:04:05.932000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1416, "domain": 2979, "URL": 8250, "hostname": 2262 }, "indicator_count": 14907, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708cac217e290594a79ecb", "name": "188.166.154.118", "description": "", "modified": "2023-12-06T15:01:00.949000", "created": "2023-12-06T15:01:00.949000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 162, "hostname": 494, "domain": 375, "URL": 1404, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ca99b684204a04e0b36", "name": "188.166.154.118", "description": "", "modified": "2023-12-06T15:00:57.293000", "created": "2023-12-06T15:00:57.293000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 162, "hostname": 494, "domain": 375, "URL": 1404, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ca60be7cea12070cd6e", "name": "188.166.154.118", "description": "", "modified": "2023-12-06T15:00:54.743000", "created": "2023-12-06T15:00:54.743000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 162, "hostname": 494, "domain": 375, "URL": 1404, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d20f7e10c1e37fcf89", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2023-12-06T14:10:26.301000", "created": "2023-12-06T14:10:26.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1078, "domain": 838, "hostname": 1607, "URL": 4134, "email": 3, "FileHash-SHA1": 2, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f8475d8a8785dfc5a2f", "name": "Zetalytics API", "description": "", "modified": "2023-12-06T14:04:52.250000", "created": "2023-12-06T14:04:52.250000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 754, "hostname": 833, "domain": 441, "URL": 2375, "CIDR": 5, "FileHash-MD5": 2, "email": 1 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1d947db1f44d13bf9982", "name": " Malicious Google - Sign in? https://accounts.google.com/speedbump", "description": "", "modified": "2023-11-22T03:03:38.455000", "created": "2023-10-30T03:05:56.431000", "tags": [ "detection list", "ip address", "blacklist", "united", "cisco umbrella", "site", "alexa top", "safe site", "malicious url", "million", "facebook", "hsbc group", "blacknet rat", "stealer", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "noname057", "name verdict", "falcon sandbox", "date", "markmonitor", "name server", "opera", "edge", "error", "hidden", "windir", "silk", "unknown", "android", "hybrid", "general", "click", "strings", "trident", "class", "critical", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "script", "self", "pragma", "html info", "title sign", "meta tags" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": "6535ef14a479ec0ed4c895b4", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 208, "FileHash-MD5": 1206, "FileHash-SHA1": 609, "FileHash-SHA256": 564, "domain": 116, "URL": 457 }, "indicator_count": 3160, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "879 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6535ef14a479ec0ed4c895b4", "name": "Malicious Google - Sign in? https://accounts.google.com/speedbump/changepassword", "description": "Is account part of Botnet. I witnessed; login needs to be reset, logged out [get this 'https://accounts.google.com/speedbump/changepassword' read browser bar when looks suspect, log in to a Google interface, titled Google Account, font is different. Says this device logged in for the first time 10/19/2023. Untrue. Implicated someone had password and Google critical security alert email.\nI haven't had enough time to research. Hostile bruteforce account login.? Complete CNC on Google email accounts.", "modified": "2023-11-22T03:03:38.455000", "created": "2023-10-23T03:57:08.696000", "tags": [ "detection list", "ip address", "blacklist", "united", "cisco umbrella", "site", "alexa top", "safe site", "malicious url", "million", "facebook", "hsbc group", "blacknet rat", "stealer", "fakedout threat", "ip summary", "url summary", "summary", "sample", "samples", "noname057", "name verdict", "falcon sandbox", "date", "markmonitor", "name server", "opera", "edge", "error", "hidden", "windir", "silk", "unknown", "android", "hybrid", "general", "click", "strings", "trident", "class", "critical", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "script", "self", "pragma", "html info", "title sign", "meta tags" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 208, "FileHash-MD5": 1206, "FileHash-SHA1": 609, "FileHash-SHA256": 564, "domain": 116, "URL": 457 }, "indicator_count": 3160, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "879 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "634b4481d97a69446b750e82", "name": "adsbygoogle.js hybrid-A ts 55/100 seems mych worse here", "description": "", "modified": "2022-10-15T23:52:08.907000", "created": "2022-10-15T23:38:41.311000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "memoryfile scan", "error", "null", "string", "runtime data", "number", "object", "chrome", "void", "date", "android", "path", "iframe", "window", "this", "trident", "meta", "suspicious", "infinity", "hybrid", "close", "click", "general", "strings", "malicious", "august" ], "references": [ "https://hybrid-analysis.com/sample/fbba6129666c709aae5bcc8f49cffc28ad0d0c6d5b22fb4ee69da66e5d5fd7d9/634753ff96b237006c46584e" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 62, "URL": 835, "domain": 65, "FileHash-SHA256": 81, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 1045, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1281 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6280aa12040a569d19f6285f", "name": "possibly a central bank", "description": "Tobias Ahlin,", "modified": "2022-06-14T00:00:05.659000", "created": "2022-05-15T07:21:54.499000", "tags": [ "regexp", "typeof e", "function", "typeof t", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "reduceright", "number", "string", "l420", "g8m7ft2s1tv", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeerror", "symbol", "generator", "typeof n", "array", "promise", "weakmap", "typeof f", "natb", "409764", "animation", "suspense", "context", "forwardref", "deleted", "10252", "meta", "facebook", "unknown", "scroll", "backspace", "insert", "typeof symbol", "typeof c", "typeof s", "sprintf", "syntaxerror", "vhyj", "diefg", "bcdiefguxx", "constructor", "param", "rockn", "createclass", "source", "super", "infinity", "false", "contact", "internal", "phonenumber", "middle", "path", "redemption", "pass", "click", "cont", "albania", "armenia", "burma", "belarus", "cuba", "panama", "paraguay", "slovakia", "chad", "uruguay", "prop", "invert", "flip", "close", "small", "green", "union", "indonesia", "lucia", "martin", "mexico", "code", "apache", "blin", "slave", "gondi", "icelandic", "ganda", "zulu", "christmas", "burkina", "czech", "ukraine", "android", "format", "updater", "next", "hooks", "harmony", "trim", "python", "push", "shift", "slice", "shadowsizzle", "domdata", "hexchars", "agent", "launcher", "fail", "bind", "trident", "getclass", "body", "widget", "areasmodule", "duip", "hlwq", "fz5i", "dehu", "tbh0", "fwir", "x7am", "pcnd", "valr", "boolean", "portal", "partner", "ascio partner", "ascio", "tlds", "login en", "en de", "join today", "idns", "skip", "ascio domains", "tlds offered", "global whois", "checker", "helvetica neue", "arial", "d67a60", "inter", "baskerville", "15px", "180deg", "135deg", "video", "init", "wrap", "flip direction", "stop animation", "scale", "htmlelement", "hide", "typeof", "property", "fill", "noscroll", "matrix", "skew", "look", "julian garnier", "mit license", "typeof define", "typeof module", "htmlcollection", "255a", "qnull", "float32array", "nfunction", "tobias ahlin", "github", "spotify", "hyper island", "strong", "tobias", "read", "view", "ahlin bjerrome", "minecraft", "view project", "spinkit", "lookback", "ruby", "hello" ], "references": [ "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "https://tobiasahlin.com/js/app.js?v=1", "https://tobiasahlin.com/js/portfolio.js", "https://tobiasahlin.com/css/site.css", "https://ascio.com", "https://portal.ascio.com/login", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://js.hs-scripts.com/20704235.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "hostname": 1221, "domain": 2558, "FileHash-SHA256": 622, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1405 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62756a0d14664003affb0555", "name": "hush.com 301 to hushmail.com", "description": "var b[f, gw.b, \"dust\" - a.g - has been added to an Array by the end of the year, if there is any chance of it being added.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T18:33:49.161000", "tags": [ "widget", "null", "regexp", "array", "copyright", "license", "calltrkswap", "date", "typeof s", "xmlhttprequest", "typeof r", "script", "vd", "number", "string", "ienew ca", "closure library", "error", "quota", "aafunction", "dafunction", "function", "typeof o", "reduceright", "aw1070742489", "uint8array", "void", "code", "typeof symbol", "wickedclientid", "wickedemail", "wickedurl", "wickednullurl", "typeof e", "direct", "typeof require", "modulenotfound", "mini", "cnull", "anull", "nl50", "pnull", "okcancel", "compiled", "true", "android", "trident", "form", "window", "false", "acronym", "body", "canvas", "embed", "footer", "iframe", "keygen", "legend", "mark", "meta", "ruby", "small", "span", "template", "blank", "twitter", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "typeof module", "width", "object", "this", "accept", "fnumber", "gtmmf25krh", "host", "path" ], "references": [ "xfe-URL-Hush.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH", "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js", "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://widget.wickedreports.com/widget.js", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489", "https://www.hushmail.com/status/", "https://script.tapfiliate.com/tapfiliate.js", "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13", "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js", "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301", "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "OkCancel", "display_name": "OkCancel", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1917, "hostname": 698, "FileHash-SHA256": 116, "domain": 263 }, "indicator_count": 2994, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1414 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62752a3d78ce35783bfc85cc", "name": "SafeFrame Container", "description": "If you want to know what is going to happen when you create a non-iterable object, try these three pieces of code in the form of a new \"word\" or \"phrase\".", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T14:01:33.267000", "tags": [ "public", "typeof", "typeof define", "array", "typeerror", "typeof symbol", "error", "typeof enulle", "sdkversion", "internal", "date", "cnzzdata", "czuuid", "umdistinctid", "typeof e", "typeof t", "version", "swiper", "most", "copyright", "mit license", "april", "trident", "win32", "class", "lh", "vd", "function", "overlaylevel", "zdhxiong", "customevent", "symbol", "object", "string", "number", "null", "uint8array", "typeof b", "iframe", "android", "embed", "meta", "0x14a", "0x104", "0x97", "0xe1", "0x228", "0x12b", "0x14e", "0xf5", "0x11a", "0xc6", "sxa0", "typeof d", "closure library", "array int8array", "b1342177279", "regexp", "typeof r", "pseudo", "child", "typeof n", "template", "void", "this", "ienew ca", "quota", "aafunction", "dafunction", "gc", "trackpageview", "trackevent", "gtmmdcvhgd", "node", "element", "path", "reduceright", "p420", "gc3w7t6h5qw", "kafunction", "fafafa", "xlfunction", "kkfunction", "nkfunction", "qkfunction", "rkfunction", "skfunction", "span", "edge", "bad idp", "bad event", "crios", "invalid attempt", "afunction", "ufunction", "kfunction" ], "references": [ "xfe-URL-himado.com-stix2-2.1-export.json", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "xfe-URL-Psychz.net-stix2-2.1-export.json", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://himado.com/heihei/layui/layui.all.js", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "https://himado.com/heihei/js/swiper.min.js", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "xfe-URL-Aliyun.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lh", "display_name": "Lh", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2262, "URL": 8251, "FileHash-SHA256": 1416, "domain": 2979 }, "indicator_count": 14908, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1414 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62751d6e20ce7971fe122760", "name": "layerhost.com", "description": "function ra(a,b,c,d,e,f, a new type of node, which can only be defined by its own type, is the same as its current type.", "modified": "2022-06-05T00:03:45.266000", "created": "2022-05-06T13:06:54.626000", "tags": [ "typeerror", "function", "string", "urlsearchparams", "array", "object", "typeof t", "incorrect", "boolean", "iterator", "target", "error", "typeof o", "date", "typeof symbol", "window", "promise", "iere", "typeof ne", "null", "body", "this", "regexp", "please", "blob", "matomo", "post", "javascript", "link", "license", "info", "campaigns", "storagetest", "typeof json", "sufeffxa0", "typeof c", "document", "invalid attempt", "chat", "search", "language", "feel", "file", "call", "strongstart", "address", "again", "attrs", "cparseint", "dparseint", "bparseint", "9999px", "fparseint", "eparseint", "bnull", "gparseint", "iparseint", "blank", "trident", "fixedpos", "fixedheader", "click", "rotate", "dataslider", "eventtarget", "basicstructure", "moztransition", "gthis", "preventdefault", "bthis", "regexcss", "xthis", "true", "filterizr api", "filterizr", "value", "ease", "steps", "idle", "classcallcheck", "reveal", "init", "drilldown", "dropdown", "dropdownmenu", "orbit", "slider", "burn", "sticky", "keyboard", "eventkey", "apple cmd", "mapping", "mouse", "input", "cache", "button", "checkbox", "shift", "typeof b", "pseudo", "child", "class", "attr", "void", "secure", "result" ], "references": [ "xfe-IP-134.73.11.118-stix2-2.1-export.json", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "https://www.powr.io/powr.js?platform=html", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://www.layerhost.com/assets/js/vendor/what-input.js", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://www.layerhost.com/assets/js/yui.js", "https://www.layerhost.com/assets/js/app.js", "https://www.layerhost.com/assets/js/slider.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://tag.aticdn.net/616708/smarttag.js", "https://analytics.gandi.net/piwik.js", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "EventTarget", "display_name": "EventTarget", "target": null }, { "id": "Filterizr API", "display_name": "Filterizr API", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 350, "URL": 2035, "hostname": 718, "FileHash-SHA256": 355, "CVE": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 3461, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1414 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62680e38dad4e4b62851b8e8", "name": "188.166.154.118", "description": "function E(e,t,n), a new type of function, has its own set of functions, which can be used to start or end a specific function for any user or event.", "modified": "2022-05-26T00:02:33.465000", "created": "2022-04-26T15:22:32.241000", "tags": [ "error", "cancel", "confirm", "function", "regexp", "width", "click", "date", "typeof b", "height", "null", "this", "scroll", "body", "class", "target", "service", "accept", "twitter", "batal", "reload", "hj", "copyright", "closure library", "object", "hotjar", "email", "typeof symbol", "typeof e", "telefon", "array", "survey", "meta", "cookie", "keypress", "trident", "live", "fullscreen", "generic", "window", "widget", "ciudad", "adore", "experiment", "mutation", "send", "minified", "original file", "catched", "typeof y", "typeof blob", "blob", "xmlhttprequest", "tracking file", "mktz", "varname", "typeradio", "getnow", "visitor", "explorer", "android", "unknown", "x3e3", "gfunction", "jfunction", "yfunction", "typeof r", "f3e3", "string", "typeof t", "function code", "angular", "angularjs", "ember", "meteor", "zepto", "jquery", "reduceright", "trackevent", "page", "number", "digitalocean", "linode", "home cta", "vultr", "home page", "demo", "path", "magento", "derek", "void", "code", "typeof l", "json", "8760", "image", "adveid", "typeof c", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "addtocart", "signup", "addtowishlist", "lead", "custom", "typeof require", "sha256", "viewcontent", "search", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtolist", "contact", "download", "install", "typeerror", "quora pixel", "dwelltime", "gnu general", "public license", "sufeffxa0", "infinity", "gettitle", "promise", "hidden", "oref", "activexobject", "begin doc", "false", "cookiesfunction", "saconv", "pnull", "html", "style", "ctnull", "post", "uint32array", "fanull", "license", "ynull", "config", "iframe", "webkittransform", "main", "maincontent", "placeroot", "generator", "next", "info" ], "references": [ "xfe-URL-Cloudways.com-stix2-2.1-export.json", "https://s.adroll.com/onsite_personalization/production/0.1/static/js/main.39c29e42.js", "https://www.clarity.ms/eus2/s/0.6.34/clarity.js", "https://tags.srv.stackadapt.com/events.js", "https://a.quora.com/qevents.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.redditstatic.com/ads/pixel.js", "https://bat.bing.com/bat.js", "https://s.adroll.com/j/roundtrip.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWBZTT", "https://bam-cell.nr-data.net/1/f825f6c9b9?a=1271427646&v=1215.1253ab8&to=NVNUNkBQDxADV0RQXgwZYxBbHggNBlFIF0EKRg%3D%3D&rst=3260&ck=1&ref=https://www.cloudways.com/en/&ap=335&be=1077&fe=2760&dc=1572&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1650985479670,%22n%22:0,%22f%22:498,%22dn%22:499,%22dne%22:551,%22c%22:552,%22s%22:748,%22ce%22:841,%22rq%22:841,%22rp%22:1047,%22rpe%22:1047,%22dl%22:1066,%22di%22:1561,%22ds%22:1573,%22de%22:1599,%22dc%22:2759,%22l%22:2760,%22le%22:2765%7D,%22navigation%22:", "https://js-agent.newrelic.com/nr-spa-1215.min.js", "https://serve.albacross.com/track.js", "https://cdn.omniconvert.com/js/a91f81f.js", "https://tracking.g2crowd.com/attribution_tracking/conversions/3769.js?p=https://www.cloudways.com/en/&e=", "https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack.min.js", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/948053426/?random=1650985487354&cv=9&fst=1650985487354&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4p0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cloudways.com%2Fen%2F&tiba=Cloudways%3A%20Managed%20Cloud%20Hosting%20Platform%20Simplified%20-%20Cloudways&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://s.adroll.com/j/exp/UZQYN577R5CHXAGR45AYXQ/index.js", "https://s.adroll.com/j/pre/UZQYN577R5CHXAGR45AYXQ/3YIA4GQCONCAVH77AJMDGR/fpconsent.js", "https://www.cloudways.com/wp-content/cache/breeze-minification/js/breeze_44ba8066e751ddb3b497212de30fa3f9.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 494, "URL": 1404, "domain": 375, "FileHash-SHA256": 162, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1424 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62680e37bad2501c255b86e3", "name": "188.166.154.118", "description": "function E(e,t,n), a new type of function, has its own set of functions, which can be used to start or end a specific function for any user or event.", "modified": "2022-05-26T00:02:33.465000", "created": "2022-04-26T15:22:31.759000", "tags": [ "error", "cancel", "confirm", "function", "regexp", "width", "click", "date", "typeof b", "height", "null", "this", "scroll", "body", "class", "target", "service", "accept", "twitter", "batal", "reload", "hj", "copyright", "closure library", "object", "hotjar", "email", "typeof symbol", "typeof e", "telefon", "array", "survey", "meta", "cookie", "keypress", "trident", "live", "fullscreen", "generic", "window", "widget", "ciudad", "adore", "experiment", "mutation", "send", "minified", "original file", "catched", "typeof y", "typeof blob", "blob", "xmlhttprequest", "tracking file", "mktz", "varname", "typeradio", "getnow", "visitor", "explorer", "android", "unknown", "x3e3", "gfunction", "jfunction", "yfunction", "typeof r", "f3e3", "string", "typeof t", "function code", "angular", "angularjs", "ember", "meteor", "zepto", "jquery", "reduceright", "trackevent", "page", "number", "digitalocean", "linode", "home cta", "vultr", "home page", "demo", "path", "magento", "derek", "void", "code", "typeof l", "json", "8760", "image", "adveid", "typeof c", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "addtocart", "signup", "addtowishlist", "lead", "custom", "typeof require", "sha256", "viewcontent", "search", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtolist", "contact", "download", "install", "typeerror", "quora pixel", "dwelltime", "gnu general", "public license", "sufeffxa0", "infinity", "gettitle", "promise", "hidden", "oref", "activexobject", "begin doc", "false", "cookiesfunction", "saconv", "pnull", "html", "style", "ctnull", "post", "uint32array", "fanull", "license", "ynull", "config", "iframe", "webkittransform", "main", "maincontent", "placeroot", "generator", "next", "info" ], "references": [ "xfe-URL-Cloudways.com-stix2-2.1-export.json", "https://s.adroll.com/onsite_personalization/production/0.1/static/js/main.39c29e42.js", "https://www.clarity.ms/eus2/s/0.6.34/clarity.js", "https://tags.srv.stackadapt.com/events.js", "https://a.quora.com/qevents.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.redditstatic.com/ads/pixel.js", "https://bat.bing.com/bat.js", "https://s.adroll.com/j/roundtrip.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWBZTT", "https://bam-cell.nr-data.net/1/f825f6c9b9?a=1271427646&v=1215.1253ab8&to=NVNUNkBQDxADV0RQXgwZYxBbHggNBlFIF0EKRg%3D%3D&rst=3260&ck=1&ref=https://www.cloudways.com/en/&ap=335&be=1077&fe=2760&dc=1572&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1650985479670,%22n%22:0,%22f%22:498,%22dn%22:499,%22dne%22:551,%22c%22:552,%22s%22:748,%22ce%22:841,%22rq%22:841,%22rp%22:1047,%22rpe%22:1047,%22dl%22:1066,%22di%22:1561,%22ds%22:1573,%22de%22:1599,%22dc%22:2759,%22l%22:2760,%22le%22:2765%7D,%22navigation%22:", "https://js-agent.newrelic.com/nr-spa-1215.min.js", "https://serve.albacross.com/track.js", "https://cdn.omniconvert.com/js/a91f81f.js", "https://tracking.g2crowd.com/attribution_tracking/conversions/3769.js?p=https://www.cloudways.com/en/&e=", "https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack.min.js", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/948053426/?random=1650985487354&cv=9&fst=1650985487354&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4p0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cloudways.com%2Fen%2F&tiba=Cloudways%3A%20Managed%20Cloud%20Hosting%20Platform%20Simplified%20-%20Cloudways&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://s.adroll.com/j/exp/UZQYN577R5CHXAGR45AYXQ/index.js", "https://s.adroll.com/j/pre/UZQYN577R5CHXAGR45AYXQ/3YIA4GQCONCAVH77AJMDGR/fpconsent.js", "https://www.cloudways.com/wp-content/cache/breeze-minification/js/breeze_44ba8066e751ddb3b497212de30fa3f9.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 494, "URL": 1404, "domain": 375, "FileHash-SHA256": 162, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1424 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62680e32b8ee0032f3ab4c38", "name": "188.166.154.118", "description": "function E(e,t,n), a new type of function, has its own set of functions, which can be used to start or end a specific function for any user or event.", "modified": "2022-05-26T00:02:33.465000", "created": "2022-04-26T15:22:26.556000", "tags": [ "error", "cancel", "confirm", "function", "regexp", "width", "click", "date", "typeof b", "height", "null", "this", "scroll", "body", "class", "target", "service", "accept", "twitter", "batal", "reload", "hj", "copyright", "closure library", "object", "hotjar", "email", "typeof symbol", "typeof e", "telefon", "array", "survey", "meta", "cookie", "keypress", "trident", "live", "fullscreen", "generic", "window", "widget", "ciudad", "adore", "experiment", "mutation", "send", "minified", "original file", "catched", "typeof y", "typeof blob", "blob", "xmlhttprequest", "tracking file", "mktz", "varname", "typeradio", "getnow", "visitor", "explorer", "android", "unknown", "x3e3", "gfunction", "jfunction", "yfunction", "typeof r", "f3e3", "string", "typeof t", "function code", "angular", "angularjs", "ember", "meteor", "zepto", "jquery", "reduceright", "trackevent", "page", "number", "digitalocean", "linode", "home cta", "vultr", "home page", "demo", "path", "magento", "derek", "void", "code", "typeof l", "json", "8760", "image", "adveid", "typeof c", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "addtocart", "signup", "addtowishlist", "lead", "custom", "typeof require", "sha256", "viewcontent", "search", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtolist", "contact", "download", "install", "typeerror", "quora pixel", "dwelltime", "gnu general", "public license", "sufeffxa0", "infinity", "gettitle", "promise", "hidden", "oref", "activexobject", "begin doc", "false", "cookiesfunction", "saconv", "pnull", "html", "style", "ctnull", "post", "uint32array", "fanull", "license", "ynull", "config", "iframe", "webkittransform", "main", "maincontent", "placeroot", "generator", "next", "info" ], "references": [ "xfe-URL-Cloudways.com-stix2-2.1-export.json", "https://s.adroll.com/onsite_personalization/production/0.1/static/js/main.39c29e42.js", "https://www.clarity.ms/eus2/s/0.6.34/clarity.js", "https://tags.srv.stackadapt.com/events.js", "https://a.quora.com/qevents.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.redditstatic.com/ads/pixel.js", "https://bat.bing.com/bat.js", "https://s.adroll.com/j/roundtrip.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWBZTT", "https://bam-cell.nr-data.net/1/f825f6c9b9?a=1271427646&v=1215.1253ab8&to=NVNUNkBQDxADV0RQXgwZYxBbHggNBlFIF0EKRg%3D%3D&rst=3260&ck=1&ref=https://www.cloudways.com/en/&ap=335&be=1077&fe=2760&dc=1572&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1650985479670,%22n%22:0,%22f%22:498,%22dn%22:499,%22dne%22:551,%22c%22:552,%22s%22:748,%22ce%22:841,%22rq%22:841,%22rp%22:1047,%22rpe%22:1047,%22dl%22:1066,%22di%22:1561,%22ds%22:1573,%22de%22:1599,%22dc%22:2759,%22l%22:2760,%22le%22:2765%7D,%22navigation%22:", "https://js-agent.newrelic.com/nr-spa-1215.min.js", "https://serve.albacross.com/track.js", "https://cdn.omniconvert.com/js/a91f81f.js", "https://tracking.g2crowd.com/attribution_tracking/conversions/3769.js?p=https://www.cloudways.com/en/&e=", "https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack.min.js", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/948053426/?random=1650985487354&cv=9&fst=1650985487354&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4p0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cloudways.com%2Fen%2F&tiba=Cloudways%3A%20Managed%20Cloud%20Hosting%20Platform%20Simplified%20-%20Cloudways&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://s.adroll.com/j/exp/UZQYN577R5CHXAGR45AYXQ/index.js", "https://s.adroll.com/j/pre/UZQYN577R5CHXAGR45AYXQ/3YIA4GQCONCAVH77AJMDGR/fpconsent.js", "https://www.cloudways.com/wp-content/cache/breeze-minification/js/breeze_44ba8066e751ddb3b497212de30fa3f9.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1546", "name": "Event Triggered Execution", "display_name": "T1546 - Event Triggered Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 494, "URL": 1404, "domain": 375, "FileHash-SHA256": 162, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1424 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62634f4db80546374654f4c4", "name": "frantech.ca - malware", "description": "T,t.F, t.f, is written in the same place as the following:t, d. F, has been added to the end of the document, as well as its own propertyDescriptor.", "modified": "2022-05-22T00:01:01.264000", "created": "2022-04-23T00:58:53.444000", "tags": [ "overview", "typeof symbol", "error", "typeerror", "object", "typeof t", "string", "typeof e", "function", "array", "promise", "date", "target", "class", "path", "back", "bounce", "this", "iframe", "null", "0x105684", "0xb66229", "0xb9b329", "0x3eed40", "0x2923e0", "cookie", "0x1d2d25", "0x2d6b", "0x538ea5", "0x240c1a", "push", "shift", "open" ], "references": [ "xfe-URL-https___my.frantech.ca_-stix2-2.1-export.json", "xfe-URL-frantech.ca-stix2-2.1-export.json", "https://my.frantech.ca/templates/lagom/assets/js/lagom-app.min.js?v=1.4.3", "https://my.frantech.ca/templates/lagom/assets/js/whmcs-custom.min.js?v=1.4.3" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 757, "hostname": 498, "domain": 311, "FileHash-SHA256": 21 }, "indicator_count": 1587, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1428 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6261fd6a8d527fa569351e63", "name": "Malware hosting - unrealservers.net & heymman.com", "description": "function S.name, a.com, has been added to the end of a page to make sure it does not end up in an unauthorised place. and it will not get any more.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-22T00:57:14.125000", "tags": [ "e2f0fc", "fd7a07", "f0482b", "gradienttype0", "a5bcce", "helvetica", "negative", "arial", "bcd3e4", "style sheet", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "onload", "select", "error", "strong", "uint8array", "string", "null", "number", "function", "input", "array", "iframe", "date", "android", "verify", "stop", "this", "span", "enterprise", "click", "widget", "window", "form", "generator", "reload", "void", "dd2d2f", "e8e8e8", "d8d8d8", "fcfcfc", "e5e5e5", "lucida", "unicode", "lucida grande", "f9f9f9", "footer", "unavailable", "ngsanitize", "order now", "invalid", "snippet", "month", "hours", "fullyear", "regexp", "eeee", "mmmm d", "mena", "christ" ], "references": [ "xfe-URL-heymman.com-stix2-2.1-export.json", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.2/angular-sanitize.js", "https://www.heymman.com/script.js", "https://www.heymman.com/style/main.css", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.google.com/recaptcha/api.js", "https://unrealservers.net/master.css", "xfe-URL-Ndevix.com-stix2-2.1-export.json", "xfe-URL-Misk.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 427, "URL": 1183, "FileHash-SHA256": 162, "domain": 441, "email": 4 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1429 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62616627ee302d24b23523c3", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T14:11:51.629000", "tags": [ "tbody", "span", "thead", "tfoot", "multiple", "type", "href", "input", "halflings", "gradienttype1", "twitter", "false", "fontface", "fatface", "woff2", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "typesubmit", "function", "typeof c", "formdata", "this", "typeof define", "null", "typeof f", "object", "boolean", "typeof module", "error", "reflect", "math", "regexp", "number", "array", "typeerror", "string", "symbol", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "account", "open", "navitem", "text", "mainnav", "click", "blank", "copyright", "u0027", "value", "body", "firefox", "enum", "html", "msie", "applewebkit", "traceconsole", "form", "iframe", "legend", "nonmsdombrowser", "callbackindex", "callbackframeid", "eventtarget", "eventargument", "validation", "explorer", "target", "plugin", "bootstrap", "https", "conflict", "focus", "next", "trigger", "checkbox", "delta", "scroll", "sourceid", "date", "sessiontoken", "sessionexpires", "void", "rangeerror", "utf16", "illegal input", "global", "chrome", "opredge", "opera", "safari", "version", "sxa0", "browser", "typeof require", "dom node", "typeof d", "component", "typeof h", "bubble", "reduceright", "script", "typeof n", "jhnew ia", "gtm5sn6brv", "path", "host", "trackpageview", "gw8yd4p2eny", "select", "strong", "uint8array", "android", "verify", "stop", "enterprise", "widget", "window", "generator", "reload", "r300", "caca", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "please", "typeemail", "email", "jarallaxinner", "webkit", "property", "transform", "trident", "edge", "ipodi", "ipadi", "androidi", "blackberryi", "windows phonei", "xfunction", "pfunction", "wfunction", "show navigation", "mjquery", "typeof", "defaulttype", "hidden", "show", "shown", "startr", "endr", "federico zivolo", "distributed", "mit license", "statict", "flip" ], "references": [ "xfe-IP-78.142.35.163-stix2-2.1-export.json", "xfe-URL-Enom.com-stix2-2.1-export.json", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "https://4vendeta.com/assets/js/popper.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/js/global-functions.js", "https://cp.enom.com/js/punycode.min.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/js/cart.minicart.min.js", "https://cp.enom.com/js/openWin.min.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://cp.enom.com/scripts/Session.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://cdn.optimizely.com/js/26241557.js", "https://cp.enom.com/verisign-seal.htm", "https://cp.enom.com/global/TopMenu.ascx.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2989, "hostname": 1208, "domain": 634, "FileHash-SHA256": 302 }, "indicator_count": 5133, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1429 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fff22683106d256390a89", "name": "'Chinese botnet", "description": "\u00c2\u00a31.3m (838m euros) - that is the amount of money the Chinese government has to spend on upgrading the country's economy - but how much is it going to cost?", "modified": "2022-05-08T09:06:05.710000", "created": "2022-04-08T09:23:46.746000", "tags": [ "datav7a53b450", "microsoft yahei", "label", "arial", "verdana", "simsun", "simhei", "stheiti", "helvetica", "aba8a8", "font awesome", "license", "font", "sil ofl", "mit license", "woff2", "woff", "truetype", "fontawesome", "0xb6f109", "0x9e4f21", "0x464801", "0x21c094", "object", "0x54da69", "0x28e5ab", "promise", "0x3aef82", "0x12d16a", "this", "push", "window", "code", "date", "bind", "error", "path", "target", "middle", "null", "open", "download", "blank", "refresh", "config", "span", "mark", "canvas", "mask", "9999", "close", "shift", "android", "encrypt", "getclass", "checker", "agent", "4328", "trim", "service", "slice", "crypto", "stop", "7910", "zero", "checkbox", "format", "model", "spinner", "clickdownload", "meta", "sport", "click", "next", "class", "hammer", "body", "boolean", "number", "string", "array", "typeof t", "function", "regexp", "typeof e", "generator", "4096", "ping", "f6cf32", "modulenotfound", "n noticecontent", "typeerror", "circular", "infinite", "mouseevent", "dommousescroll", "lotteryhallhome", "void", "bubble", "vnode", "vuessrcontext", "swiper", "typeof o", "mozperspective", "msperspective", "tridentg", "event", "bscroll", "u200", "typeof s", "newatchman", "fetch", "timeout", "ofunction", "zfunction", "watchman", "dfunction", "domutils", "typeof n", "4294967295", "parseint", "utf8", "utils", "post", "channelcode", "0xa60881", "0x1e0610", "0x489cca", "0x4d5bd1", "0x1a7a9a", "0x3145fc", "0x2d9acb", "0xbf1b3e", "0x47699d", "cookie", "info", "jb3tu", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "tencent", "barrio", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "yuwvm", "g 18", "720p", "hd luna", "hd 99", "ktvp", "part", "hd h", "dykthr", "jquery", "titlestr", "viewport" ], "references": [ "xfe-IP-154.36.230.14-stix2-2.0-export.json", "http://www.jxhykj1210.com/common.js", "http://www.jxhykj1210.com/tj.js", "https://17se.xyz/", "https://www.bibo18.app:2171/?agent=2207259251", "https://www.bibo18.app:2171/js/xinstall_inner_e.min.js?v=1004", "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://www.shareinstall.com.cn/js/page/jshareinstall.min.js", "https://acstatic-dun.126.net/tool.min.js?t=1647252792143", "https://9755w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~agent-doc~cpxpjLogin~download~game~home~member~sports~vnsoLogin~vnstLogin2.js", "https://9755w.com:2188/m/js/2203141811-JieBei~YuEBao~agent-center-modec~agent-center-new~bet~game~home~invite~member.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~home.js", "https://9755w.com:2188/m/js/2203141811-home.js", "https://9755w.com:2188/m/js/2203141811-fhcpLogin.js", "https://9755w.com:2188/m/js/2203141811-view-page.js", "https://9755w.com:2188/m/js/2203141811-chunk-vendors.js", "https://9755w.com:2188/m/js/2203141811-index.js", "https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css", "https://9755w.com:2188/m/css/fhcpLogin.css?v=2203141811" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 306, "URL": 1135, "FileHash-SHA256": 122, "domain": 172, "FileHash-MD5": 4 }, "indicator_count": 1739, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62276abfaa65cd33f64331f8", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2022-04-07T00:04:02.553000", "created": "2022-03-08T14:39:59.235000", "tags": [ "march", "lookup go", "rescan add", "verdict report", "de summary", "http", "redirects links", "behaviour", "similar dom", "content api", "value", "search url", "search domain", "scan url", "url search", "domain scan", "url url", "motor vehicle", "aqb1", "eventsevent10", "meta", "show", "download go", "full url", "reverse dns", "resource", "windows nt", "win64", "khtml", "gecko", "response", "main", "milan", "apache", "paris", "accept" ], "references": [ "TarrantCounty3df.pdf", "TarantCounty2df.pdf", "TarrantCounty4df.pdf", "TarrantCounty5df.pdf", "tarrant23df.pdf", "TarrantCounty1df.pdf", "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf", "TarrantCounty6df.pdf", "TarrantCounty7df.pdf", "TarrantCounty10df.pdf", "TarrantCounty9df.pdf", "TarrantCounty17df.pdf", "TarrantCounty15df.pdf", "TarrantCounty12df.pdf", "TarrantCounty14df.pdf", "tarrantcounty8df.pdf", "TarrantCounty18df.pdf", "TarrantCounty19df.pdf", "TarrantCounty21df.pdf", "tarrantcounty22df.pdf", "TarrantCounty20df.pdf", "tarrantcountydf.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4134, "hostname": 1607, "domain": 838, "FileHash-SHA256": 1078, "FileHash-SHA1": 2, "email": 3, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621bc3aa050a6c5693595f25", "name": "Zetalytics API", "description": "", "modified": "2022-03-29T00:03:34.773000", "created": "2022-02-27T18:32:10.542000", "tags": [ "google", "google llc", "detected", "expand overall", "http", "amazonaes", "openssl", "lookup go", "rescan add", "verdict report", "behaviour", "june", "apache", "search url", "search domain", "scan url", "url search", "domain scan", "url url", "us summary", "line", "google maps", "api warning", "redirects links", "similar dom", "content api", "domains", "Ransomware" ], "references": [ "zetalytics .pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Win32:Cryptor", "display_name": "Win32:Cryptor", "target": null }, { "id": "TELPER:CERT:SoftwareBundler:Win32/Bunpredelt", "display_name": "TELPER:CERT:SoftwareBundler:Win32/Bunpredelt", "target": null }, { "id": "Trojan:Win32/Danabot.G", "display_name": "Trojan:Win32/Danabot.G", "target": "/malware/Trojan:Win32/Danabot.G" }, { "id": "Backdoor:Win32/Poison.E", "display_name": "Backdoor:Win32/Poison.E", "target": "/malware/Backdoor:Win32/Poison.E" }, { "id": "ALF:PUA:Block:IObit.R!MTB", "display_name": "ALF:PUA:Block:IObit.R!MTB", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 754, "URL": 2375, "domain": 441, "hostname": 833, "CIDR": 5, "FileHash-MD5": 2, "email": 1 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1482 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "jquery.autocomplete.min.js.pobrane", "https://tracking.g2crowd.com/attribution_tracking/conversions/3769.js?p=https://www.cloudways.com/en/&e=", "fontswitcher.js.pobrane", "https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css", "https://serve.albacross.com/track.js", "https://cp.enom.com/js/global-functions.js", "https://hybrid-analysis.com/sample/fbba6129666c709aae5bcc8f49cffc28ad0d0c6d5b22fb4ee69da66e5d5fd7d9/634753ff96b237006c46584e", "TarrantCounty21df.pdf", "xfe-IP-134.73.11.118-stix2-2.1-export.json", "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000", "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js", "f5Y41t9wqY4.html", "https://a.quora.com/qevents.js", "djmobilemenu.css", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://cdn.optimizely.com/js/26241557.js", "https://cdn.omniconvert.com/js/a91f81f.js", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "tarrant23df.pdf", "stickybar.js.pobrane", "http://www.jxhykj1210.com/common.js", "jcemediabox.js.pobrane", "https://www.google.com/recaptcha/api.js", "TarrantCounty20df.pdf", "https://4vendeta.com/assets/js/popper.min.js", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://9755w.com:2188/m/js/2203141811-chunk-vendors.js", "xfe-URL-Powr.io-stix2-2.1-export 2.json", "https://js-agent.newrelic.com/nr-spa-1215.min.js", "offcanvas.css", "https://17se.xyz/", "https://ascio.com", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "bootstrap_responsive.26.css", "geometry.js.pobrane", "content.css", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://9755w.com:2188/m/css/fhcpLogin.css?v=2203141811", "magnific-init.js.pobrane", "https://widget.wickedreports.com/widget.js", "TarrantCounty4df.pdf", "caption.js.pobrane", "animations.css", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "djmegamenu.26.css", "offcanvas.26.css", "remote.js.pobrane", "https://9755w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "TarrantCounty18df.pdf", "https://my.frantech.ca/templates/lagom/assets/js/lagom-app.min.js?v=1.4.3", "xfe-URL-lodash.com-stix2-2.1-export.json", "layout.min.js.pobrane", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "jquery.cookie.js.pobrane", "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js", "tarrantcounty22df.pdf", "xfe-URL-ascio.com-stix2-2.1-export.json", "https://www.layerhost.com/assets/js/vendor/foundation.min.js", "xfe-URL-frantech.ca-stix2-2.1-export.json", "TarrantCounty15df.pdf", "https://cdn.onesignal.com/sdks/OneSignalSDK.js", "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf", "https://acstatic-dun.126.net/tool.min.js?t=1647252792143", "https://js.hs-scripts.com/20704235.js", "TarrantCounty1df.pdf", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "TarrantCounty9df.pdf", "TarrantCounty5df.pdf", "TarrantCounty12df.pdf", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://4vendeta.com/assets/js/parallax.min.js", "font_switcher.26.css", "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "search.js.pobrane", "animate.min.css", "https://analytics.gandi.net/piwik.js", "xfe-URL-Enom.com-stix2-2.1-export.json", "https://cp.enom.com/js/openWin.min.js", "style.css", "template_responsive.26.css", "TarrantCounty6df.pdf", "djimageslider.css", "xfe-URL-Aliyun.com-stix2-2.1-export.json", "https://9755w.com:2188/m/js/2203141811-LotteryHall~home.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/js/twk-chunk-2d0d2b7c.js", "https://9755w.com:2188/m/js/2203141811-fhcpLogin.js", "https://cp.enom.com/js/jquery-3.5.1.min.js", "tarrantcounty8df.pdf", "xfe-IP-146.148.236.187-stix2-2.1-export.json", "magnific.css", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://www.layerhost.com/assets/js/vendor/jquery.min.js", "https://www.layerhost.com/assets/js/yui.js", "xfe-URL-Hush.com-stix2-2.1-export.json", "https://cp.enom.com/global/TopMenu.ascx.js", "bootstrap.min.js.pobrane", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "https://tobiasahlin.com/js/portfolio.js", "https://www.bibo18.app:2171/?agent=2207259251", "https://www.hushmail.com/status/", "main.js.pobrane", "https://www.layerhost.com/assets/js/vendor/what-input.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://www.jxhykj1210.com/tj.js", "https://www.bibo18.app:2171/js/xinstall_inner_e.min.js?v=1004", "https://9755w.com:2188/m/js/2203141811-LotteryHall~agent-doc~cpxpjLogin~download~game~home~member~sports~vnsoLogin~vnstLogin2.js", "util.js.pobrane", "https://www.clarity.ms/eus2/s/0.6.34/clarity.js", "TarantCounty2df.pdf", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://9755w.com:2188/m/js/2203141811-JieBei~YuEBao~agent-center-modec~agent-center-new~bet~game~home~invite~member.js", "finder.css", "https://www.googletagmanager.com/gtag/js?id=AW-1070742489", "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html", "jquery.ui.sortable.min.js.pobrane", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "sw3VTUzeRvWIVwvWSyk6S5gHWPxOOwU1OxerozmN4Hw.js.pobrane", "embed.js.pobrane", "animate.ext.css", "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-NWBZTT", "https://unrealservers.net/master.css", "offcanvas.js.pobrane", "scripts.js.pobrane", "www-embed-player.js.pobrane", "search_impl.js.pobrane", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "xfe-URL-heymman.com-stix2-2.1-export.json", "TarrantCounty10df.pdf", "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "https://s.adroll.com/j/exp/UZQYN577R5CHXAGR45AYXQ/index.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "jquery.djmobilemenu.js.pobrane", "https://cp.enom.com/responsive/_js/init.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD", "https://www.heymman.com/style/main.css", "TarrantCounty7df.pdf", "bootstrap.26.css", "https://4vendeta.com/assets/js/meanmenu.min.js", "jquery.min.js.pobrane", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.2/angular-sanitize.js", "css", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/948053426/?random=1650985487354&cv=9&fst=1650985487354&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2wg4p0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.cloudways.com%2Fen%2F&tiba=Cloudways%3A%20Managed%20Cloud%20Hosting%20Platform%20Simplified%20-%20Cloudways&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "map.js.pobrane", "https://tobiasahlin.com/js/app.js?v=1", "pagesettings.js.pobrane", "https://www.layerhost.com/assets/js/jquery.filterizr.min.js", "https://my.frantech.ca/templates/lagom/assets/js/whmcs-custom.min.js?v=1.4.3", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2", "https://www.cloudways.com/wp-content/cache/breeze-minification/js/breeze_44ba8066e751ddb3b497212de30fa3f9.js", "xfe-URL-Cloudways.com-stix2-2.1-export.json", "slider.js.pobrane", "jquery.countTo.js.pobrane", "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://www.layerhost.com/assets/js/app.js", "xfe-URL-Layerhost.com-stix2-2.1-export.json", "https://tags.srv.stackadapt.com/events.js", "ad_status.js.pobrane", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0", "magnific.js.pobrane", "jquery.easing.min.js.pobrane", "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "https://himado.com/heihei/js/swiper.min.js", "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light", "https://4vendeta.com/assets/js/jquery.min.js", "https://9755w.com:2188/m/js/2203141811-home.js", "embed.html", "jquery.ui.core.min.js.pobrane", "https://www.powr.io/powr.js?platform=html", "https://script.tapfiliate.com/tapfiliate.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://portal.ascio.com/login", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://cdn.jsdelivr.net/npm/hockeystack@latest/hockeystack.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "jcemediabox.css", "TarrantCounty14df.pdf", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c", "zetalytics .pdf", "xfe-URL-Ndevix.com-stix2-2.1-export.json", "xfe-URL-Misk.com-stix2-2.1-export.json", "https://s.adroll.com/onsite_personalization/production/0.1/static/js/main.39c29e42.js", "jquery-noconflict.js.pobrane", "https://cp.enom.com/js/cart.minicart.min.js", "https://tobiasahlin.com/js/anime.min.js", "xfe-URL-https___my.frantech.ca_-stix2-2.1-export.json", "TarrantCounty3df.pdf", "js", "xfe-URL-Cnzz.com-stix2-2.1-export.json", "https://himado.com/heihei/layui/layui.all.js", "https://c.cnzz.com/core.php?web_id=1280305902&t=z", "https://9755w.com:2188/m/js/2203141811-index.js", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-himado.com-stix2-2.1-export.json", "cast_sender.js.pobrane", "xfe-URL-Psychz.net-stix2-2.1-export.json", "https://www.heymman.com/script.js", "https://www.gandi.net/static/js/legacy.7cc648e3ff7a.js", "https://cp.enom.com/js/punycode.min.js", "TarrantCounty17df.pdf", "https://s.adroll.com/j/roundtrip.js", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301", "xfe-IP-78.142.35.163-stix2-2.1-export.json", "https://tobiasahlin.com/css/site.css", "xfe-IP-154.36.230.14-stix2-2.0-export.json", "https://tag.aticdn.net/616708/smarttag.js", "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js", "onion.js.pobrane", "https://bam-cell.nr-data.net/1/f825f6c9b9?a=1271427646&v=1215.1253ab8&to=NVNUNkBQDxADV0RQXgwZYxBbHggNBlFIF0EKRg%3D%3D&rst=3260&ck=1&ref=https://www.cloudways.com/en/&ap=335&be=1077&fe=2760&dc=1572&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1650985479670,%22n%22:0,%22f%22:498,%22dn%22:499,%22dne%22:551,%22c%22:552,%22s%22:748,%22ce%22:841,%22rq%22:841,%22rp%22:1047,%22rpe%22:1047,%22dl%22:1066,%22di%22:1561,%22ds%22:1573,%22de%22:1599,%22dc%22:2759,%22l%22:2760,%22le%22:2765%7D,%22navigation%22:", "template.26.css", "https://www.layerhost.com/assets/js/slider.js", "https://www.redditstatic.com/ads/pixel.js", "https://www.shareinstall.com.cn/js/page/jshareinstall.min.js", "https://9755w.com:2188/m/js/2203141811-view-page.js", "jquery.djmegamenu.js.pobrane", "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH", "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c", "https://cp.enom.com/scripts/Session.min.js", "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301", "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902", "overlay.js.pobrane", "https://securepubads.g.doubleclick.net/tag/js/gpt.js", "xfe-URL-https___www.gandi.net-stix2-2.1-export.json", "https://tobiasahlin.com", "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js", "https://bat.bing.com/bat.js", "TarrantCounty19df.pdf", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.gandi.net/static/js/modern.27ee934b0dc5.js", "https://s.adroll.com/j/pre/UZQYN577R5CHXAGR45AYXQ/3YIA4GQCONCAVH77AJMDGR/fpconsent.js", "jquery-migrate.min.js.pobrane", "common.js.pobrane", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "tarrantcountydf.pdf", "https://cp.enom.com/verisign-seal.htm", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "extended_layouts.26.css" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Filterizr api", "Win32:cryptor", "Okcancel", "Telper:cert:softwarebundler:win32/bunpredelt", "Vd", "Win.virus.polyransom-5704625-0", "Trojan:win32/danabot.g", "Reduceright", "Gc", "Backdoor:win32/poison.e", "Hj", "Alf:pua:block:iobit.r!mtb", "Eventtarget", "Lh" ], "industries": [ "Government" ], "unique_indicators": 75444 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/h.next", "whois": "http://whois.domaintools.com/h.next", "domain": "h.next", "hostname": "a.f.h.next" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 26, "pulses": [ { "id": "684c65464466dd19b089f325", "name": "Zesp\u00f3\u0142 Profilaktyki i Rehabilitacji w Janowicach Wielkich - YouTube", "description": "If d=void 0===c,w(\"trustedResourceUrl\",d: \"Trusted resourceUrl,\" thend=c.src,d, c.js, then d:", "modified": "2025-06-13T17:56:28.689000", "created": "2025-06-13T17:52:06.399000", "tags": [ "rehabilitacji w", "youtube tv", "dami jelenia", "tv dami", "jelenia gra", "zakupy wycz", "jeli", "nie korzystasz", "filmy", "aby tego", "copyright", "closure library", "argument", "ifunction", "error", "null", "type", "cast", "webchannel", "su2028u2029", "chrome", "xmlhttp", "kkvoid", "remotecontrol", "android", "unknown", "screen", "desktop", "function", "string", "array", "number", "vfunction", "f8192", "n432", "true", "j2048", "this", "window", "void", "date", "pokau017c", "pytfunction", "fe8function", "qgzfunction", "afunction", "hb28", "r150", "promise", "bigint", "post", "edge", "swhealthlog", "symbol", "trident", "infinity", "embed", "webkitkeyframes", "zoomin", "zoominx", "zoomoutx", "zoominy", "zoomouty", "2000px", "90deg", "20px", "30deg", "30px", "10px", "10deg", "3deg", "5deg", "djmegamenu", "use license", "tabindex", "menu", "close", "msie", "beforechange", "imagehassize", "buildcontrols", "magnific popup", "dmitry semenov", "http", "beforeclose", "afterclose", "open", "next", "open source", "bsd license", "george mcginley", "smith", "djimageslider", "subpackage", "webkit", "khtml", "icab", "countto", "callback", "handler", "object", "typeof", "method", "gnugplv2", "website", "set module", "height script", "regexp", "screenheight", "highcontrast2", "highcontrast3", "highcontrast", "wide", "night", "body", "normalbutton", "cookie plugin", "https", "klaus hartl", "mit license", "register", "nodecommonjs", "factory", "jquery", "write", "sticky bar", "stickybar", "count", "offcanvas", "html", "noscroll", "offcanvas var", "toggle nav", "click jquery", "ajax", "autocomplete", "tomas kirda", "typeof define", "esc27", "tab9", "return13", "left37", "up38", "twitter", "custom version", "joomla", "rolemenu", "boolean", "get adobe", "flash player", "title", "text", "typeof data", "typeof s", "accept", "width", "foundation", "backspace8", "comma188", "delete46", "down40", "end35", "enter13", "escape27", "value", "migrate", "backcompat", "quirks mode", "typeof f", "xtablet768", "document", "ui sortable", "leftright", "gnu general", "public license", "dddddd", "ffffcc", "eeeeee", "verdana", "geneva", "arial", "helvetica", "f0f0f0", "sans", "charset", "utf8", "fontawesome", "typeof b", "pseudo", "child", "sufeffxa0", "class", "attr", "general slider", "slide", "rgba", "navigation", "15deg", "300px", "20deg", "transition", "scale", "baskerville", "main image", "bdbdbd", "f3f3f3", "remove", "fontface", "woff2", "u0131", "u01520153", "u02bb02bc", "u02c6", "u02da", "u02dc", "u0304", "dirrtl", "msviewport", "href", "span", "legend", "halflings", "fieldset", "typeimage", "f2f2f2", "d9edf7", "dff0d8", "f2dede", "thead", "tbody", "tahoma", "00a0", "video", "script", "2500", "xnew ita", "dnew jta", "dataset", "orfunction", "prfunction", "nsafunction", "xsafunction", "vrfunction", "cakes", "ovbfunction", "pvbfunction", "rvbfunction", "qvbfunction", "tvbfunction", "uvbfunction", "vvbclass", "xvbclass", "yvbclass", "svbclass", "lvafunction", "ggfunction", "mvafunction", "ovafunction", "pvafunction", "uvafunction", "tvafunction", "qvafunction", "vvafunction", "nvaclass", "dark", "vector", "yy49", "raster", "roboto", "new tk", "qael", "przechyl", "mars", "mercury", "venus", "pluto", "titan", "weakset", "wfclass", "googlelayer", "uint8array", "weakmap", "5001", "mouseevent", "webassembly", "180180", "9090", "google maps", "javascript api", "internal", "small", "lightrail", "false", "february", "light", "hybrid", "bounce", "drop", "inside", "outside", "marker", "gc" ], "references": [ "embed.html", "ad_status.js.pobrane", "f5Y41t9wqY4.html", "cast_sender.js.pobrane", "remote.js.pobrane", "sw3VTUzeRvWIVwvWSyk6S5gHWPxOOwU1OxerozmN4Hw.js.pobrane", "embed.js.pobrane", "www-embed-player.js.pobrane", "animate.ext.css", "animate.min.css", "jquery.djmegamenu.js.pobrane", "jquery.djmobilemenu.js.pobrane", "magnific.js.pobrane", "jquery.easing.min.js.pobrane", "slider.js.pobrane", "jquery.countTo.js.pobrane", "scripts.js.pobrane", "magnific-init.js.pobrane", "pagesettings.js.pobrane", "jquery.cookie.js.pobrane", "stickybar.js.pobrane", "fontswitcher.js.pobrane", "offcanvas.js.pobrane", "jquery.autocomplete.min.js.pobrane", "bootstrap.min.js.pobrane", "jcemediabox.js.pobrane", "jquery.ui.core.min.js.pobrane", "jquery-migrate.min.js.pobrane", "layout.min.js.pobrane", "jquery.ui.sortable.min.js.pobrane", "caption.js.pobrane", "finder.css", "jquery-noconflict.js.pobrane", "djmegamenu.26.css", "animations.css", "djmobilemenu.css", "jquery.min.js.pobrane", "djimageslider.css", "offcanvas.css", "magnific.css", "font_switcher.26.css", "css", "template_responsive.26.css", "offcanvas.26.css", "bootstrap_responsive.26.css", "extended_layouts.26.css", "style.css", "content.css", "template.26.css", "bootstrap.26.css", "jcemediabox.css", "js", "onion.js.pobrane", "search_impl.js.pobrane", "overlay.js.pobrane", "map.js.pobrane", "util.js.pobrane", "search.js.pobrane", "common.js.pobrane", "geometry.js.pobrane", "main.js.pobrane" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 26, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2779, "hostname": 661, "domain": 684, "email": 4, "FileHash-MD5": 1, "FileHash-SHA256": 689 }, "indicator_count": 4818, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "310 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "663d2869e0f3a42bbddc42ff", "name": "UPX executable packer.", "description": "A new rule has been introduced a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"", "modified": "2024-10-14T00:01:17.069000", "created": "2024-05-09T19:47:53.786000", "tags": [ "cioch adrian", "centrum usug", "sieciowych", "elf binary", "upx compression", "roth", "nextron", "info", "javascript", "html", "office open", "xml document", "network capture", "win32 exe", "xml pakietu", "pdf zestawy", "przechwytywanie", "office", "filehashsha1", "url https", "cve cve20201070", "cve cve20203153", "cve cve20201048", "cve cve20211732", "cve20201048 apr", "filehashmd5", "cve cve20010901", "cve cve20021841", "cve20153202 apr", "cve cve20160728", "cve cve20161807", "cve cve20175123", "cve20185407 apr", "cve cve20054605", "cve cve20060745", "cve cve20070452", "cve cve20070453", "cve cve20070454", "cve cve20071355", "cve cve20071358", "cve cve20071871", "cve20149614 apr", "cve cve20151503", "cve cve20152080", "cve cve20157377", "cve cve20170131", "cve20200796 may", "cve cve20113403" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6861, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5771, "domain": 3139, "URL": 14525, "FileHash-SHA1": 2610, "IPv4": 108, "CIDR": 40, "FileHash-SHA256": 10705, "FileHash-MD5": 3373, "YARA": 2, "CVE": 148, "Mutex": 7, "FilePath": 3, "SSLCertFingerprint": 3, "email": 23, "JA3": 1, "IPv6": 2 }, "indicator_count": 40460, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "552 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d657f0895a860febf8f", "name": "SafeFrame Container", "description": "", "modified": "2023-12-06T15:04:05.932000", "created": "2023-12-06T15:04:05.932000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1416, "domain": 2979, "URL": 8250, "hostname": 2262 }, "indicator_count": 14907, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708cac217e290594a79ecb", "name": "188.166.154.118", "description": "", "modified": "2023-12-06T15:01:00.949000", "created": "2023-12-06T15:01:00.949000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 162, "hostname": 494, "domain": 375, "URL": 1404, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ca99b684204a04e0b36", "name": "188.166.154.118", "description": "", "modified": "2023-12-06T15:00:57.293000", "created": "2023-12-06T15:00:57.293000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 162, "hostname": 494, "domain": 375, "URL": 1404, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708ca60be7cea12070cd6e", "name": "188.166.154.118", "description": "", "modified": "2023-12-06T15:00:54.743000", "created": "2023-12-06T15:00:54.743000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 162, "hostname": 494, "domain": 375, "URL": 1404, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2440, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d20f7e10c1e37fcf89", "name": "TarrantCounty.com ~ 03.01.2022", "description": "", "modified": "2023-12-06T14:10:26.301000", "created": "2023-12-06T14:10:26.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1078, "domain": 838, "hostname": 1607, "URL": 4134, "email": 3, "FileHash-SHA1": 2, "CIDR": 4, "FileHash-MD5": 15 }, "indicator_count": 7681, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f8475d8a8785dfc5a2f", "name": "Zetalytics API", "description": "", "modified": "2023-12-06T14:04:52.250000", "created": "2023-12-06T14:04:52.250000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 754, "hostname": 833, "domain": 441, "URL": 2375, "CIDR": 5, "FileHash-MD5": 2, "email": 1 }, "indicator_count": 4411, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://a.f.h.next", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://a.f.h.next", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776639582.3988664 }