{
  "type": "URL",
  "indicator": "https://aceptra.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://aceptra.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3009333010,
      "indicator": "https://aceptra.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "699c6ef61298b57cd7275728",
          "name": "Apple Support IOC\u2019s IcedID | Bloored |  Mydoom worm | iOS IOC\u2019s",
          "description": "A list of Apple and Apple related iOS\u2019s linked to a malicious redirect found in an apple.support.com redirect. Two separate Apple ID\u2019s on one iPhone. | Mimecast compromised with Emotet. iCloud siphoning. Related to Pulse  found in references. |  IOC\u2019s came from a single url.",
          "modified": "2026-03-25T07:05:10.628000",
          "created": "2026-02-23T15:15:02.857000",
          "tags": [
            "ipv4",
            "http",
            "passive dns",
            "files domain",
            "united",
            "unknown ns",
            "for privacy",
            "ip address",
            "domain",
            "dynamicloader",
            "antivirus",
            "yara rule",
            "fe ff",
            "write c",
            "msvisualcpp60",
            "rsds",
            "e8 c8",
            "e8 a8",
            "ff e1",
            "unknown",
            "worm",
            "launch",
            "write",
            "explorer",
            "february",
            "push",
            "service",
            "files",
            "reverse dns",
            "america flag",
            "america asn",
            "url add",
            "otx logo",
            "all ipv4",
            "searc",
            "date checked",
            "server response",
            "results dec",
            "unknown soa",
            "present aug",
            "present oct",
            "present sep",
            "present nov",
            "moved",
            "error",
            "title",
            "win32mydoom feb",
            "aaaa",
            "name servers",
            "trojan",
            "servers",
            "virtool",
            "united states",
            "apple",
            "crlf line",
            "unicode text",
            "utf8",
            "ff d5",
            "ascii text",
            "ee fc",
            "suspicious",
            "music",
            "malware",
            "role title",
            "ttl value",
            ".cc",
            "d4 f5",
            "msvisualcpp2002",
            "msvisualcpp2005",
            "apple support",
            ".ch",
            "privaterelay",
            "pattern match",
            "ck id",
            "mitre att",
            "ck matrix",
            "href",
            "et info",
            "general",
            "local",
            "path",
            "click",
            "learn",
            "command",
            "name tactics",
            "informative",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "present jun",
            "backdoor",
            "present may",
            "status",
            "ransom",
            "high",
            "medium",
            "windows",
            "tofsee",
            "loaderid",
            "lidfileupd",
            "localcfg",
            "rndhex",
            "stream",
            "delete",
            "emotet",
            "bot network",
            "mitm",
            "screenshot",
            "mimecast"
          ],
          "references": [
            "http://apple.support.com/ht***** redirect",
            "https://otx.alienvault.com/pulse/699b907c5375efb7ce1639b8",
            "mac.store",
            "https://icloud.ch/cn/ipod-touch/",
            "https://icloud.ch/",
            "https://multicash.smbcgroup.com/gb/App/Authentication/Challenge",
            "https://uatapp.pacificcross.com.ph/Oqapv2uatRedirect/",
            "Redirect: schemas.microsoft.com",
            "apple.com(-inc.cc)",
            "oas-japac-domains-applecomputer.cn",
            "robert-aebi.appleid.com",
            "smtp2.icl-privaterelay.appleid.com",
            "http://audaxgroup.appleid.com/",
            "https://otx.alienvault.com/indicator/url/http://ipodtouch.co/?cid=oas-japac-domains-applecomputer.com.cn/ing/product+validatie.php",
            "iphonegermany.com",
            "api.mr-2538.dev-phoenix.diagnostics.si.siemens.cloud",
            "https://aspmx.l.google.com/",
            "api.us-1.a.mimecastprotect.com  l.uk-1.a.mimecastprotect.com",
            "de-smtp-inbound-1.mimecast.com  de-smtp-inbound-2.mimecast.com",
            "http://www.icloud-sms-alert.com/",
            "monitoring.eurovision.net",
            "https://www.irby.com/iub-en/services/testing-and-monitoring",
            "monitor.kyos.ninja"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/IcedId.DI!MTB",
              "display_name": "Trojan:Win32/IcedId.DI!MTB",
              "target": "/malware/Trojan:Win32/IcedId.DI!MTB"
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "Worm:Win32/Bloored",
              "display_name": "Worm:Win32/Bloored",
              "target": "/malware/Worm:Win32/Bloored"
            },
            {
              "id": "Win.Malware.Elenooka-6996044-0",
              "display_name": "Win.Malware.Elenooka-6996044-0",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1557",
              "name": "Man-in-the-Middle",
              "display_name": "T1557 - Man-in-the-Middle"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0029",
              "name": "Privilege Escalation",
              "display_name": "TA0029 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6031,
            "hostname": 1971,
            "domain": 1125,
            "FileHash-SHA256": 1715,
            "email": 18,
            "FileHash-MD5": 317,
            "FileHash-SHA1": 164
          },
          "indicator_count": 11341,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "25 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6885713b1663acf8f8d67256",
          "name": "Bot Joining - Ransom | Malware Packed Botnet",
          "description": "Bot joining by going to trusted names domains.\nI haven\u2019t isolated (bot joining) IoC\u2019s because the results are unsettling.\n*I realize it\u2019s important to check for an unsigned certificates, headers, redirects, and various other indications no matter how well one is secured. There are amazing hackers armed with AI who are only getting better. There software/tools will erase your security unless you\u2019re a hacker as well. IMO targeted persons should consider becoming Grey Hats on White team armed with AI knowledge.\n#Crypto_Mining_Pool\n#Bot_Joining #Malware #BotNetworking",
          "modified": "2025-08-25T23:01:42.226000",
          "created": "2025-07-27T00:22:19.267000",
          "tags": [
            "hostname",
            "domain",
            "pulses",
            "groups",
            "search filter",
            "time",
            "x show",
            "indicator type",
            "cidr",
            "email",
            "present jun",
            "body html",
            "head meta",
            "moved title",
            "head body",
            "moved",
            "a href",
            "certificate",
            "united",
            "showing",
            "date",
            "present may",
            "backdoor",
            "aaaa",
            "entries",
            "ip address",
            "search",
            "mtb jul",
            "domain add",
            "trojan",
            "error",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as15169",
            "less whois",
            "registrar",
            "markmonitor",
            "crypto mining",
            "next associated",
            "files show",
            "date hash",
            "avast avg",
            "win32ellell jul",
            "lowfi",
            "ransom",
            "serialnumber",
            "html http2",
            "record value"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 4,
            "hostname": 65,
            "FileHash-SHA256": 994,
            "FileHash-SHA1": 151,
            "domain": 61,
            "URL": 103,
            "FileHash-MD5": 151
          },
          "indicator_count": 1529,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657092f9499206cd87c73969",
          "name": "iphone",
          "description": "",
          "modified": "2023-12-06T15:27:53.981000",
          "created": "2023-12-06T15:27:53.981000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1768,
            "hostname": 808,
            "domain": 306,
            "URL": 1938,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4821,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657080e2831409d23c8d24a5",
          "name": "iMessages.app 03.01.2022",
          "description": "",
          "modified": "2023-12-06T14:10:42.459000",
          "created": "2023-12-06T14:10:42.459000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1768,
            "hostname": 808,
            "domain": 306,
            "URL": 1937,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4820,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6342b2b087554c9d5209b50b",
          "name": "iphone",
          "description": "",
          "modified": "2022-11-09T00:03:32.403000",
          "created": "2022-10-09T11:38:24.078000",
          "tags": [],
          "references": [
            "iMessages.app"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "622775d4f2c38a89fdd0128a",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Lazzo115",
            "id": "210949",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 306,
            "URL": 1938,
            "hostname": 808,
            "FileHash-SHA256": 1768,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4821,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 8,
          "modified_text": "1257 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "622775d4f2c38a89fdd0128a",
          "name": "iMessages.app 03.01.2022",
          "description": "",
          "modified": "2022-04-07T00:04:02.553000",
          "created": "2022-03-08T15:27:16.349000",
          "tags": [],
          "references": [
            "iMessages.app"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 306,
            "URL": 1937,
            "hostname": 808,
            "FileHash-SHA256": 1768,
            "FileHash-SHA1": 1
          },
          "indicator_count": 4820,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 408,
          "modified_text": "1473 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://aspmx.l.google.com/",
        "api.us-1.a.mimecastprotect.com  l.uk-1.a.mimecastprotect.com",
        "http://apple.support.com/ht***** redirect",
        "https://www.irby.com/iub-en/services/testing-and-monitoring",
        "smtp2.icl-privaterelay.appleid.com",
        "https://multicash.smbcgroup.com/gb/App/Authentication/Challenge",
        "de-smtp-inbound-1.mimecast.com  de-smtp-inbound-2.mimecast.com",
        "mac.store",
        "Redirect: schemas.microsoft.com",
        "https://otx.alienvault.com/indicator/url/http://ipodtouch.co/?cid=oas-japac-domains-applecomputer.com.cn/ing/product+validatie.php",
        "monitor.kyos.ninja",
        "iphonegermany.com",
        "https://icloud.ch/cn/ipod-touch/",
        "robert-aebi.appleid.com",
        "monitoring.eurovision.net",
        "iMessages.app",
        "https://otx.alienvault.com/pulse/699b907c5375efb7ce1639b8",
        "http://audaxgroup.appleid.com/",
        "apple.com(-inc.cc)",
        "oas-japac-domains-applecomputer.cn",
        "api.mr-2538.dev-phoenix.diagnostics.si.siemens.cloud",
        "http://www.icloud-sms-alert.com/",
        "https://uatapp.pacificcross.com.ph/Oqapv2uatRedirect/",
        "https://icloud.ch/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Mydoom",
            "Worm:win32/bloored",
            "Win.malware.elenooka-6996044-0",
            "Trojan:win32/icedid.di!mtb",
            "Emotet"
          ],
          "industries": [],
          "unique_indicators": 17309
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/aceptra.com",
    "whois": "http://whois.domaintools.com/aceptra.com",
    "domain": "aceptra.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "699c6ef61298b57cd7275728",
      "name": "Apple Support IOC\u2019s IcedID | Bloored |  Mydoom worm | iOS IOC\u2019s",
      "description": "A list of Apple and Apple related iOS\u2019s linked to a malicious redirect found in an apple.support.com redirect. Two separate Apple ID\u2019s on one iPhone. | Mimecast compromised with Emotet. iCloud siphoning. Related to Pulse  found in references. |  IOC\u2019s came from a single url.",
      "modified": "2026-03-25T07:05:10.628000",
      "created": "2026-02-23T15:15:02.857000",
      "tags": [
        "ipv4",
        "http",
        "passive dns",
        "files domain",
        "united",
        "unknown ns",
        "for privacy",
        "ip address",
        "domain",
        "dynamicloader",
        "antivirus",
        "yara rule",
        "fe ff",
        "write c",
        "msvisualcpp60",
        "rsds",
        "e8 c8",
        "e8 a8",
        "ff e1",
        "unknown",
        "worm",
        "launch",
        "write",
        "explorer",
        "february",
        "push",
        "service",
        "files",
        "reverse dns",
        "america flag",
        "america asn",
        "url add",
        "otx logo",
        "all ipv4",
        "searc",
        "date checked",
        "server response",
        "results dec",
        "unknown soa",
        "present aug",
        "present oct",
        "present sep",
        "present nov",
        "moved",
        "error",
        "title",
        "win32mydoom feb",
        "aaaa",
        "name servers",
        "trojan",
        "servers",
        "virtool",
        "united states",
        "apple",
        "crlf line",
        "unicode text",
        "utf8",
        "ff d5",
        "ascii text",
        "ee fc",
        "suspicious",
        "music",
        "malware",
        "role title",
        "ttl value",
        ".cc",
        "d4 f5",
        "msvisualcpp2002",
        "msvisualcpp2005",
        "apple support",
        ".ch",
        "privaterelay",
        "pattern match",
        "ck id",
        "mitre att",
        "ck matrix",
        "href",
        "et info",
        "general",
        "local",
        "path",
        "click",
        "learn",
        "command",
        "name tactics",
        "informative",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "present jun",
        "backdoor",
        "present may",
        "status",
        "ransom",
        "high",
        "medium",
        "windows",
        "tofsee",
        "loaderid",
        "lidfileupd",
        "localcfg",
        "rndhex",
        "stream",
        "delete",
        "emotet",
        "bot network",
        "mitm",
        "screenshot",
        "mimecast"
      ],
      "references": [
        "http://apple.support.com/ht***** redirect",
        "https://otx.alienvault.com/pulse/699b907c5375efb7ce1639b8",
        "mac.store",
        "https://icloud.ch/cn/ipod-touch/",
        "https://icloud.ch/",
        "https://multicash.smbcgroup.com/gb/App/Authentication/Challenge",
        "https://uatapp.pacificcross.com.ph/Oqapv2uatRedirect/",
        "Redirect: schemas.microsoft.com",
        "apple.com(-inc.cc)",
        "oas-japac-domains-applecomputer.cn",
        "robert-aebi.appleid.com",
        "smtp2.icl-privaterelay.appleid.com",
        "http://audaxgroup.appleid.com/",
        "https://otx.alienvault.com/indicator/url/http://ipodtouch.co/?cid=oas-japac-domains-applecomputer.com.cn/ing/product+validatie.php",
        "iphonegermany.com",
        "api.mr-2538.dev-phoenix.diagnostics.si.siemens.cloud",
        "https://aspmx.l.google.com/",
        "api.us-1.a.mimecastprotect.com  l.uk-1.a.mimecastprotect.com",
        "de-smtp-inbound-1.mimecast.com  de-smtp-inbound-2.mimecast.com",
        "http://www.icloud-sms-alert.com/",
        "monitoring.eurovision.net",
        "https://www.irby.com/iub-en/services/testing-and-monitoring",
        "monitor.kyos.ninja"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/IcedId.DI!MTB",
          "display_name": "Trojan:Win32/IcedId.DI!MTB",
          "target": "/malware/Trojan:Win32/IcedId.DI!MTB"
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "Worm:Win32/Bloored",
          "display_name": "Worm:Win32/Bloored",
          "target": "/malware/Worm:Win32/Bloored"
        },
        {
          "id": "Win.Malware.Elenooka-6996044-0",
          "display_name": "Win.Malware.Elenooka-6996044-0",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1557",
          "name": "Man-in-the-Middle",
          "display_name": "T1557 - Man-in-the-Middle"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0029",
          "name": "Privilege Escalation",
          "display_name": "TA0029 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6031,
        "hostname": 1971,
        "domain": 1125,
        "FileHash-SHA256": 1715,
        "email": 18,
        "FileHash-MD5": 317,
        "FileHash-SHA1": 164
      },
      "indicator_count": 11341,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "25 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6885713b1663acf8f8d67256",
      "name": "Bot Joining - Ransom | Malware Packed Botnet",
      "description": "Bot joining by going to trusted names domains.\nI haven\u2019t isolated (bot joining) IoC\u2019s because the results are unsettling.\n*I realize it\u2019s important to check for an unsigned certificates, headers, redirects, and various other indications no matter how well one is secured. There are amazing hackers armed with AI who are only getting better. There software/tools will erase your security unless you\u2019re a hacker as well. IMO targeted persons should consider becoming Grey Hats on White team armed with AI knowledge.\n#Crypto_Mining_Pool\n#Bot_Joining #Malware #BotNetworking",
      "modified": "2025-08-25T23:01:42.226000",
      "created": "2025-07-27T00:22:19.267000",
      "tags": [
        "hostname",
        "domain",
        "pulses",
        "groups",
        "search filter",
        "time",
        "x show",
        "indicator type",
        "cidr",
        "email",
        "present jun",
        "body html",
        "head meta",
        "moved title",
        "head body",
        "moved",
        "a href",
        "certificate",
        "united",
        "showing",
        "date",
        "present may",
        "backdoor",
        "aaaa",
        "entries",
        "ip address",
        "search",
        "mtb jul",
        "domain add",
        "trojan",
        "error",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as15169",
        "less whois",
        "registrar",
        "markmonitor",
        "crypto mining",
        "next associated",
        "files show",
        "date hash",
        "avast avg",
        "win32ellell jul",
        "lowfi",
        "ransom",
        "serialnumber",
        "html http2",
        "record value"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 4,
        "hostname": 65,
        "FileHash-SHA256": 994,
        "FileHash-SHA1": 151,
        "domain": 61,
        "URL": 103,
        "FileHash-MD5": 151
      },
      "indicator_count": 1529,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657092f9499206cd87c73969",
      "name": "iphone",
      "description": "",
      "modified": "2023-12-06T15:27:53.981000",
      "created": "2023-12-06T15:27:53.981000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1768,
        "hostname": 808,
        "domain": 306,
        "URL": 1938,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4821,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657080e2831409d23c8d24a5",
      "name": "iMessages.app 03.01.2022",
      "description": "",
      "modified": "2023-12-06T14:10:42.459000",
      "created": "2023-12-06T14:10:42.459000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1768,
        "hostname": 808,
        "domain": 306,
        "URL": 1937,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4820,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6342b2b087554c9d5209b50b",
      "name": "iphone",
      "description": "",
      "modified": "2022-11-09T00:03:32.403000",
      "created": "2022-10-09T11:38:24.078000",
      "tags": [],
      "references": [
        "iMessages.app"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "622775d4f2c38a89fdd0128a",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Lazzo115",
        "id": "210949",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 306,
        "URL": 1938,
        "hostname": 808,
        "FileHash-SHA256": 1768,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4821,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 8,
      "modified_text": "1257 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "622775d4f2c38a89fdd0128a",
      "name": "iMessages.app 03.01.2022",
      "description": "",
      "modified": "2022-04-07T00:04:02.553000",
      "created": "2022-03-08T15:27:16.349000",
      "tags": [],
      "references": [
        "iMessages.app"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 306,
        "URL": 1937,
        "hostname": 808,
        "FileHash-SHA256": 1768,
        "FileHash-SHA1": 1
      },
      "indicator_count": 4820,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 408,
      "modified_text": "1473 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://aceptra.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://aceptra.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776621971.4573023
}