{
  "type": "URL",
  "indicator": "https://appeal-59321958.web.app/twofac.html",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://appeal-59321958.web.app/twofac.html",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "majestic",
        "message": "Whitelisted domain web.app",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3491974233,
      "indicator": "https://appeal-59321958.web.app/twofac.html",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "639bb5534a815ddb80df90c2",
          "name": "Meta-Phish: Facebook Infrastructure Used in Phishing Attack Chain",
          "description": "",
          "modified": "2022-12-16T00:01:22.504000",
          "created": "2022-12-16T00:01:22.504000",
          "tags": [
            "OSINT",
            "Phishing",
            "Meta",
            "Facebook",
            "T1566"
          ],
          "references": [
            "https://community.riskiq.com/article/8890b711"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1,
            "domain": 2,
            "URL": 10
          },
          "indicator_count": 13,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "1265 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62bf88621145ca43f15dd1c6",
          "name": "Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam",
          "description": "",
          "modified": "2022-07-01T23:50:58.030000",
          "created": "2022-07-01T23:50:58.030000",
          "tags": [
            "Phishing",
            "Meta",
            "TrustWave"
          ],
          "references": [
            "https://community.riskiq.com/article/66570457"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3,
            "hostname": 1
          },
          "indicator_count": 4,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "1432 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62bd28bdc49b05d68f0c4d26",
          "name": "Phishing Attack Using Facebook Messenger Chatbots Steal Credentials Used to Manage Facebook Pages",
          "description": "A new phishing attack is using Facebook Messenger chatbots to impersonate the company's support team to steal credentials for managers of Facebook pages.\n\nChatbots in Messenger\nThe attack starts with an email informing that the Facebook page has violated Community Standards, giving 48 hours to appeal the decision, or the page will be deleted. The user is offered a chance to resolve the problem in Facebook\u2019s Support center. To access it, they have to click on an \u201cAppeal Now\u201d button. Clicking the button takes the victim to a Messenger conversation where a chatbot impersonates a Facebook customer support agent.",
          "modified": "2022-06-30T04:38:21.246000",
          "created": "2022-06-30T04:38:21.246000",
          "tags": [
            "Phishing attach",
            "Facebook",
            "Credentials"
          ],
          "references": [
            "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam/"
          ],
          "public": 1,
          "adversary": "Informational",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "SVThreatIntel",
            "id": "148120",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_148120/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1,
            "URL": 4
          },
          "indicator_count": 5,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 190,
          "modified_text": "1434 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62bc5b50fa591c6569d5f8b5",
          "name": "Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam | Trustwave",
          "description": "Trustwave is a global cybersecurity platform designed to protect against the most advance cybersecurity threats, including email and chatbots, which are being used to target users of Facebook Messenger and other messaging platforms across the world.",
          "modified": "2022-06-29T14:01:52.125000",
          "created": "2022-06-29T14:01:52.125000",
          "tags": [
            "facebook",
            "appeal",
            "statista",
            "messenger",
            "meta",
            "open",
            "submit button",
            "january",
            "facebook login",
            "s community",
            "service"
          ],
          "references": [
            "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "mohdrennis",
            "id": "138092",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7,
            "CVE": 3
          },
          "indicator_count": 10,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 354,
          "modified_text": "1434 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam/",
        "https://community.riskiq.com/article/66570457",
        "https://community.riskiq.com/article/8890b711"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Informational"
          ],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 20
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/web.app",
    "whois": "http://whois.domaintools.com/web.app",
    "domain": "web.app",
    "hostname": "appeal-59321958.web.app"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "639bb5534a815ddb80df90c2",
      "name": "Meta-Phish: Facebook Infrastructure Used in Phishing Attack Chain",
      "description": "",
      "modified": "2022-12-16T00:01:22.504000",
      "created": "2022-12-16T00:01:22.504000",
      "tags": [
        "OSINT",
        "Phishing",
        "Meta",
        "Facebook",
        "T1566"
      ],
      "references": [
        "https://community.riskiq.com/article/8890b711"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1,
        "domain": 2,
        "URL": 10
      },
      "indicator_count": 13,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "1265 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62bf88621145ca43f15dd1c6",
      "name": "Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam",
      "description": "",
      "modified": "2022-07-01T23:50:58.030000",
      "created": "2022-07-01T23:50:58.030000",
      "tags": [
        "Phishing",
        "Meta",
        "TrustWave"
      ],
      "references": [
        "https://community.riskiq.com/article/66570457"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3,
        "hostname": 1
      },
      "indicator_count": 4,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "1432 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62bd28bdc49b05d68f0c4d26",
      "name": "Phishing Attack Using Facebook Messenger Chatbots Steal Credentials Used to Manage Facebook Pages",
      "description": "A new phishing attack is using Facebook Messenger chatbots to impersonate the company's support team to steal credentials for managers of Facebook pages.\n\nChatbots in Messenger\nThe attack starts with an email informing that the Facebook page has violated Community Standards, giving 48 hours to appeal the decision, or the page will be deleted. The user is offered a chance to resolve the problem in Facebook\u2019s Support center. To access it, they have to click on an \u201cAppeal Now\u201d button. Clicking the button takes the victim to a Messenger conversation where a chatbot impersonates a Facebook customer support agent.",
      "modified": "2022-06-30T04:38:21.246000",
      "created": "2022-06-30T04:38:21.246000",
      "tags": [
        "Phishing attach",
        "Facebook",
        "Credentials"
      ],
      "references": [
        "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam/"
      ],
      "public": 1,
      "adversary": "Informational",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "SVThreatIntel",
        "id": "148120",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_148120/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1,
        "URL": 4
      },
      "indicator_count": 5,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 190,
      "modified_text": "1434 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62bc5b50fa591c6569d5f8b5",
      "name": "Interactive Phishing Mark II: Messenger Chatbot Leveraged in a New Facebook-Themed Spam | Trustwave",
      "description": "Trustwave is a global cybersecurity platform designed to protect against the most advance cybersecurity threats, including email and chatbots, which are being used to target users of Facebook Messenger and other messaging platforms across the world.",
      "modified": "2022-06-29T14:01:52.125000",
      "created": "2022-06-29T14:01:52.125000",
      "tags": [
        "facebook",
        "appeal",
        "statista",
        "messenger",
        "meta",
        "open",
        "submit button",
        "january",
        "facebook login",
        "s community",
        "service"
      ],
      "references": [
        "https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/interactive-phishing-mark-ii-messenger-chatbot-leveraged-in-a-new-facebook-themed-spam/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "mohdrennis",
        "id": "138092",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7,
        "CVE": 3
      },
      "indicator_count": 10,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 354,
      "modified_text": "1434 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://appeal-59321958.web.app/twofac.html",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://appeal-59321958.web.app/twofac.html",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780476160.1144204
}