{
  "type": "URL",
  "indicator": "https://cbdv2.monerpool.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cbdv2.monerpool.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3436016692,
      "indicator": "https://cbdv2.monerpool.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "65708f3d55770338a7d7e46b",
          "name": "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
          "description": "",
          "modified": "2023-12-06T15:11:57.253000",
          "created": "2023-12-06T15:11:57.253000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 430,
            "hostname": 1503,
            "domain": 1549,
            "URL": 3561,
            "FileHash-MD5": 1
          },
          "indicator_count": 7045,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708cee75cb524822443805",
          "name": "what a difference a . makes -  irr.blizzard.com. - CVE-2018-8120",
          "description": "",
          "modified": "2023-12-06T15:02:05.972000",
          "created": "2023-12-06T15:02:05.972000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6174,
            "FileHash-SHA256": 1762,
            "domain": 693,
            "email": 2,
            "hostname": 1343,
            "FileHash-MD5": 115,
            "FileHash-SHA1": 107,
            "CVE": 2
          },
          "indicator_count": 10198,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 114,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653090cd5c6271761323a7a4",
          "name": "Jupyter Notebooks Under Attack: QubitStrike Malware Targets Linux Servers",
          "description": "",
          "modified": "2023-11-18T01:05:41.002000",
          "created": "2023-10-19T02:13:33.190000",
          "tags": [
            "cyber security news",
            "cyber news",
            "cyber security news today",
            "cyber security updates",
            "cyber updates",
            "hacker news",
            "hacking news",
            "software vulnerability",
            "cyber attacks",
            "data breach",
            "ransomware malware",
            "how to hack",
            "network security",
            "information security",
            "the hacker news",
            "computer security",
            "tunisia",
            "qubitstrike",
            "cado",
            "telegram api",
            "git hosting",
            "github",
            "matt muir",
            "nate bill",
            "jupyter",
            "codeberg",
            "discord",
            "twitter",
            "linux server",
            "linux",
            "telegram bot",
            "discord channel",
            "linux rootkit",
            "xmrrig miner",
            "google cloud",
            "cado research",
            "download",
            "insert",
            "install",
            "teamtnt",
            "cryptojacking",
            "cloud",
            "cado security",
            "aws",
            "malware",
            "saas",
            "muir",
            "jupyter web",
            "threat research",
            "lead",
            "help net",
            "ssh key",
            "cloud service",
            "ssh propagation",
            "xmrig",
            "persistence",
            "python",
            "netshadow",
            "blacksun",
            "diamorphine",
            "strong",
            "github desktop",
            "linux kernels",
            "arm64",
            "sign",
            "lkm rootkit",
            "search",
            "cancel create",
            "star",
            "victor",
            "footer",
            "ipv4 url"
          ],
          "references": [
            "October 19th, 2023 - CryptoGen Cyber Threat Intelligence Advisory #3434 - Jupyter Notebooks Under Attack - QubitStrike Malware Targets Linux Servers"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Qubitstrike",
              "display_name": "Qubitstrike",
              "target": null
            },
            {
              "id": "Linux",
              "display_name": "Linux",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1049",
              "name": "System Network Connections Discovery",
              "display_name": "T1049 - System Network Connections Discovery"
            },
            {
              "id": "T1526",
              "name": "Cloud Service Discovery",
              "display_name": "T1526 - Cloud Service Discovery"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "cryptocti",
            "id": "110256",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 58,
            "hostname": 43,
            "domain": 4,
            "URL": 110
          },
          "indicator_count": 219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 499,
          "modified_text": "926 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6295d72c09bca73117c7b35c",
          "name": "\u5a01\u80c1\u72e9\u730e\u2014\u6316\u77ff\u6728\u9a6c\u7684\u5206\u6790\u4e0e\u8ddf\u8e2a",
          "description": "\u5a01\u80c1\u60c5\u62a5\u56e2\u961f\u901a\u8fc7\u5bf9\u6316\u77ff\u6728\u9a6c\u5bb6\u65cf\u7684\u5a01\u80c1\u72e9\u730e\uff0c\u83b7\u5f97\u5927\u91cf\u6316\u77ff\u6728\u9a6c\u5e38\u7528\u6316\u77ff\u57df\u540d\u548c\u76f8\u5173C2\u3002",
          "modified": "2023-07-19T06:10:51.967000",
          "created": "2022-05-31T08:51:55.995000",
          "tags": [
            "CoinMiner",
            "HotSpot"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Coin Miner",
              "display_name": "Coin Miner",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "junchuanyang1",
            "id": "157561",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157561/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 285,
            "hostname": 109,
            "domain": 21
          },
          "indicator_count": 415,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 88,
          "modified_text": "1048 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62981c9999c140fe3dc70f18",
          "name": "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
          "description": "",
          "modified": "2022-07-02T00:05:39.094000",
          "created": "2022-06-02T02:12:41.574000",
          "tags": [
            "geoip",
            "cloudflarenet",
            "as13335",
            "as16276",
            "apache geoip",
            "as57724",
            "ddosguard",
            "as49282",
            "ficolo",
            "as24940",
            "xserver",
            "media",
            "telecom",
            "https://www.flooringforum.com/media/",
            "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
            "CVE-2017-0147"
          ],
          "references": [
            "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
            "CVE-2017-0147"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3561,
            "hostname": 1503,
            "FileHash-SHA256": 430,
            "domain": 1549,
            "CVE": 1,
            "FileHash-MD5": 1
          },
          "indicator_count": 7045,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 393,
          "modified_text": "1430 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "626bdc17d4519e2619a504da",
          "name": "what a difference a . makes -  irr.blizzard.com. - CVE-2018-8120",
          "description": "",
          "modified": "2022-05-30T00:00:40.928000",
          "created": "2022-04-29T12:37:43.880000",
          "tags": [
            "irr.blizzard.com",
            "irr.blizzard.com.",
            "24.105.29.24",
            "CVE-2018-8120"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/0046d22f2c6d0d3805d3ac393a5e9a6d22fbdf4c536accc953c0ad6016180e2f/626bcef6f5f0f643c216c84c",
            "https://hybrid-analysis.com/sample/60efb7ca24b6996a44c919d50ebcffe4092591ab15e6acda03f6a459ee96646e/626bd048a7193d6c1b3e9910",
            "https://hybrid-analysis.com/sample/95121783365a25ff1016eb630deaf5ee50456295161604553fb27ac30b5f1cfe/626bce701d2fd7781b6f8653",
            "https://hybrid-analysis.com/sample/e22d8ea5dc8732defed6c17b4bec3fbdf092aa86df4f4b80c768037fd59397ac/626bc2368590ef23a25053b4",
            "74.203.211.12:1433",
            "irr.blizzard.com. 24.105.29.24",
            "https://www.virustotal.com/graph/g909fda2b00874cfcac059078fd24495c5ac4a8b219cd4b8fb8108b19dab31ad8"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            }
          ],
          "industries": [
            ""
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1343,
            "URL": 6174,
            "domain": 693,
            "FileHash-SHA256": 1762,
            "FileHash-MD5": 115,
            "CVE": 2,
            "FileHash-SHA1": 107,
            "email": 2
          },
          "indicator_count": 10198,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 410,
          "modified_text": "1463 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "74.203.211.12:1433",
        "irr.blizzard.com. 24.105.29.24",
        "https://hybrid-analysis.com/sample/60efb7ca24b6996a44c919d50ebcffe4092591ab15e6acda03f6a459ee96646e/626bd048a7193d6c1b3e9910",
        "CVE-2017-0147",
        "https://hybrid-analysis.com/sample/0046d22f2c6d0d3805d3ac393a5e9a6d22fbdf4c536accc953c0ad6016180e2f/626bcef6f5f0f643c216c84c",
        "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
        "https://hybrid-analysis.com/sample/95121783365a25ff1016eb630deaf5ee50456295161604553fb27ac30b5f1cfe/626bce701d2fd7781b6f8653",
        "October 19th, 2023 - CryptoGen Cyber Threat Intelligence Advisory #3434 - Jupyter Notebooks Under Attack - QubitStrike Malware Targets Linux Servers",
        "https://www.virustotal.com/graph/g909fda2b00874cfcac059078fd24495c5ac4a8b219cd4b8fb8108b19dab31ad8",
        "https://hybrid-analysis.com/sample/e22d8ea5dc8732defed6c17b4bec3fbdf092aa86df4f4b80c768037fd59397ac/626bc2368590ef23a25053b4"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Coin miner",
            "Qubitstrike",
            "Linux"
          ],
          "industries": [
            ""
          ],
          "unique_indicators": 18027
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/monerpool.org",
    "whois": "http://whois.domaintools.com/monerpool.org",
    "domain": "monerpool.org",
    "hostname": "cbdv2.monerpool.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "65708f3d55770338a7d7e46b",
      "name": "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
      "description": "",
      "modified": "2023-12-06T15:11:57.253000",
      "created": "2023-12-06T15:11:57.253000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 430,
        "hostname": 1503,
        "domain": 1549,
        "URL": 3561,
        "FileHash-MD5": 1
      },
      "indicator_count": 7045,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708cee75cb524822443805",
      "name": "what a difference a . makes -  irr.blizzard.com. - CVE-2018-8120",
      "description": "",
      "modified": "2023-12-06T15:02:05.972000",
      "created": "2023-12-06T15:02:05.972000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6174,
        "FileHash-SHA256": 1762,
        "domain": 693,
        "email": 2,
        "hostname": 1343,
        "FileHash-MD5": 115,
        "FileHash-SHA1": 107,
        "CVE": 2
      },
      "indicator_count": 10198,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 114,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653090cd5c6271761323a7a4",
      "name": "Jupyter Notebooks Under Attack: QubitStrike Malware Targets Linux Servers",
      "description": "",
      "modified": "2023-11-18T01:05:41.002000",
      "created": "2023-10-19T02:13:33.190000",
      "tags": [
        "cyber security news",
        "cyber news",
        "cyber security news today",
        "cyber security updates",
        "cyber updates",
        "hacker news",
        "hacking news",
        "software vulnerability",
        "cyber attacks",
        "data breach",
        "ransomware malware",
        "how to hack",
        "network security",
        "information security",
        "the hacker news",
        "computer security",
        "tunisia",
        "qubitstrike",
        "cado",
        "telegram api",
        "git hosting",
        "github",
        "matt muir",
        "nate bill",
        "jupyter",
        "codeberg",
        "discord",
        "twitter",
        "linux server",
        "linux",
        "telegram bot",
        "discord channel",
        "linux rootkit",
        "xmrrig miner",
        "google cloud",
        "cado research",
        "download",
        "insert",
        "install",
        "teamtnt",
        "cryptojacking",
        "cloud",
        "cado security",
        "aws",
        "malware",
        "saas",
        "muir",
        "jupyter web",
        "threat research",
        "lead",
        "help net",
        "ssh key",
        "cloud service",
        "ssh propagation",
        "xmrig",
        "persistence",
        "python",
        "netshadow",
        "blacksun",
        "diamorphine",
        "strong",
        "github desktop",
        "linux kernels",
        "arm64",
        "sign",
        "lkm rootkit",
        "search",
        "cancel create",
        "star",
        "victor",
        "footer",
        "ipv4 url"
      ],
      "references": [
        "October 19th, 2023 - CryptoGen Cyber Threat Intelligence Advisory #3434 - Jupyter Notebooks Under Attack - QubitStrike Malware Targets Linux Servers"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Qubitstrike",
          "display_name": "Qubitstrike",
          "target": null
        },
        {
          "id": "Linux",
          "display_name": "Linux",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1049",
          "name": "System Network Connections Discovery",
          "display_name": "T1049 - System Network Connections Discovery"
        },
        {
          "id": "T1526",
          "name": "Cloud Service Discovery",
          "display_name": "T1526 - Cloud Service Discovery"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "cryptocti",
        "id": "110256",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 58,
        "hostname": 43,
        "domain": 4,
        "URL": 110
      },
      "indicator_count": 219,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 499,
      "modified_text": "926 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6295d72c09bca73117c7b35c",
      "name": "\u5a01\u80c1\u72e9\u730e\u2014\u6316\u77ff\u6728\u9a6c\u7684\u5206\u6790\u4e0e\u8ddf\u8e2a",
      "description": "\u5a01\u80c1\u60c5\u62a5\u56e2\u961f\u901a\u8fc7\u5bf9\u6316\u77ff\u6728\u9a6c\u5bb6\u65cf\u7684\u5a01\u80c1\u72e9\u730e\uff0c\u83b7\u5f97\u5927\u91cf\u6316\u77ff\u6728\u9a6c\u5e38\u7528\u6316\u77ff\u57df\u540d\u548c\u76f8\u5173C2\u3002",
      "modified": "2023-07-19T06:10:51.967000",
      "created": "2022-05-31T08:51:55.995000",
      "tags": [
        "CoinMiner",
        "HotSpot"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Coin Miner",
          "display_name": "Coin Miner",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "junchuanyang1",
        "id": "157561",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157561/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 285,
        "hostname": 109,
        "domain": 21
      },
      "indicator_count": 415,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 88,
      "modified_text": "1048 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62981c9999c140fe3dc70f18",
      "name": "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
      "description": "",
      "modified": "2022-07-02T00:05:39.094000",
      "created": "2022-06-02T02:12:41.574000",
      "tags": [
        "geoip",
        "cloudflarenet",
        "as13335",
        "as16276",
        "apache geoip",
        "as57724",
        "ddosguard",
        "as49282",
        "ficolo",
        "as24940",
        "xserver",
        "media",
        "telecom",
        "https://www.flooringforum.com/media/",
        "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
        "CVE-2017-0147"
      ],
      "references": [
        "filename:\"fa-brands-400.woff2?_v=5.15.3\"",
        "CVE-2017-0147"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3561,
        "hostname": 1503,
        "FileHash-SHA256": 430,
        "domain": 1549,
        "CVE": 1,
        "FileHash-MD5": 1
      },
      "indicator_count": 7045,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 393,
      "modified_text": "1430 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "626bdc17d4519e2619a504da",
      "name": "what a difference a . makes -  irr.blizzard.com. - CVE-2018-8120",
      "description": "",
      "modified": "2022-05-30T00:00:40.928000",
      "created": "2022-04-29T12:37:43.880000",
      "tags": [
        "irr.blizzard.com",
        "irr.blizzard.com.",
        "24.105.29.24",
        "CVE-2018-8120"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/0046d22f2c6d0d3805d3ac393a5e9a6d22fbdf4c536accc953c0ad6016180e2f/626bcef6f5f0f643c216c84c",
        "https://hybrid-analysis.com/sample/60efb7ca24b6996a44c919d50ebcffe4092591ab15e6acda03f6a459ee96646e/626bd048a7193d6c1b3e9910",
        "https://hybrid-analysis.com/sample/95121783365a25ff1016eb630deaf5ee50456295161604553fb27ac30b5f1cfe/626bce701d2fd7781b6f8653",
        "https://hybrid-analysis.com/sample/e22d8ea5dc8732defed6c17b4bec3fbdf092aa86df4f4b80c768037fd59397ac/626bc2368590ef23a25053b4",
        "74.203.211.12:1433",
        "irr.blizzard.com. 24.105.29.24",
        "https://www.virustotal.com/graph/g909fda2b00874cfcac059078fd24495c5ac4a8b219cd4b8fb8108b19dab31ad8"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        }
      ],
      "industries": [
        ""
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1343,
        "URL": 6174,
        "domain": 693,
        "FileHash-SHA256": 1762,
        "FileHash-MD5": 115,
        "CVE": 2,
        "FileHash-SHA1": 107,
        "email": 2
      },
      "indicator_count": 10198,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 410,
      "modified_text": "1463 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cbdv2.monerpool.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cbdv2.monerpool.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780297480.3692732
}