{ "type": "URL", "indicator": "https://clipboardjs.com/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://clipboardjs.com/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3083917131, "indicator": "https://clipboardjs.com/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "69b7ac3b32ac89ecba53f3d9", "name": "Malicious", "description": "", "modified": "2026-04-15T08:44:52.171000", "created": "2026-03-16T07:07:39.495000", "tags": [ "march", "input http", "posix shell", "ascii text", "threat level", "summary av", "detection", "environment", "action" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 291, "URL": 272, "hostname": 296, "domain": 293, "FileHash-MD5": 90, "FileHash-SHA1": 89, "CIDR": 3, "email": 3, "SSLCertFingerprint": 9 }, "indicator_count": 1346, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "4 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b1f368db0d00947ef729c2", "name": "\u5403\u74dc\u770b\u9ed1\u6599\u5c31\u4e0a - \u9ed1\u6599\u5403\u74dc\u7f51 | \u70ed\u95e8\u4e8b\u4ef6\u7206\u6599\u4e0e\u771f\u76f8", "description": "Why is this type of malicious found on a US citizens device? Found in a link extracted from a glitching device.. Palantir\u2019s Prometheus Intelligence Technology tracking and AI at work.\n#tracker #http_redirect #onlyfans_? #bombing #airlines #lalal.ai #openclaw #targeted", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-11T22:57:44.584000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b235439d56630943ea31e6", "name": "Clone by Q Vashti (excellent systemic analyzer I may add)", "description": "", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-12T03:38:43.171000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": "69b1f368db0d00947ef729c2", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bbc4c8bf557c17688e1", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "", "modified": "2023-12-06T14:57:00.280000", "created": "2023-12-06T14:57:00.280000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 233, "domain": 361, "hostname": 563, "URL": 1374, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570842bc1e3efb7d13f5e30", "name": "pastebin.fun.zlubq7geis.", "description": "", "modified": "2023-12-06T14:24:43.338000", "created": "2023-12-06T14:24:43.338000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 946, "hostname": 306, "domain": 212, "URL": 839, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2330, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657084286ad40e776a240d3c", "name": "pastebin.fun.mnxtedror6", "description": "", "modified": "2023-12-06T14:24:40.711000", "created": "2023-12-06T14:24:40.711000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 939, "hostname": 306, "domain": 219, "URL": 823, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2314, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6256f92778c2f2177bdd4de9", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "Here is a full list of highlights from the Chinese TV series, which began in 2011 and has now been broadcast on Chinese television, online and mobile devices, and is now available to watch online.", "modified": "2022-05-13T00:03:35.765000", "created": "2022-04-13T16:24:07.391000", "tags": [ "date", "cnzzdata", "czuuid", "umdistinctid", "typeof symbol", "https", "zeno rocha", "typeof", "typeof define", "error", "array", "12863", "qrcode", "2g2g2h2h0g", "dhdh", "exptable", "logtable", "string", "typeof j", "regexp", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "ahgr", "0x40", "h0x1", "mm32", "indexof", "length", "h0x0", "0x248", "h0x2", "0x17b", "webpackrequire", "webpackexports", "object", "default", "hn return", "importsnvar", "truennnn", "iostf", "android", "nvar", "clickdownload", "this", "path", "service", "roboto", "boolean", "number", "createnamespace", "n default", "nn return", "null", "click", "void", "istanbul", "false", "close", "window", "info", "target", "find", "footer", "delta", "generator", "cascade", "code", "trigger", "next", "arrow", "slice", "checkbox", "body", "green", "phase", "copy", "infinity", "middle", "open", "calendar", "flex", "fail", "shift", "super", "internal", "form", "locale", "spinner", "spin", "multi", "mask", "write", "flip", "logic", "patch", "abcd", "skew", "main", "rest", "trim", "dark", "canvas", "facebook", "executor", "span", "tips", "sticky", "uploader", "bind", "config", "startpage", "speed", "toolbar", "refresh", "done", "format", "cardinal", "outside", "install", "public", "github", "vuejs", "jump", "browser", "sign", "view", "sponsor", "github sponsors", "mit license", "contact", "star", "stars", "javascript", "please", "strong", "\u9ad8\u5c71tv", "\u9ad8\u5c71tv\u5f71\u9662", "\u9ad8\u5c71tv\u770b\u7247\u7f51", "hd 20210830", "hd mu", "hd heydouga", "poro", "tv tv", "hd ok", "hd fol", "hd nanami2", "hd \uff13", "hd 20210927" ], "references": [ "http://www.bbbbop13.com:1313/", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "https://web.op39v.xyz/?channelCode=pingguo", "https://github.com/vuejs/vue-devtools", "https://web.op39v.xyz/js/chunk-vendors.js", "https://web.op39v.xyz/js/chunk-common.js", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "https://c.cnzz.com/core.php?web_id=1280740152&t=z" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1374, "hostname": 563, "CVE": 1, "domain": 361, "FileHash-SHA256": 233, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1437 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625088e80292028d4e82311c", "name": "Botnet-malware -lgmhgjm.com", "description": "The full list of names and names of people who have taken part in the 2016 Olympics and Paralympics in Rio de Janeiro, Brazil, as part of the Rio Games, and as well as the 2017 Olympics in Brazil.", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T19:11:36.165000", "tags": [ "function", "param", "object", "return", "webpackrequire", "constructor", "clipboard", "typeof", "symbol", "typeerror", "error", "click", "null", "copy", "factory", "super", "date", "target", "mustflag", "html", "applewebkit", "ipad", "mqqbrowser", "base", "trident", "presto", "gecko", "khtml", "ios android", "android", "array", "2f2f2i2i0f", "eh0g", "exptable", "logtable", "typeof h", "typeof e", "regexp", "typeof n", "typeof t", "width", "typeof r", "pseudo", "class", "this", "accept", "false", "https", "zeno rocha", "typeof define", "select", "input", "textarea", "0x455d", "0x34260b", "0x4ce9d1", "avge", "tung", "3ctz", "n33m", "0x514351", "hn4d", "0x70c2f4", "push", "shift", "baidu", "instanceof", "adjust", "body", "nulli", "windowi", "typeof jquery", "tthis", "mspointerdown", "child", "sfunction", "microsoft yahei", "arial", "x20trnf", "version", "swiper", "most", "copyright", "mit license", "october", "win32", "meta", "parsefloat", "androidgi", "iphonegi", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "wifi", "saol", "fc2ppv12518005", "oretd633riana01", "hodv sex", "orec37502", "06inn01", "siro2661ol2401", "garea742kou01", "175cm9av", "attr", "typeof symbol", "root", "length", "indexof", "x0ax20x20x20x20", "location", "math", "0x10", "0x18", "history", "config", "slice", "cookie", "open", "onload", "adunit", "refresh", "style", "position", "creativetplid", "show", "tcmod", "tcheight", "height", "yahei", "truetype", "f8f8f8", "typeof module", "reserved", "18hdxxxx\u4e2d\u56fd", "\u5973\u4e3b\u7a7f\u8d8a\u88ab\u8089\u6765\u8089\u53bbnp", "\u7537\u753718\u7981\u6c61\u8089\u56fe\u65e0\u7801", "\u65e0\u7801\u4e9a\u6d32\u6210a\u4eba\u7247\u5728\u7ebf\u89c2\u770b", "ore572s04", "ore572s03", "ore572s02", "ore572s01", "fc2ppv117430501", "cmi1513707", "cmi1513706", "cmi1513705", "cmi1513704", "cmi1513703", "\u514d\u8d39\u89c6\u9891\u7231\u7231\u592a\u723d\u4e86\u7f51\u7ad9_\u8001\u8272\u9b3c\u5728\u7ebf\u7cbe\u54c1\u89c6\u9891\u5728\u7ebf\u89c2\u770b_\u767d\u6d01\u4e00\u591c\u88ab\u723d\u4e86\u4e03\u6b21_\u5fd8\u4e86\u6234\u80f8\u7f69\u88ab\u540c\u5b66\u6478\u4e86\u4e00\u8282\u8bfe", "viewport" ], "references": [ "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "http://www.lgmhgjm.com/common.js", "http://www.lgmhgjm.com/tj.js", "http://www.sp385.com/", "http://avtv10.com", "http://9766.tv", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "https://xc.6xc.tv/css/index.css", "https://xctg07.cc/?channelCode=xiaosu03_8", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "http://sdk.51.la/js-sdk-pro.min.js", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "http://kniveb.info/template/9c/ads/gonggao.js", "http://kniveb.info/", "https://koban360.com/ky/?shareName=1736.com", "https://koban360.com/ky/js/flexible.js", "https://koban360.com/ky/js/swiper.min.js", "https://koban360.com/ky/js/jquery.min.js", "https://koban360.com/ky/css/m.css?vs=1.7", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "https://xbt.0lunwen.com/3/js/flexible.js", "https://xbt.0lunwen.com/boinstall.js", "https://miaouuuc.com/?channelCode=852890&aid=852890", "https://miaouuuc.com/template/static/js/clipborad.min.js", "https://am96.vip/", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 482, "URL": 1383, "FileHash-SHA256": 104, "domain": 199, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2171, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62323620869dfa6ef690b92e", "name": "pastebin.fun.mnxtedror6", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T19:10:24.706000", "tags": [], "references": [ "pastebin.fun.mnxtedror6.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 824, "hostname": 306, "domain": 219, "FileHash-SHA256": 939, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2315, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623237a80722476fe44c6eb4", "name": "pastebin.fun.zlubq7geis.", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T19:16:56.509000", "tags": [], "references": [ "pastebin.fun.zlubq7geis.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 840, "hostname": 306, "domain": 212, "FileHash-SHA256": 946, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2331, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "https://xc.6xc.tv/css/index.css", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "http://avtv10.com", "Amazon.com", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://xctg07.cc/?channelCode=xiaosu03_8", "pastebin.fun.zlubq7geis.pdf", "http://www.lgmhgjm.com/common.js", "delete-me.bgs.beanie.cloud", "https://xbt.0lunwen.com/boinstall.js", "https://koban360.com/ky/?shareName=1736.com", "https://miaouuuc.com/template/static/js/clipborad.min.js", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "https://koban360.com/ky/css/m.css?vs=1.7", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "https://am96.vip/", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "http://kniveb.info/", "https://web.op39v.xyz/?channelCode=pingguo", "http://www.lgmhgjm.com/tj.js", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "sso.dev.applemarketingtools.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "https://koban360.com/ky/js/flexible.js", "Will sort to identify malware", "containers-oceanus.palantirsec.com", "https://github.com/vuejs/vue-devtools", "http://9766.tv", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "http://sdk.51.la/js-sdk-pro.min.js", "https://xbt.0lunwen.com/3/js/flexible.js", "lalal.ai", "https://bombing.gwuzafo.cc/", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js", "quantum-staging.emsbk.com", "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "http://kniveb.info/template/9c/ads/gonggao.js", "https://koban360.com/ky/js/jquery.min.js", "pastebin.fun.mnxtedror6.pdf", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "https://koban360.com/ky/js/swiper.min.js", "spf.google.com", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "api-cookie.click", "https://miaouuuc.com/?channelCode=852890&aid=852890", "test-ssa.pineapples.dev", "https://web.op39v.xyz/js/chunk-vendors.js", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "http://www.bbbbop13.com:1313/", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "http://www.sp385.com/", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "https://web.op39v.xyz/js/chunk-common.js", "https://c.cnzz.com/core.php?web_id=1280740152&t=z" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Malware" ], "industries": [], "unique_indicators": 16858 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/clipboardjs.com", "whois": "http://whois.domaintools.com/clipboardjs.com", "domain": "clipboardjs.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "69b7ac3b32ac89ecba53f3d9", "name": "Malicious", "description": "", "modified": "2026-04-15T08:44:52.171000", "created": "2026-03-16T07:07:39.495000", "tags": [ "march", "input http", "posix shell", "ascii text", "threat level", "summary av", "detection", "environment", "action" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 291, "URL": 272, "hostname": 296, "domain": 293, "FileHash-MD5": 90, "FileHash-SHA1": 89, "CIDR": 3, "email": 3, "SSLCertFingerprint": 9 }, "indicator_count": 1346, "is_author": false, "is_subscribing": null, "subscriber_count": 49, "modified_text": "4 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b1f368db0d00947ef729c2", "name": "\u5403\u74dc\u770b\u9ed1\u6599\u5c31\u4e0a - \u9ed1\u6599\u5403\u74dc\u7f51 | \u70ed\u95e8\u4e8b\u4ef6\u7206\u6599\u4e0e\u771f\u76f8", "description": "Why is this type of malicious found on a US citizens device? Found in a link extracted from a glitching device.. Palantir\u2019s Prometheus Intelligence Technology tracking and AI at work.\n#tracker #http_redirect #onlyfans_? #bombing #airlines #lalal.ai #openclaw #targeted", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-11T22:57:44.584000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b235439d56630943ea31e6", "name": "Clone by Q Vashti (excellent systemic analyzer I may add)", "description": "", "modified": "2026-04-10T22:04:28.607000", "created": "2026-03-12T03:38:43.171000", "tags": [ "\u9ed1\u6599", "\u5403\u74dc", "\u5403\u74dc\u7f51", "51\u5403\u74dc", "\u9ed1\u6599\u4e0d\u6253\u70ca", "\u9ed1\u6599\u5403\u74dc\u7f51", "\u70ed\u95e8\u5927\u74dc", "\u660e\u661f\u8d44\u8baf", "\u7f51\u7ea2\u9ed1\u6599", "\u5185\u6db5\u6bb5\u5b50", "\u4eca\u65e5\u5403\u74dc", "\u5403\u74dc\u65b0\u95fb", "\u9ed1\u6599\u66dd\u5149", "\u516b\u5366\u65b0\u95fb", "\u793e\u4f1a\u70ed\u70b9", "\u5403\u74dc\u7fa4\u4f17", "\u70ed\u70b9\u4e8b\u4ef6", "\u6bcf\u65e5\u5403\u74dc", "\u7f51\u7ea2\u5403\u74dc", "\u4eca\u65e5\u5927\u74dc", "\u5403\u74dc\u7206\u6599", "\u5403\u74dc\u4e2d\u5fc3", "\u4eca\u65e5\u70ed\u74dc", "\u5403\u74dc\u9ed1\u6599", "\u9ed1\u6599\u6cc4\u5bc6", "\u91cd\u78c5\u9ed1\u6599", "\u5403\u74dc\u6cc4\u5bc6", "\u4eca\u65e5\u9ed1\u6599", "\u6700\u65b0\u9ed1\u6599", "\u5403\u74dc\u66dd\u5149", "\u5403\u74dc\u8d44\u6e90", "\u91cd\u78c5\u5403\u74dc", "\u5a31\u4e50\u70ed\u74dc", "chrome", "cos ai", "a serif", "sans serif", "top10", "openclaw", "21200", "onlyfans", "strong", "dmca copyright", "address google", "safe browsing", "data upload", "extraction", "lte all", "enter sc", "type o", "extra", "referen https", "lte o", "type", "extr data", "include review", "exclude sugges", "failed", "hong kong", "passive dns", "otx logo", "all ipv4", "url analysis", "urls", "files", "location hong", "value", "march", "0x1595 function", "0x19b5 object", "tracker", "base64 object", "cookie function", "mlog", "localconst", "style function", "reverse dns", "general full", "url https", "resource", "software", "hash", "security tls", "singapore", "asn139341", "aceasap ace", "ip address", "cloudflare", "report", "whois", "as13335", "name lookup", "website", "kong", "ssl certificate", "http", "request chain", "nl redirected", "http redirect", "kb script", "protocol h3", "security quic", "seychelles", "asn13335", "cloudflarenet", "js function", "portable descr", "internet", "iana", "iana web", "stepgo limited", "assigned pa", "afrinic", "filtered parent", "ebene", "mahe", "stepgo", "united", "unknown ns", "script script", "moved", "record value", "title", "0 lte", "find s", "size", "mitre att", "ck id", "ck matrix", "root", "hybrid", "general", "path", "click", "strings", "yrbyd", "learn", "name tactics", "suspicious", "informative", "command", "adversaries", "spawns", "initial access", "lalal.ai", "record type", "ttl value", "thumbprint", "ios ping", "defense evasion", "id name", "malicious", "t1055.015 list planting", "sha1", "copy md5", "sha256", "pattern match", "show technique", "unknown", "accept", "date", "local", "starfield", "encrypt", "iframe", "prometheus intelligence technology", "apple", "cyber attacks", "usptracker.com", "android" ], "references": [ "https://airline.cmntgoyq.com/ | Prometheus Intelligence Technology", "lalal.ai", "logstream-mystifying-tharp-7si72pw.cribl.cloud", "quantum-staging.emsbk.com", "spf.google.com", "Amazon.com", "mc.yandex.com \u2022 mc.yandex.ru \u2022 yandex.com \u2022 yandex.ru", "mc.yandex.com/metrika/ \u2022 mc.yandex.com/watch/99885987/", "api-cookie.click", "delete-me.bgs.beanie.cloud", "bridge-websocket-evolosciuc.devint01.goodleap.com", "https://bombing.gwuzafo.cc/", "test-ssa.pineapples.dev", "sso.dev.applemarketingtools.com", "containers-oceanus.palantirsec.com", "https://otx.alienvault.com/pulse/69af3fd8db2ede31abda6c14", "kadmos.bot \u2022 cutout.bot \u2022 scenebot.com", "https://www.lalal.ai/privacy-policy/InvalidOutputFolderErrorQAndroidJniObject", "Will sort to identify malware", "https://hybrid-analysis.com/sample/9e7bfc9fb60aa3e3f3c5b91f84ebf8b07e35893e1491149420535cd494bb8a32/69b1b467625a11ce330587db" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Malware", "display_name": "Malware", "target": null } ], "attack_ids": [ { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1069", "name": "Permission Groups Discovery", "display_name": "T1069 - Permission Groups Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.001", "name": "Domains", "display_name": "T1583.001 - Domains" }, { "id": "T1566.002", "name": "Spearphishing Link", "display_name": "T1566.002 - Spearphishing Link" }, { "id": "T1553.002", "name": "Code Signing", "display_name": "T1553.002 - Code Signing" }, { "id": "T1069.002", "name": "Domain Groups", "display_name": "T1069.002 - Domain Groups" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1048", "name": "Exfiltration Over Alternative Protocol", "display_name": "T1048 - Exfiltration Over Alternative Protocol" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1562.001", "name": "Disable or Modify Tools", "display_name": "T1562.001 - Disable or Modify Tools" }, { "id": "T1048.003", "name": "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol", "display_name": "T1048.003 - Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" }, { "id": "T1584.005", "name": "Botnet", "display_name": "T1584.005 - Botnet" } ], "industries": [], "TLP": "white", "cloned_from": "69b1f368db0d00947ef729c2", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4097, "domain": 849, "hostname": 2440, "FileHash-MD5": 149, "FileHash-SHA1": 131, "FileHash-SHA256": 955, "CIDR": 5, "email": 6, "SSLCertFingerprint": 8 }, "indicator_count": 8640, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "8 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bbc4c8bf557c17688e1", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "", "modified": "2023-12-06T14:57:00.280000", "created": "2023-12-06T14:57:00.280000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 233, "domain": 361, "hostname": 563, "URL": 1374, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570842bc1e3efb7d13f5e30", "name": "pastebin.fun.zlubq7geis.", "description": "", "modified": "2023-12-06T14:24:43.338000", "created": "2023-12-06T14:24:43.338000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 946, "hostname": 306, "domain": 212, "URL": 839, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2330, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657084286ad40e776a240d3c", "name": "pastebin.fun.mnxtedror6", "description": "", "modified": "2023-12-06T14:24:40.711000", "created": "2023-12-06T14:24:40.711000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 939, "hostname": 306, "domain": 219, "URL": 823, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2314, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6256f92778c2f2177bdd4de9", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "Here is a full list of highlights from the Chinese TV series, which began in 2011 and has now been broadcast on Chinese television, online and mobile devices, and is now available to watch online.", "modified": "2022-05-13T00:03:35.765000", "created": "2022-04-13T16:24:07.391000", "tags": [ "date", "cnzzdata", "czuuid", "umdistinctid", "typeof symbol", "https", "zeno rocha", "typeof", "typeof define", "error", "array", "12863", "qrcode", "2g2g2h2h0g", "dhdh", "exptable", "logtable", "string", "typeof j", "regexp", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "ahgr", "0x40", "h0x1", "mm32", "indexof", "length", "h0x0", "0x248", "h0x2", "0x17b", "webpackrequire", "webpackexports", "object", "default", "hn return", "importsnvar", "truennnn", "iostf", "android", "nvar", "clickdownload", "this", "path", "service", "roboto", "boolean", "number", "createnamespace", "n default", "nn return", "null", "click", "void", "istanbul", "false", "close", "window", "info", "target", "find", "footer", "delta", "generator", "cascade", "code", "trigger", "next", "arrow", "slice", "checkbox", "body", "green", "phase", "copy", "infinity", "middle", "open", "calendar", "flex", "fail", "shift", "super", "internal", "form", "locale", "spinner", "spin", "multi", "mask", "write", "flip", "logic", "patch", "abcd", "skew", "main", "rest", "trim", "dark", "canvas", "facebook", "executor", "span", "tips", "sticky", "uploader", "bind", "config", "startpage", "speed", "toolbar", "refresh", "done", "format", "cardinal", "outside", "install", "public", "github", "vuejs", "jump", "browser", "sign", "view", "sponsor", "github sponsors", "mit license", "contact", "star", "stars", "javascript", "please", "strong", "\u9ad8\u5c71tv", "\u9ad8\u5c71tv\u5f71\u9662", "\u9ad8\u5c71tv\u770b\u7247\u7f51", "hd 20210830", "hd mu", "hd heydouga", "poro", "tv tv", "hd ok", "hd fol", "hd nanami2", "hd \uff13", "hd 20210927" ], "references": [ "http://www.bbbbop13.com:1313/", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "https://web.op39v.xyz/?channelCode=pingguo", "https://github.com/vuejs/vue-devtools", "https://web.op39v.xyz/js/chunk-vendors.js", "https://web.op39v.xyz/js/chunk-common.js", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "https://c.cnzz.com/core.php?web_id=1280740152&t=z" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1374, "hostname": 563, "CVE": 1, "domain": 361, "FileHash-SHA256": 233, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1437 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625088e80292028d4e82311c", "name": "Botnet-malware -lgmhgjm.com", "description": "The full list of names and names of people who have taken part in the 2016 Olympics and Paralympics in Rio de Janeiro, Brazil, as part of the Rio Games, and as well as the 2017 Olympics in Brazil.", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T19:11:36.165000", "tags": [ "function", "param", "object", "return", "webpackrequire", "constructor", "clipboard", "typeof", "symbol", "typeerror", "error", "click", "null", "copy", "factory", "super", "date", "target", "mustflag", "html", "applewebkit", "ipad", "mqqbrowser", "base", "trident", "presto", "gecko", "khtml", "ios android", "android", "array", "2f2f2i2i0f", "eh0g", "exptable", "logtable", "typeof h", "typeof e", "regexp", "typeof n", "typeof t", "width", "typeof r", "pseudo", "class", "this", "accept", "false", "https", "zeno rocha", "typeof define", "select", "input", "textarea", "0x455d", "0x34260b", "0x4ce9d1", "avge", "tung", "3ctz", "n33m", "0x514351", "hn4d", "0x70c2f4", "push", "shift", "baidu", "instanceof", "adjust", "body", "nulli", "windowi", "typeof jquery", "tthis", "mspointerdown", "child", "sfunction", "microsoft yahei", "arial", "x20trnf", "version", "swiper", "most", "copyright", "mit license", "october", "win32", "meta", "parsefloat", "androidgi", "iphonegi", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "wifi", "saol", "fc2ppv12518005", "oretd633riana01", "hodv sex", "orec37502", "06inn01", "siro2661ol2401", "garea742kou01", "175cm9av", "attr", "typeof symbol", "root", "length", "indexof", "x0ax20x20x20x20", "location", "math", "0x10", "0x18", "history", "config", "slice", "cookie", "open", "onload", "adunit", "refresh", "style", "position", "creativetplid", "show", "tcmod", "tcheight", "height", "yahei", "truetype", "f8f8f8", "typeof module", "reserved", "18hdxxxx\u4e2d\u56fd", "\u5973\u4e3b\u7a7f\u8d8a\u88ab\u8089\u6765\u8089\u53bbnp", "\u7537\u753718\u7981\u6c61\u8089\u56fe\u65e0\u7801", "\u65e0\u7801\u4e9a\u6d32\u6210a\u4eba\u7247\u5728\u7ebf\u89c2\u770b", "ore572s04", "ore572s03", "ore572s02", "ore572s01", "fc2ppv117430501", "cmi1513707", "cmi1513706", "cmi1513705", "cmi1513704", "cmi1513703", "\u514d\u8d39\u89c6\u9891\u7231\u7231\u592a\u723d\u4e86\u7f51\u7ad9_\u8001\u8272\u9b3c\u5728\u7ebf\u7cbe\u54c1\u89c6\u9891\u5728\u7ebf\u89c2\u770b_\u767d\u6d01\u4e00\u591c\u88ab\u723d\u4e86\u4e03\u6b21_\u5fd8\u4e86\u6234\u80f8\u7f69\u88ab\u540c\u5b66\u6478\u4e86\u4e00\u8282\u8bfe", "viewport" ], "references": [ "xfe-URL-lgmhgjm.com-stix2-2.0-export.json", "http://www.lgmhgjm.com/common.js", "http://www.lgmhgjm.com/tj.js", "http://www.sp385.com/", "http://avtv10.com", "http://9766.tv", "https://xc.6xc.tv/?channelCode=xiaosu03_8", "https://app.okoockec.xyz:8443/apps/v2/index1/0c1d6cd4e9634a3d?m=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoiZzByUjNpMUczaEt0Sk5sZmVNSE44NEhjVDlDOVFTM2xEcm5pM1dIWG9UM1FBSklpR1phN01teTZOcjFxVVJIWVlhZnJPQkE9IiwiZXhwIjoxNjQ5NDQ0NDcyfQ.utSNnRI7C9FuWMUxhY4cufCJBIuHUk5vdk8Dj6WnXYs", "https://xc.6xc.tv/js/jquery-3.6.0.min.js", "https://xc.6xc.tv/css/index.css", "https://xctg07.cc/?channelCode=xiaosu03_8", "https://ad.abilm.info/bid?url=http%3A%2F%2Fkniveb.info%2F&frm=0&ref=http%3A%2F%2Fwww.sp385.com%2F&ic=1&pl=0&ml=0&sid=105:80:104:111:110:101:58:50:53:48:50:50:51:49:53:54:58:51:58:51:57:48:46:56:52:52&ps=20030107&lgs=0&zo=240&ws=390x844&gdm=0&iw=1&cpn=0&fid=5d80d32079e9fdb035e4886c32c6612e&hl=2&ihn=0&md=1&ns=undefined&np=undefined&pj=0&top=650&left=0&id=47&rid=ec5a07ef8f3e3f2c25ba75c7da106dcc&dcc=&dcl=&gvd=Apple%20Inc.&grr=Apple%20GPU&ct=unknown&diit=&dit=&cmn=", "http://sdk.51.la/js-sdk-pro.min.js", "http://sdk.51.la/event/js-sdk-event.min.js?u=JYWHYgTN1B6iZ5P2", "http://kniveb.info/template/9c/ads/gonggao.js", "http://kniveb.info/", "https://koban360.com/ky/?shareName=1736.com", "https://koban360.com/ky/js/flexible.js", "https://koban360.com/ky/js/swiper.min.js", "https://koban360.com/ky/js/jquery.min.js", "https://koban360.com/ky/css/m.css?vs=1.7", "https://libs.baidu.com/jquery/2.0.0/jquery.min.js", "https://xbt.0lunwen.com/3/js/flexible.js", "https://xbt.0lunwen.com/boinstall.js", "https://miaouuuc.com/?channelCode=852890&aid=852890", "https://miaouuuc.com/template/static/js/clipborad.min.js", "https://am96.vip/", "https://unpkg.com/jquery-1.10.2@1.10.2/jquery-1.10.2.min.js", "https://unpkg.com/jquery.qrcode@1.0.3/jquery.qrcode.min.js", "https://www.gootft.com/js/app.base.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://www.gootft.com/js/poplayer.js;jsessionid=20F7490B81FBD25B0DE24EE1076D230D", "https://unpkg.com/clipboard@2.0.8/dist/clipboard.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 482, "URL": 1383, "FileHash-SHA256": 104, "domain": 199, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 2171, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62323620869dfa6ef690b92e", "name": "pastebin.fun.mnxtedror6", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T19:10:24.706000", "tags": [], "references": [ "pastebin.fun.mnxtedror6.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 824, "hostname": 306, "domain": 219, "FileHash-SHA256": 939, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2315, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623237a80722476fe44c6eb4", "name": "pastebin.fun.zlubq7geis.", "description": "", "modified": "2022-04-15T00:03:47.669000", "created": "2022-03-16T19:16:56.509000", "tags": [], "references": [ "pastebin.fun.zlubq7geis.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 840, "hostname": 306, "domain": 212, "FileHash-SHA256": 946, "CIDR": 9, "FileHash-MD5": 18 }, "indicator_count": 2331, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://clipboardjs.com/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://clipboardjs.com/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776624658.0483649 }