{ "type": "URL", "indicator": "https://e.ctor.options.name", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://e.ctor.options.name", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3414806134, "indicator": "https://e.ctor.options.name", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 19, "pulses": [ { "id": "655aef8a8cc2e0929f2aa5ea", "name": "Python Initiated Connection | Spyware | Remote Attacks |", "description": "", "modified": "2023-12-18T23:03:18.732000", "created": "2023-11-20T05:32:58.400000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et", "october", "contacted", "threat roundup", "january", "cyberstalking", "attack", "icmp", "banker", "keylogger", "google llc", "gc abuse", "orgid", "direct", "whois lookup", "netrange", "nethandle", "net34", "net340000", "googl2", "comment", "gc", "dns replication", "date", "domain", "win32 exe", "driver pro", "files", "detections type", "name", "optimizer pro", "javascript", "text", "text ip", "aacr", "type name", "email", "email delivery", "email fwd", "delivery status", "notification", "name verdict", "runtime process", "sha1", "size", "localappdata", "temp", "prefetch8", "unicode text", "type data", "programfiles", "win64", "hybrid", "click", "strings", "youth", "pe resource", "apple private", "data collection", "hidden privacy", "threats https", "legal", "amazon aws", "wife happy", "vhash", "authentihash", "ssdeep", "file type", "magic pe32", "intel", "ms windows", "trid windows", "os2 executable", "compiler", "delphi", "sections", "md5 code", "data", "children", "file size", "dropped files", "google update", "setup sha256", "kb file" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "green", "cloned_from": "655950034e6ae4650a6b02ce", "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 12901, "hostname": 4445, "domain": 3685, "FileHash-MD5": 197, "FileHash-SHA256": 5136, "FileHash-SHA1": 170, "CIDR": 1, "email": 2, "CVE": 4 }, "indicator_count": 26541, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655950034e6ae4650a6b02ce", "name": "Python Initiated Connection | Spyware | Remote Attacks | | Part 4", "description": "Apple, Mac, iOS, phishing, frauds services, malware, trojan.allesgreh/trojan.allesgreh/respat, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and possibly others. Python Initiated Connection, WScriptShell_Case_Anomaly.\nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]", "modified": "2023-12-18T23:03:18.732000", "created": "2023-11-19T00:00:03.258000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et", "october", "contacted", "threat roundup", "january", "cyberstalking", "attack", "icmp", "banker", "keylogger", "google llc", "gc abuse", "orgid", "direct", "whois lookup", "netrange", "nethandle", "net34", "net340000", "googl2", "comment", "gc", "dns replication", "date", "domain", "win32 exe", "driver pro", "files", "detections type", "name", "optimizer pro", "javascript", "text", "text ip", "aacr", "type name", "email", "email delivery", "email fwd", "delivery status", "notification", "name verdict", "runtime process", "sha1", "size", "localappdata", "temp", "prefetch8", "unicode text", "type data", "programfiles", "win64", "hybrid", "click", "strings", "youth", "pe resource", "apple private", "data collection", "hidden privacy", "threats https", "legal", "amazon aws", "wife happy", "vhash", "authentihash", "ssdeep", "file type", "magic pe32", "intel", "ms windows", "trid windows", "os2 executable", "compiler", "delphi", "sections", "md5 code", "data", "children", "file size", "dropped files", "google update", "setup sha256", "kb file" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 12901, "hostname": 4445, "domain": 3685, "FileHash-MD5": 197, "FileHash-SHA256": 5136, "FileHash-SHA1": 170, "CIDR": 1, "email": 2, "CVE": 4 }, "indicator_count": 26541, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655907b9da2479892590b77a", "name": "Apple iOS Spyware | Remote Attacks | Fraud Services | Part 3", "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]", "modified": "2023-12-18T16:03:26.037000", "created": "2023-11-18T18:51:37.411000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8650, "hostname": 3073, "domain": 2708, "FileHash-MD5": 118, "FileHash-SHA256": 3552, "FileHash-SHA1": 104 }, "indicator_count": 18205, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655907b4d8c905f4475d8bcc", "name": "Apple iOS Spyware | Remote Attacks | Fraud Services | Part 3", "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]", "modified": "2023-12-18T16:03:26.037000", "created": "2023-11-18T18:51:32.856000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8650, "hostname": 3073, "domain": 2708, "FileHash-MD5": 118, "FileHash-SHA256": 3552, "FileHash-SHA1": 104 }, "indicator_count": 18205, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c37c54dd9e78f85c0fa", "name": "\u7ea2\u674f\u89c6\u9891 malware", "description": "", "modified": "2023-12-06T14:59:03.859000", "created": "2023-12-06T14:59:03.859000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1686, "hostname": 2218, "URL": 5740, "domain": 901, "FileHash-MD5": 3 }, "indicator_count": 10548, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708beba2ba8bcfb1d10237", "name": "hostkey - Industroyer&ReduceRight", "description": "", "modified": "2023-12-06T14:57:47.430000", "created": "2023-12-06T14:57:47.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 304, "hostname": 563, "domain": 407, "URL": 1776, "FileHash-SHA1": 2 }, "indicator_count": 3052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bbc4c8bf557c17688e1", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "", "modified": "2023-12-06T14:57:00.280000", "created": "2023-12-06T14:57:00.280000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 233, "domain": 361, "hostname": 563, "URL": 1374, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708aa1dca4e6c505e4fc9e", "name": "Botnet c&c", "description": "", "modified": "2023-12-06T14:52:16.286000", "created": "2023-12-06T14:52:16.286000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 214, "hostname": 334, "URL": 1182, "FileHash-SHA256": 33 }, "indicator_count": 1763, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62844b9aeadcab773b3eb51a", "name": "DATAHATA - data-xata", "description": "ChunkLoadError, a new type of error, failed to load a chunk of JavaScript, according to the web browser operator, E.noconflict.com, as well as the website itself.", "modified": "2022-06-16T00:01:26.112000", "created": "2022-05-18T01:27:54.809000", "tags": [ "zendesk", "integration", "offline form", "routing website", "acquire", "english", "chatsupport", "livechat", "genesys dx", "drift", "live", "chat", "android", "contact", "twitter", "facebook", "fast", "enterprise", "small", "demo", "leave", "premium", "easy", "robin", "tbody", "span", "jost", "object", "thead", "tfoot", "typecheckbox", "typeradio", "typeof content", "array", "error", "footer", "nuxtlink", "combo", "cookie", "please", "cancel", "email", "zendesk chat", "sorry", "back", "name", "function", "document", "click", "close", "null", "hello", "noraid", "datav57c71c16", "raid0", "raid1", "raid5", "raid6", "raid10", "republic", "islands", "rating", "guinea", "reviewstab", "samoa", "china", "congo", "korea", "united", "albania", "armenia", "belarus", "chad", "cuba", "indonesia", "mexico", "panama", "paraguay", "slovakia", "ukraine", "uruguay", "bitcoin", "script", "date", "scroll", "mousemove", "touchstart", "setaccount", "trackpageview", "textjavascript", "datalayer", "gtmngp6lxc", "number", "string", "trackevent", "click button", "copyright", "host", "path", "order", "typeerror", "typeof symbol", "typeof e", "typeof t", "referenceerror", "promise", "boolean", "typeof n" ], "references": [ "https://www.googletagmanager.com/gtm.js?id=GTM-NGP6LXC", "https://www.data-xata.com/js/zopimlaunch.js", "https://www.data-xata.com/_nuxt/1e8744d.modern.js", "https://www.data-xata.com/_nuxt/65d6cfa.modern.js", "https://www.data-xata.com/_nuxt/b799d37.modern.js", "https://www.data-xata.com/_nuxt/e7424e3.js", "xfe-URL-Data-xata.com-stix2-2.1-export.json", "https://zopim.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "E-Commerce" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 329, "URL": 968, "FileHash-SHA256": 245, "domain": 241, "FileHash-MD5": 1, "email": 1 }, "indicator_count": 1785, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1404 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626a8a564da0d5b27dc02619", "name": "App By Web", "description": "Israeli malware hosting", "modified": "2022-05-28T00:03:46.141000", "created": "2022-04-28T12:36:38.103000", "tags": [ "hebrew", "truetype", "woff2", "woff", "body", "fh5cooffcanvas", "function", "click", "main menu", "superfish var", "parallax", "offcanvas", "mobile menu", "animations var", "mstouchaction", "superfish menu", "plugin", "copyright", "joel birch", "dual", "fill", "touchaction", "y position", "hoverintent", "brian cherne", "param", "threshold", "mit license", "or selector", "author", "1parseint", "mark dalgleish", "http", "webkitopacity", "webkit", "khtmlopacity", "khtml", "typeof d", "error", "this", "caleb troughton", "typeof f", "adapter", "bootstrap", "javascript", "typeof c", "twitter", "focus", "azaz", "including", "this software", "but not", "limited to", "terms of", "open", "bsd license", "redistribution", "redistributions", "neither", "direct", "gc", "regexp", "typeof b", "pseudo", "child", "array", "width", "sufeffxa0", "class", "null", "date", "accept", "boolean", "modernizr", "custom build", "build", "afunction", "cfunction", "typeerror", "object", "documenttouch", "websocket", "string", "silk", "script", "arial", "edge", "iframe", "promise", "void", "android", "trident", "embed", "meta", "roboto", "term", "\u05d4\u05d6\u05de\u05e0\u05ea \u05de\u05d5\u05e0\u05d9\u05ea", "wtaxi", "wapp", "app by web ltd", "03-5115656", "03-5109109", "+97235115656", "\u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05e1\u05e2\u05d9\u05dd", "\u05db\u05e8\u05d8\u05d9\u05e1 \u05d0\u05e9\u05e8\u05d0\u05d9 \u05d1\u05de\u05d5\u05e0\u05d9\u05ea", "web ltd", "reserved" ], "references": [ "xfe-URL-appbyweb.net-stix2-2.1-export.json", "http://appbyweb.net/AppByWeb", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "http://appbyweb.net/AppByWeb/js/superfish.js", "http://appbyweb.net/AppByWeb/js/main.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1554, "hostname": 533, "domain": 211, "FileHash-SHA256": 199 }, "indicator_count": 2497, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1423 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6261f2763fabd1214a79f0e5", "name": "Masterhost.ru - malware hosting", "description": "Here is the code-decode for the punycode-overflow test, which is based on the results of the following test-run by the UK's Office of National Statistics (ONS).", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-22T00:10:30.250000", "tags": [ "fffe37", "b76810", "helvetica", "arial", "pf din", "text comp", "circe", "span", "button", "90deg", "object", "typeof t", "date", "promise", "function", "array", "regexp", "error", "typeof symbol", "typeof n", "null", "backspace", "void", "window", "vd", "gc", "typeof e", "sufeffxa0", "class", "attr", "pseudo", "child", "typeof module", "string", "weakmap", "proxy", "number", "boolean", "trnf", "keepalive", "transitiongroup", "hello", "comment", "infinity", "this", "copyright", "closure library", "xdfunction", "cdfunction", "ddfunction", "bded", "kefunction", "65535", "counter", "typeof c", "segoe ui", "typeerror", "lucida", "vwtabguid", "form", "impact", "light", "cureit", "bu durumda", "ip address", "devam", "yandex", "help section", "captcha code", "support service", "search", "edge", "swhealthlog", "logsdatabasev2", "trident", "android", "rangeerror", "webpackexports", "illegal input", "webpackrequire" ], "references": [ "https://admin.verbox.ru/support/support.js?h=afe80d31a1cabd6ae5c00580688f27d2", "https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js", "https://site.yandex.net/v2.0/js/all.js", "https://mc.yandex.ru/metrika/tag.js", "https://www.googletagmanager.com/gtag/js?id=UA-36935570-1", "https://masterhost.ru/s/masterhost_v2/build/js/app.js?v=WivgGVzt/Ynv", "https://masterhost.ru/s/masterhost_v2/build/js/compiled.min.js?v=Q/hhNATxy3sx", "https://static.me-talk.ru/cabinet/build/chat/modern.support.js", "https://masterhost.ru/s/masterhost_v2/build/css/global.css?v=MUmvaY06hvKf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1991, "hostname": 678, "FileHash-SHA256": 247, "domain": 404, "email": 1, "FileHash-MD5": 51 }, "indicator_count": 3372, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1430 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62606584633e2b9a3bc935b9", "name": "\u7ea2\u674f\u89c6\u9891 malware", "description": "function s(t,e), o, is a new type of function, which throws new TypeError when it comes to trying to make a function out of its own language or its form.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-20T19:56:52.162000", "tags": [ "typeof t", "typeof define", "moztransform", "success", "error", "make sure", "stop", "ajax", "action", "click", "open", "active", "button", "toggle btn", "body", "scroll", "isotope", "preloader", "function", "javascript", "mit license", "typeof module", "gplv3", "license", "copyright", "metafizzy", "math", "typeof", "typeerror", "hidden", "show", "typeof n", "version", "hide", "focusin", "focusout", "shown", "startr", "endr", "federico zivolo", "distributed", "html", "statict", "flip", "regexp", "null", "void", "width", "object", "pseudo", "child", "class", "date", "accept", "webpackrequire", "name", "number", "arraybuffer", "iterator", "typedarray", "prototype", "string", "index", "meta", "target", "infinity", "zero", "epsilon", "observer", "android", "trim", "enumerate", "freeze", "internal", "bind", "window", "next", "find", "this", "rest", "middle", "canvas", "slidercaptcha", "createelement", "textdanger", "plugin", "rgba", "imagedata", "false", "touchstart", "trident", "applewebkit", "safari", "base", "presto", "gecko", "khtml", "micromessenger", "typeof e", "swiper", "most", "september", "customevent", "image", "typeof c", "twitter", "bootstrap", "rolemenu", "typeof f", "typeof g", "cookie plugin", "https", "klaus hartl", "register", "nodecommonjs", "factory", "jquery", "write", "typeof b", "array", "sufeffxa0", "attr", "\u706b\u7bad\u5185\u6d4b\u7b7e\u540d", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "push", "shift", "tencent", "barrio", "slice", "symbol", "typeof window", "maximum", "typeof symbol", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "ufe0fg", "ud83dudc6cud83c", "ud83dudc6dud83c", "welcome", "datav66d78640", "datav2f8052f5", "90deg", "datav5f1e575c", "datave97d7462", "helvetica neue", "helvetica", "10px", "pingfang sc", "arial", "45deg", "typenumber", "opacity0", "mozopacity0", "khtmlopacity0", "opacity100", "event", "boolean", "uint8array", "errordetails", "info", "checker", "generator", "blink", "keepalive", "4096", "unknown", "meteor", "rhino", "mini", "comment", "verify", "yeke", "codec", "media", "live", "speed", "headname", "axiostimeout", "apiurl", "bmi86hjtsk", "root", "length", "indexof", "x0ax20x20x20x20", "location", "0x10", "0x18", "history", "config", "cookie", "onload", "video", "afunction", "indexnotice", "sitehome", "x20trnf", "please", "strong" ], "references": [ "xfe-URL-sys95.com-stix2-2.1-export.json", "https://2001.habyc.com/?channelNo=2001#/home", "https://sdk.51.la/event/js-sdk-event.min.js?u=JdoUNv3VSW0GHUpw", "https://2001.habyc.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://sdk.51.la/js-sdk-pro.min.js", "https://2001.habyc.com/js/config.js", "xfe-URL-2001.habyc.com-stix2-2.1-export.json", "https://2001.habyc.com/static/js/chunk-vendors.9d7684f4.js", "xfe-URL-habyc.com-stix2-2.1-export.json", "https://2001.habyc.com/static/css/chunk-vendors.6a41b67e.css", "https://2001.habyc.com/static/css/app.88afcfd8.css", "https://2001.habyc.com/static/css/chunk-7d5d3bac.e1a32335.css", "https://2001.dwlww.com/?channelNo=2001#/home", "https://2001.dwlww.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://2001.dwlww.com/js/config.js", "https://2001.dwlww.com/static/js/chunk-vendors.9d7684f4.js", "https://2001.dwlww.com/static/js/app.9d5d18d7.js", "https://2001.dwlww.com/static/css/chunk-vendors.6a41b67e.css", "https://2001.dwlww.com/static/css/app.88afcfd8.css", "https://2001.dwlww.com/static/css/chunk-7d5d3bac.e1a32335.css", "https://www.tidio.com/talk/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://chatting.page/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://widget-v4.tidiochat.com/code/kv6vcosd7tmhsetmarsoawzaglejnny4.js", "https://m4244.com:35003/", "https://www.8098.app:21568/?agent=7691755704", "https://www.8098.app:21568/js/jquery-1.11.3.min.js", "https://www.8098.app:21568/js/xinstall_inner_e.min.js?v=1004", "https://app.ynsdty.cn//package/GmCC6WISh", "https://app.ynsdty.cn/dist/js/jquery.min.js", "https://app.ynsdty.cn/dist/js/jquery.cookie.js", "https://app.ynsdty.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "https://app.ynsdty.cn/dist/vendors/swiper/swiper.min.js", "https://app.ynsdty.cn/dist/js/app.base.js", "https://app.ynsdty.cn/dist/js/longbow.slidercaptcha.js", "https://app.ynsdty.cn/dist/vendors/core-js/core.js", "xfe-URL-sun.net.hk-stix2-2.1-export.json", "https://www.sunnetwork.com.sg/sun_21/js/vendor/jquery-3.5.0.min.js", "https://www.sunnetwork.com.sg/sun_21/js/popper.min.js", "https://www.sunnetwork.com.sg/sun_21/js/bootstrap.min.js", "https://www.sunnetwork.com.sg/sun_21/js/isotope.pkgd.min.js", "https://www.sunnetwork.com.sg/sun_21/js/imagesloaded.pkgd.min.js", "https://www.sunnetwork.com.sg/sun_21/js/main.js", "https://www.sunnetwork.com.sg/sun_21/js/ajax-form.js", "https://www.sunnetwork.com.sg/sun_21/js/slick.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 901, "URL": 5740, "hostname": 2218, "FileHash-SHA256": 1686, "FileHash-MD5": 3 }, "indicator_count": 10548, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1431 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6256f92778c2f2177bdd4de9", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "Here is a full list of highlights from the Chinese TV series, which began in 2011 and has now been broadcast on Chinese television, online and mobile devices, and is now available to watch online.", "modified": "2022-05-13T00:03:35.765000", "created": "2022-04-13T16:24:07.391000", "tags": [ "date", "cnzzdata", "czuuid", "umdistinctid", "typeof symbol", "https", "zeno rocha", "typeof", "typeof define", "error", "array", "12863", "qrcode", "2g2g2h2h0g", "dhdh", "exptable", "logtable", "string", "typeof j", "regexp", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "ahgr", "0x40", "h0x1", "mm32", "indexof", "length", "h0x0", "0x248", "h0x2", "0x17b", "webpackrequire", "webpackexports", "object", "default", "hn return", "importsnvar", "truennnn", "iostf", "android", "nvar", "clickdownload", "this", "path", "service", "roboto", "boolean", "number", "createnamespace", "n default", "nn return", "null", "click", "void", "istanbul", "false", "close", "window", "info", "target", "find", "footer", "delta", "generator", "cascade", "code", "trigger", "next", "arrow", "slice", "checkbox", "body", "green", "phase", "copy", "infinity", "middle", "open", "calendar", "flex", "fail", "shift", "super", "internal", "form", "locale", "spinner", "spin", "multi", "mask", "write", "flip", "logic", "patch", "abcd", "skew", "main", "rest", "trim", "dark", "canvas", "facebook", "executor", "span", "tips", "sticky", "uploader", "bind", "config", "startpage", "speed", "toolbar", "refresh", "done", "format", "cardinal", "outside", "install", "public", "github", "vuejs", "jump", "browser", "sign", "view", "sponsor", "github sponsors", "mit license", "contact", "star", "stars", "javascript", "please", "strong", "\u9ad8\u5c71tv", "\u9ad8\u5c71tv\u5f71\u9662", "\u9ad8\u5c71tv\u770b\u7247\u7f51", "hd 20210830", "hd mu", "hd heydouga", "poro", "tv tv", "hd ok", "hd fol", "hd nanami2", "hd \uff13", "hd 20210927" ], "references": [ "http://www.bbbbop13.com:1313/", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "https://web.op39v.xyz/?channelCode=pingguo", "https://github.com/vuejs/vue-devtools", "https://web.op39v.xyz/js/chunk-vendors.js", "https://web.op39v.xyz/js/chunk-common.js", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "https://c.cnzz.com/core.php?web_id=1280740152&t=z" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1374, "hostname": 563, "CVE": 1, "domain": 361, "FileHash-SHA256": 233, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1438 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624fff22683106d256390a89", "name": "'Chinese botnet", "description": "\u00c2\u00a31.3m (838m euros) - that is the amount of money the Chinese government has to spend on upgrading the country's economy - but how much is it going to cost?", "modified": "2022-05-08T09:06:05.710000", "created": "2022-04-08T09:23:46.746000", "tags": [ "datav7a53b450", "microsoft yahei", "label", "arial", "verdana", "simsun", "simhei", "stheiti", "helvetica", "aba8a8", "font awesome", "license", "font", "sil ofl", "mit license", "woff2", "woff", "truetype", "fontawesome", "0xb6f109", "0x9e4f21", "0x464801", "0x21c094", "object", "0x54da69", "0x28e5ab", "promise", "0x3aef82", "0x12d16a", "this", "push", "window", "code", "date", "bind", "error", "path", "target", "middle", "null", "open", "download", "blank", "refresh", "config", "span", "mark", "canvas", "mask", "9999", "close", "shift", "android", "encrypt", "getclass", "checker", "agent", "4328", "trim", "service", "slice", "crypto", "stop", "7910", "zero", "checkbox", "format", "model", "spinner", "clickdownload", "meta", "sport", "click", "next", "class", "hammer", "body", "boolean", "number", "string", "array", "typeof t", "function", "regexp", "typeof e", "generator", "4096", "ping", "f6cf32", "modulenotfound", "n noticecontent", "typeerror", "circular", "infinite", "mouseevent", "dommousescroll", "lotteryhallhome", "void", "bubble", "vnode", "vuessrcontext", "swiper", "typeof o", "mozperspective", "msperspective", "tridentg", "event", "bscroll", "u200", "typeof s", "newatchman", "fetch", "timeout", "ofunction", "zfunction", "watchman", "dfunction", "domutils", "typeof n", "4294967295", "parseint", "utf8", "utils", "post", "channelcode", "0xa60881", "0x1e0610", "0x489cca", "0x4d5bd1", "0x1a7a9a", "0x3145fc", "0x2d9acb", "0xbf1b3e", "0x47699d", "cookie", "info", "jb3tu", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "tencent", "barrio", "\u77ed\u89c6\u9891", "\u641e\u7b11\u89c6\u9891", "\u89c6\u9891\u5206\u4eab", "\u514d\u8d39\u89c6\u9891", "\u5728\u7ebf\u89c6\u9891", "\u9884\u544a\u7247", "yuwvm", "g 18", "720p", "hd luna", "hd 99", "ktvp", "part", "hd h", "dykthr", "jquery", "titlestr", "viewport" ], "references": [ "xfe-IP-154.36.230.14-stix2-2.0-export.json", "http://www.jxhykj1210.com/common.js", "http://www.jxhykj1210.com/tj.js", "https://17se.xyz/", "https://www.bibo18.app:2171/?agent=2207259251", "https://www.bibo18.app:2171/js/xinstall_inner_e.min.js?v=1004", "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://www.shareinstall.com.cn/js/page/jshareinstall.min.js", "https://acstatic-dun.126.net/tool.min.js?t=1647252792143", "https://9755w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~agent-doc~cpxpjLogin~download~game~home~member~sports~vnsoLogin~vnstLogin2.js", "https://9755w.com:2188/m/js/2203141811-JieBei~YuEBao~agent-center-modec~agent-center-new~bet~game~home~invite~member.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~home.js", "https://9755w.com:2188/m/js/2203141811-home.js", "https://9755w.com:2188/m/js/2203141811-fhcpLogin.js", "https://9755w.com:2188/m/js/2203141811-view-page.js", "https://9755w.com:2188/m/js/2203141811-chunk-vendors.js", "https://9755w.com:2188/m/js/2203141811-index.js", "https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css", "https://9755w.com:2188/m/css/fhcpLogin.css?v=2203141811" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 306, "URL": 1135, "FileHash-SHA256": 122, "domain": 172, "FileHash-MD5": 4 }, "indicator_count": 1739, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1442 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624da4e55644a1e8e4de3fc7", "name": "'+titlestr+' -APP STORE- C&C", "description": "This is the full text of the code for the BBC's Newsround app, using the fakeElem and its fakeHandlerCallback to remove fake elements from the page. and add them to the screen.", "modified": "2022-05-06T00:03:41.989000", "created": "2022-04-06T14:34:13.114000", "tags": [ "datav4d9cb9db", "object", "typeof content", "dtnocomment1", "appn", "wlan", "appstore", "potato 24hn", "getdownload", "getdownloadlog", "datave49f1a26", "desktopview", "datav16fe8306", "mobileview", "array", "typeerror", "typeof t", "function", "string", "symbol", "typeof symbol", "vnode", "boolean", "error", "null", "number", "rangeerror", "regexp", "this", "promise", "date", "generator", "4096", "invalid attempt", "nuxt", "nuxtchild", "preventtran", "guozhihan", "center", "email", "fixed", "hidden", "99999", "body", "imgdata", "request", "getrequest", "tongji", "cnzzdata", "czuuid", "umdistinctid", "vuelazyload log", "mit license", "typeof", "typeof define", "customevent", "zfunction", "ifunction", "tfunction", "image", "int32array", "uint8array", "htmlelement", "htmlcollection", "nodelist", "https", "zeno rocha", "unescape", "void", "messagechannel", "array methods", "please", "canvas", "base64toblob", "click", "blob", "f25d61", "ff0163", "dedddd", "ff0168", "span", "helvetica neue", "arial", "pingfang sc", "45deg", "helvetica", "segoe ui", "roboto", "sans gb", "yahei", "woff2", "meta", "viewport" ], "references": [ "http://www.testbyczx.top/common.js", "http://www.testbyczx.top/tj.js", "https://sps666.com/", "https://xflaa.com/static/css/vant.min.css", "https://xflaa.com/static/css/common.css", "https://c.cnzz.com/core.php?web_id=1280697987&t=z", "https://xflaa.com/static/js/base64Toimg.js", "https://v1.cnzz.com/z_stat.php?id=1280697987&web_id=1280697987", "https://xflaa.com/static/js/es6-promise.auto.min.js", "https://xflaa.com/static/js/query.js", "https://xflaa.com/static/js/clipboard.min.js", "https://xflaa.com/static/js/vue-qr.min.js", "https://apk.tatwa.cn/vue-lazyload.js", "https://s4.cnzz.com/z_stat.php?id=1280740854&web_id=1280740854", "https://mtaoaa.com/js/tongji.js", "https://mtaoaa.com/js/screenHorizntal.js", "https://mtaoaa.com/_nuxt/49a5e4f.js", "https://mtaoaa.com/_nuxt/517adf2.js", "https://mtaoaa.com/_nuxt/06dc766.js", "https://mtaoaa.com/_nuxt/31ce4ff.js", "https://mtaoaa.com/_nuxt/0bc6515.js", "https://mtaoaa.com/_nuxt/4ca1314.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 244, "domain": 154, "URL": 862, "FileHash-SHA256": 173, "email": 1, "FileHash-MD5": 1 }, "indicator_count": 1435, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1445 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624da4e23e7e153ec40c8f8b", "name": "'+titlestr+' -APP STORE- C&C", "description": "This is the full text of the code for the BBC's Newsround app, using the fakeElem and its fakeHandlerCallback to remove fake elements from the page. and add them to the screen.", "modified": "2022-05-06T00:03:41.989000", "created": "2022-04-06T14:34:10.482000", "tags": [ "datav4d9cb9db", "object", "typeof content", "dtnocomment1", "appn", "wlan", "appstore", "potato 24hn", "getdownload", "getdownloadlog", "datave49f1a26", "desktopview", "datav16fe8306", "mobileview", "array", "typeerror", "typeof t", "function", "string", "symbol", "typeof symbol", "vnode", "boolean", "error", "null", "number", "rangeerror", "regexp", "this", "promise", "date", "generator", "4096", "invalid attempt", "nuxt", "nuxtchild", "preventtran", "guozhihan", "center", "email", "fixed", "hidden", "99999", "body", "imgdata", "request", "getrequest", "tongji", "cnzzdata", "czuuid", "umdistinctid", "vuelazyload log", "mit license", "typeof", "typeof define", "customevent", "zfunction", "ifunction", "tfunction", "image", "int32array", "uint8array", "htmlelement", "htmlcollection", "nodelist", "https", "zeno rocha", "unescape", "void", "messagechannel", "array methods", "please", "canvas", "base64toblob", "click", "blob", "f25d61", "ff0163", "dedddd", "ff0168", "span", "helvetica neue", "arial", "pingfang sc", "45deg", "helvetica", "segoe ui", "roboto", "sans gb", "yahei", "woff2", "meta", "viewport" ], "references": [ "http://www.testbyczx.top/common.js", "http://www.testbyczx.top/tj.js", "https://sps666.com/", "https://xflaa.com/static/css/vant.min.css", "https://xflaa.com/static/css/common.css", "https://c.cnzz.com/core.php?web_id=1280697987&t=z", "https://xflaa.com/static/js/base64Toimg.js", "https://v1.cnzz.com/z_stat.php?id=1280697987&web_id=1280697987", "https://xflaa.com/static/js/es6-promise.auto.min.js", "https://xflaa.com/static/js/query.js", "https://xflaa.com/static/js/clipboard.min.js", "https://xflaa.com/static/js/vue-qr.min.js", "https://apk.tatwa.cn/vue-lazyload.js", "https://s4.cnzz.com/z_stat.php?id=1280740854&web_id=1280740854", "https://mtaoaa.com/js/tongji.js", "https://mtaoaa.com/js/screenHorizntal.js", "https://mtaoaa.com/_nuxt/49a5e4f.js", "https://mtaoaa.com/_nuxt/517adf2.js", "https://mtaoaa.com/_nuxt/06dc766.js", "https://mtaoaa.com/_nuxt/31ce4ff.js", "https://mtaoaa.com/_nuxt/0bc6515.js", "https://mtaoaa.com/_nuxt/4ca1314.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 244, "domain": 154, "URL": 862, "FileHash-SHA256": 173, "email": 1, "FileHash-MD5": 1 }, "indicator_count": 1435, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1445 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "625eecb6fbc4353a109fe71c", "name": "hostkey - Industroyer&ReduceRight", "description": "Fbevents-PostalCodeType:f.exports, f.1, is a new addition to the list of \"signals\" that can be added to phone numbers.", "modified": "2022-04-19T17:09:10.196000", "created": "2022-04-19T17:09:10.196000", "tags": [ "livechat", "sign up", "free", "grow", "policy", "sign", "strong", "sorry", "identify", "increase", "lzutf8", "typeerror", "uint8array", "array", "error", "typeof r", "class", "invalid", "post", "uint32array", "date", "null", "papvisitorid", "string", "regexp", "value", "property", "valuenumber", "activexobject", "postaffparams", "object", "number", "boolean", "typeof e", "math", "first", "raid", "window", "service", "ukraine", "epsilon", "arrow", "target", "keepalive", "void", "shell", "econnaborted", "hkwfunction", "typeof symbol", "function", "promise", "request", "network error", "livechatwidget", "ticket form", "prechat survey", "postchat survey", "typeof n", "chat", "blank", "win32", "iframe", "reduceright", "copyright", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "x3e div", "trackevent", "landingpagegpu", "x3e table", "gpudraw", "path", "code", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "symbol", "iterator", "extractor", "pixel", "facebook", "meta", "65535", "counter", "segoe ui", "lucida", "ecommerce", "ext link", "comic", "form", "impact", "light" ], "references": [ "https://mc.yandex.ru/metrika/watch.js", "https://connect.facebook.net/signals/config/785878845108827", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H", "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1", "https://cdn.livechatinc.com/tracking.js", "https://rec.smartlook.com/main-20220331074633.js", "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js", "https://hostkey.com/hk/widgets/ext/src/hostkey.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8", "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=", "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light", "https://secure.livechatinc.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Industroyer - S0604", "display_name": "Industroyer - S0604", "target": null } ], "attack_ids": [ { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1778, "hostname": 563, "FileHash-SHA256": 304, "domain": 407, "FileHash-SHA1": 2 }, "indicator_count": 3054, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1461 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "624ade33b2dd93cdc7ef4b58", "name": "Botnet c&c", "description": "ParallelAxisIndex:0,label:1,lineStyle:2,inactiveOpacity: 1.05,m.g,graphicKey: m.style,t.", "modified": "2022-04-04T12:01:54.999000", "created": "2022-04-04T12:01:54.999000", "tags": [ "datav6a0cc948", "pingfang sc", "microsoft yahei", "helvetica neue", "helvetica", "hiragino sans", "arial", "datav11c9d7e6", "datava3f4887a", "datav12834d8c", "span", "open", "date", "function", "typeof t", "regexp", "number", "typeof e", "null", "width", "typeof s", "error", "this", "class", "accept", "d mmmm", "yyyy", "yyyy hh", "llll", "pjh5", "dddd", "ds5p", "void", "android", "backspace", "typeof define", "load", "mika tuupola", "boolean" ], "references": [ "https://cdf5cxngkkxd.com/#/home", "https://cdf5cxngkkxd.com/static/js/lazyload.min.js", "https://cdf5cxngkkxd.com/static/js/manifest.e4d52d2f9dae6cd41eb4.js", "https://cdf5cxngkkxd.com/static/js/vendor.084bf9e0e16f0b2b6faa.js", "https://cdf5cxngkkxd.com/static/js/app.e16f8acb87917d3eab20.js", "https://cdf5cxngkkxd.com/static/css/app.7b16cc13d7ec8824766fa8255c64a800.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 334, "URL": 1182, "domain": 214, "FileHash-SHA256": 33 }, "indicator_count": 1763, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1476 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6249330bfdce75b6a0667154", "name": "Malware cont..", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.", "modified": "2022-04-03T05:39:23.816000", "created": "2022-04-03T05:39:23.816000", "tags": [ "2000px", "120deg", "10px", "e9e7e7", "b2b2b2", "webkitkeyframes", "f8f8f8", "d3d4d3", "c9c5c5", "alpha", "web mit", "license http", "invalid", "activexobject", "msies", "msanimationend", "typeof e", "typeof f", "typeof y", "typeof define", "function", "null", "typeof t", "array", "value", "regexp", "textarea", "azaz", "typeof n", "this", "date", "infinity", "iframe", "error", "typeof b", "pseudo", "child", "width", "sufeffxa0", "class", "accept" ], "references": [ "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js", "https://cdn.staticfile.org/vue/1.0.21/vue.min.js", "https://cdn.staticfile.org/layer/3.1.1/layer.js", "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 914, "FileHash-SHA256": 23, "hostname": 339, "domain": 126 }, "indicator_count": 1402, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1478 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1", "https://chatting.page/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://sdk.51.la/js-sdk-pro.min.js", "https://mtaoaa.com/js/tongji.js", "https://masterhost.ru/s/masterhost_v2/build/js/app.js?v=WivgGVzt/Ynv", "https://www.8098.app:21568/js/jquery-1.11.3.min.js", "https://www.sunnetwork.com.sg/sun_21/js/main.js", "https://masterhost.ru/s/masterhost_v2/build/js/compiled.min.js?v=Q/hhNATxy3sx", "https://xflaa.com/static/js/es6-promise.auto.min.js", "https://mtaoaa.com/_nuxt/06dc766.js", "https://m4244.com:35003/", "https://cdf5cxngkkxd.com/static/js/app.e16f8acb87917d3eab20.js", "https://mtaoaa.com/_nuxt/0bc6515.js", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "https://9755w.com:2188/m/js/2203141811-chunk-vendors.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~agent-doc~cpxpjLogin~download~game~home~member~sports~vnsoLogin~vnstLogin2.js", "xfe-URL-sys95.com-stix2-2.1-export.json", "https://www.sunnetwork.com.sg/sun_21/js/vendor/jquery-3.5.0.min.js", "https://mtaoaa.com/_nuxt/31ce4ff.js", "https://rec.smartlook.com/main-20220331074633.js", "https://cdn.staticfile.org/layer/3.1.1/layer.js", "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light", "https://mtaoaa.com/_nuxt/49a5e4f.js", "https://www.sunnetwork.com.sg/sun_21/js/slick.min.js", "https://v1.cnzz.com/z_stat.php?id=1280697987&web_id=1280697987", "https://2001.dwlww.com/static/css/app.88afcfd8.css", "https://admin.verbox.ru/support/support.js?h=afe80d31a1cabd6ae5c00580688f27d2", "xfe-IP-154.36.230.14-stix2-2.0-export.json", "https://2001.habyc.com/static/css/app.88afcfd8.css", "https://xflaa.com/static/js/vue-qr.min.js", "https://web.op39v.xyz/?channelCode=pingguo", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "https://www.sunnetwork.com.sg/sun_21/js/bootstrap.min.js", "https://cdf5cxngkkxd.com/static/css/app.7b16cc13d7ec8824766fa8255c64a800.css", "https://c.cnzz.com/core.php?web_id=1280697987&t=z", "https://static.me-talk.ru/cabinet/build/chat/modern.support.js", "https://www.bibo18.app:2171/js/xinstall_inner_e.min.js?v=1004", "xfe-URL-Data-xata.com-stix2-2.1-export.json", "https://acstatic-dun.126.net/tool.min.js?t=1647252792143", "https://cdf5cxngkkxd.com/#/home", "https://xflaa.com/static/css/vant.min.css", "https://www.tidio.com/talk/kv6vcosd7tmhsetmarsoawzaglejnny4", "https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js", "https://app.ynsdty.cn/dist/vendors/swiper/swiper.min.js", "https://2001.habyc.com/?channelNo=2001#/home", "https://www.data-xata.com/_nuxt/e7424e3.js", "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js", "https://cdf5cxngkkxd.com/static/js/manifest.e4d52d2f9dae6cd41eb4.js", "http://appbyweb.net/AppByWeb/js/main.js", "https://www.googletagmanager.com/gtag/js?id=UA-36935570-1", "https://www.8098.app:21568/?agent=7691755704", "https://app.ynsdty.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "https://9755w.com:2188/m/js/2203141811-fhcpLogin.js", "https://c.cnzz.com/core.php?web_id=1280740152&t=z", "https://cdf5cxngkkxd.com/static/js/lazyload.min.js", "https://2001.habyc.com/js/config.js", "xfe-URL-appbyweb.net-stix2-2.1-export.json", "https://2001.dwlww.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://mc.yandex.ru/metrika/tag.js", "https://s9.cnzz.com/z_stat.php?id=1280740152&web_id=1280740152", "https://www.sunnetwork.com.sg/sun_21/js/ajax-form.js", "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js", "https://9755w.com:2188/m/css/fhcpLogin.css?v=2203141811", "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1", "https://masterhost.ru/s/masterhost_v2/build/css/global.css?v=MUmvaY06hvKf", "https://www.data-xata.com/_nuxt/1e8744d.modern.js", "https://www.data-xata.com/_nuxt/b799d37.modern.js", "http://appbyweb.net/AppByWeb/js/superfish.js", "https://cdn.staticfile.org/qrcodejs/1.0.0/qrcode.min.js", "https://2001.dwlww.com/static/css/chunk-7d5d3bac.e1a32335.css", "https://site.yandex.net/v2.0/js/all.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=", "https://mtaoaa.com/js/screenHorizntal.js", "https://2001.dwlww.com/?channelNo=2001#/home", "https://xflaa.com/static/js/clipboard.min.js", "https://mc.yandex.ru/metrika/watch.js", "https://app.ynsdty.cn/dist/js/jquery.cookie.js", "https://sps666.com/", "https://cdn.livechatinc.com/tracking.js", "https://secure.livechatinc.com/", "https://2001.habyc.com/static/js/chunk-7d5d3bac.efb700c7.js", "https://s4.cnzz.com/z_stat.php?id=1280740854&web_id=1280740854", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "http://appbyweb.net/AppByWeb", "https://www.shareinstall.com.cn/js/page/jshareinstall.min.js", "https://app.ynsdty.cn//package/GmCC6WISh", "https://web.op39v.xyz/js/chunk-vendors.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "https://cdn.staticfile.org/clipboard.js/2.0.8/clipboard.min.js", "https://mtaoaa.com/_nuxt/4ca1314.js", "xfe-URL-habyc.com-stix2-2.1-export.json", "xfe-URL-hyqxsnjj.com-stix2-2.1-export.json", "https://www.bibo18.app:2171/?agent=2207259251", "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H", "https://netdna.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css", "https://cdn.staticfile.org/jquery/3.6.0/jquery.min.js", "https://xflaa.com/static/js/base64Toimg.js", "https://mtaoaa.com/_nuxt/517adf2.js", "https://apk.tatwa.cn/vue-lazyload.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8", "https://app.ynsdty.cn/dist/js/app.base.js", "https://xflaa.com/static/js/query.js", "https://9755w.com:2188/m/js/2203141811-JieBei~YuEBao~agent-center-modec~agent-center-new~bet~game~home~invite~member.js", "http://www.jxhykj1210.com/tj.js", "https://www.data-xata.com/js/zopimlaunch.js", "https://connect.facebook.net/signals/config/785878845108827", "https://17se.xyz/", "https://web.op39v.xyz/js/chunk-common.js", "https://hostkey.com/hk/widgets/ext/src/hostkey.js", "https://sdk.51.la/event/js-sdk-event.min.js?u=JdoUNv3VSW0GHUpw", "xfe-URL-2001.habyc.com-stix2-2.1-export.json", "https://app.ynsdty.cn/dist/vendors/core-js/core.js", "https://github.com/vuejs/vue-devtools", "https://app.ynsdty.cn/dist/js/longbow.slidercaptcha.js", "https://www.sunnetwork.com.sg/sun_21/js/isotope.pkgd.min.js", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&", "https://www.data-xata.com/_nuxt/65d6cfa.modern.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "https://2001.dwlww.com/static/css/chunk-vendors.6a41b67e.css", "https://res-1257422681.file.myqcloud.com/assets/yeyue/boinstall.js", "https://cdf5cxngkkxd.com/static/js/vendor.084bf9e0e16f0b2b6faa.js", "https://2001.habyc.com/static/css/chunk-vendors.6a41b67e.css", "https://www.googletagmanager.com/gtm.js?id=GTM-NGP6LXC", "https://2001.dwlww.com/static/js/app.9d5d18d7.js", "https://9755w.com:2188/m/js/2203141811-home.js", "xfe-URL-sun.net.hk-stix2-2.1-export.json", "http://www.jxhykj1210.com/common.js", "https://9755w.com:2188/m/js/2203141811-view-page.js", "https://cdn.staticfile.org/vue/1.0.21/vue.min.js", "https://zopim.com", "https://9755w.com:2188/m/js/2203141811-index.js", "https://9755w.com:2188/m/js/2203141811-LotteryHall~home.js", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "https://www.8098.app:21568/js/xinstall_inner_e.min.js?v=1004", "https://app.ynsdty.cn/dist/js/jquery.min.js", "http://www.bbbbop13.com:1313/", "https://www.sunnetwork.com.sg/sun_21/js/imagesloaded.pkgd.min.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "https://2001.habyc.com/static/js/chunk-vendors.9d7684f4.js", "https://9755w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://2001.dwlww.com/static/js/chunk-vendors.9d7684f4.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "https://2001.dwlww.com/js/config.js", "https://2001.habyc.com/static/css/chunk-7d5d3bac.e1a32335.css", "http://www.testbyczx.top/common.js", "https://www.sunnetwork.com.sg/sun_21/js/popper.min.js", "http://www.testbyczx.top/tj.js", "https://xflaa.com/static/css/common.css", "https://widget-v4.tidiochat.com/code/kv6vcosd7tmhsetmarsoawzaglejnny4.js" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Vd", "Reduceright", "Gc", "Industroyer - s0604", "Et" ], "industries": [ "E-commerce" ], "unique_indicators": 45680 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/options.name", "whois": "http://whois.domaintools.com/options.name", "domain": "options.name", "hostname": "e.ctor.options.name" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 19, "pulses": [ { "id": "655aef8a8cc2e0929f2aa5ea", "name": "Python Initiated Connection | Spyware | Remote Attacks |", "description": "", "modified": "2023-12-18T23:03:18.732000", "created": "2023-11-20T05:32:58.400000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et", "october", "contacted", "threat roundup", "january", "cyberstalking", "attack", "icmp", "banker", "keylogger", "google llc", "gc abuse", "orgid", "direct", "whois lookup", "netrange", "nethandle", "net34", "net340000", "googl2", "comment", "gc", "dns replication", "date", "domain", "win32 exe", "driver pro", "files", "detections type", "name", "optimizer pro", "javascript", "text", "text ip", "aacr", "type name", "email", "email delivery", "email fwd", "delivery status", "notification", "name verdict", "runtime process", "sha1", "size", "localappdata", "temp", "prefetch8", "unicode text", "type data", "programfiles", "win64", "hybrid", "click", "strings", "youth", "pe resource", "apple private", "data collection", "hidden privacy", "threats https", "legal", "amazon aws", "wife happy", "vhash", "authentihash", "ssdeep", "file type", "magic pe32", "intel", "ms windows", "trid windows", "os2 executable", "compiler", "delphi", "sections", "md5 code", "data", "children", "file size", "dropped files", "google update", "setup sha256", "kb file" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "green", "cloned_from": "655950034e6ae4650a6b02ce", "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 12901, "hostname": 4445, "domain": 3685, "FileHash-MD5": 197, "FileHash-SHA256": 5136, "FileHash-SHA1": 170, "CIDR": 1, "email": 2, "CVE": 4 }, "indicator_count": 26541, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655950034e6ae4650a6b02ce", "name": "Python Initiated Connection | Spyware | Remote Attacks | | Part 4", "description": "Apple, Mac, iOS, phishing, frauds services, malware, trojan.allesgreh/trojan.allesgreh/respat, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and possibly others. Python Initiated Connection, WScriptShell_Case_Anomaly.\nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]", "modified": "2023-12-18T23:03:18.732000", "created": "2023-11-19T00:00:03.258000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et", "october", "contacted", "threat roundup", "january", "cyberstalking", "attack", "icmp", "banker", "keylogger", "google llc", "gc abuse", "orgid", "direct", "whois lookup", "netrange", "nethandle", "net34", "net340000", "googl2", "comment", "gc", "dns replication", "date", "domain", "win32 exe", "driver pro", "files", "detections type", "name", "optimizer pro", "javascript", "text", "text ip", "aacr", "type name", "email", "email delivery", "email fwd", "delivery status", "notification", "name verdict", "runtime process", "sha1", "size", "localappdata", "temp", "prefetch8", "unicode text", "type data", "programfiles", "win64", "hybrid", "click", "strings", "youth", "pe resource", "apple private", "data collection", "hidden privacy", "threats https", "legal", "amazon aws", "wife happy", "vhash", "authentihash", "ssdeep", "file type", "magic pe32", "intel", "ms windows", "trid windows", "os2 executable", "compiler", "delphi", "sections", "md5 code", "data", "children", "file size", "dropped files", "google update", "setup sha256", "kb file" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null }, { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 12901, "hostname": 4445, "domain": 3685, "FileHash-MD5": 197, "FileHash-SHA256": 5136, "FileHash-SHA1": 170, "CIDR": 1, "email": 2, "CVE": 4 }, "indicator_count": 26541, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655907b9da2479892590b77a", "name": "Apple iOS Spyware | Remote Attacks | Fraud Services | Part 3", "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]", "modified": "2023-12-18T16:03:26.037000", "created": "2023-11-18T18:51:37.411000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8650, "hostname": 3073, "domain": 2708, "FileHash-MD5": 118, "FileHash-SHA256": 3552, "FileHash-SHA1": 104 }, "indicator_count": 18205, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "655907b4d8c905f4475d8bcc", "name": "Apple iOS Spyware | Remote Attacks | Fraud Services | Part 3", "description": "Apple, Mac, iOS, phishing, frauds, malware, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and probably others. \nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]", "modified": "2023-12-18T16:03:26.037000", "created": "2023-11-18T18:51:32.856000", "tags": [ "http response", "final url", "serving ip", "address", "status code", "body length", "b body", "sha256", "contenttype", "phpsessid", "cisco umbrella", "alexa top", "million", "safe site", "site", "whois record", "ssl certificate", "execution", "dropped", "whois whois", "historical ssl", "copy", "tsara brashears", "communicating", "referrer", "cobalt strike", "hacktool", "emotet", "download", "malware", "malicious", "critical", "relic", "monitoring", "installer", "android", "agent tesla", "et" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ET", "display_name": "ET", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8650, "hostname": 3073, "domain": 2708, "FileHash-MD5": 118, "FileHash-SHA256": 3552, "FileHash-SHA1": 104 }, "indicator_count": 18205, "is_author": false, "is_subscribing": null, "subscriber_count": 218, "modified_text": "853 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708c37c54dd9e78f85c0fa", "name": "\u7ea2\u674f\u89c6\u9891 malware", "description": "", "modified": "2023-12-06T14:59:03.859000", "created": "2023-12-06T14:59:03.859000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1686, "hostname": 2218, "URL": 5740, "domain": 901, "FileHash-MD5": 3 }, "indicator_count": 10548, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708beba2ba8bcfb1d10237", "name": "hostkey - Industroyer&ReduceRight", "description": "", "modified": "2023-12-06T14:57:47.430000", "created": "2023-12-06T14:57:47.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 304, "hostname": 563, "domain": 407, "URL": 1776, "FileHash-SHA1": 2 }, "indicator_count": 3052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708bbc4c8bf557c17688e1", "name": "\u9ad8\u5c71tv,\u9ad8\u5c71tv,\u9ad8\u5c71tv\u5f71\u9662,\u9ad8\u5c71tv\u770b\u7247\u7f51", "description": "", "modified": "2023-12-06T14:57:00.280000", "created": "2023-12-06T14:57:00.280000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 233, "domain": 361, "hostname": 563, "URL": 1374, "FileHash-SHA1": 1, "FileHash-MD5": 1 }, "indicator_count": 2534, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708aa1dca4e6c505e4fc9e", "name": "Botnet c&c", "description": "", "modified": "2023-12-06T14:52:16.286000", "created": "2023-12-06T14:52:16.286000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 214, "hostname": 334, "URL": 1182, "FileHash-SHA256": 33 }, "indicator_count": 1763, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62844b9aeadcab773b3eb51a", "name": "DATAHATA - data-xata", "description": "ChunkLoadError, a new type of error, failed to load a chunk of JavaScript, according to the web browser operator, E.noconflict.com, as well as the website itself.", "modified": "2022-06-16T00:01:26.112000", "created": "2022-05-18T01:27:54.809000", "tags": [ "zendesk", "integration", "offline form", "routing website", "acquire", "english", "chatsupport", "livechat", "genesys dx", "drift", "live", "chat", "android", "contact", "twitter", "facebook", "fast", "enterprise", "small", "demo", "leave", "premium", "easy", "robin", "tbody", "span", "jost", "object", "thead", "tfoot", "typecheckbox", "typeradio", "typeof content", "array", "error", "footer", "nuxtlink", "combo", "cookie", "please", "cancel", "email", "zendesk chat", "sorry", "back", "name", "function", "document", "click", "close", "null", "hello", "noraid", "datav57c71c16", "raid0", "raid1", "raid5", "raid6", "raid10", "republic", "islands", "rating", "guinea", "reviewstab", "samoa", "china", "congo", "korea", "united", "albania", "armenia", "belarus", "chad", "cuba", "indonesia", "mexico", "panama", "paraguay", "slovakia", "ukraine", "uruguay", "bitcoin", "script", "date", "scroll", "mousemove", "touchstart", "setaccount", "trackpageview", "textjavascript", "datalayer", "gtmngp6lxc", "number", "string", "trackevent", "click button", "copyright", "host", "path", "order", "typeerror", "typeof symbol", "typeof e", "typeof t", "referenceerror", "promise", "boolean", "typeof n" ], "references": [ "https://www.googletagmanager.com/gtm.js?id=GTM-NGP6LXC", "https://www.data-xata.com/js/zopimlaunch.js", "https://www.data-xata.com/_nuxt/1e8744d.modern.js", "https://www.data-xata.com/_nuxt/65d6cfa.modern.js", "https://www.data-xata.com/_nuxt/b799d37.modern.js", "https://www.data-xata.com/_nuxt/e7424e3.js", "xfe-URL-Data-xata.com-stix2-2.1-export.json", "https://zopim.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [ "E-Commerce" ], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 329, "URL": 968, "FileHash-SHA256": 245, "domain": 241, "FileHash-MD5": 1, "email": 1 }, "indicator_count": 1785, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1404 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626a8a564da0d5b27dc02619", "name": "App By Web", "description": "Israeli malware hosting", "modified": "2022-05-28T00:03:46.141000", "created": "2022-04-28T12:36:38.103000", "tags": [ "hebrew", "truetype", "woff2", "woff", "body", "fh5cooffcanvas", "function", "click", "main menu", "superfish var", "parallax", "offcanvas", "mobile menu", "animations var", "mstouchaction", "superfish menu", "plugin", "copyright", "joel birch", "dual", "fill", "touchaction", "y position", "hoverintent", "brian cherne", "param", "threshold", "mit license", "or selector", "author", "1parseint", "mark dalgleish", "http", "webkitopacity", "webkit", "khtmlopacity", "khtml", "typeof d", "error", "this", "caleb troughton", "typeof f", "adapter", "bootstrap", "javascript", "typeof c", "twitter", "focus", "azaz", "including", "this software", "but not", "limited to", "terms of", "open", "bsd license", "redistribution", "redistributions", "neither", "direct", "gc", "regexp", "typeof b", "pseudo", "child", "array", "width", "sufeffxa0", "class", "null", "date", "accept", "boolean", "modernizr", "custom build", "build", "afunction", "cfunction", "typeerror", "object", "documenttouch", "websocket", "string", "silk", "script", "arial", "edge", "iframe", "promise", "void", "android", "trident", "embed", "meta", "roboto", "term", "\u05d4\u05d6\u05de\u05e0\u05ea \u05de\u05d5\u05e0\u05d9\u05ea", "wtaxi", "wapp", "app by web ltd", "03-5115656", "03-5109109", "+97235115656", "\u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05e1\u05e2\u05d9\u05dd", "\u05db\u05e8\u05d8\u05d9\u05e1 \u05d0\u05e9\u05e8\u05d0\u05d9 \u05d1\u05de\u05d5\u05e0\u05d9\u05ea", "web ltd", "reserved" ], "references": [ "xfe-URL-appbyweb.net-stix2-2.1-export.json", "http://appbyweb.net/AppByWeb", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "http://appbyweb.net/AppByWeb/js/superfish.js", "http://appbyweb.net/AppByWeb/js/main.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1554, "hostname": 533, "domain": 211, "FileHash-SHA256": 199 }, "indicator_count": 2497, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1423 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://e.ctor.options.name", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://e.ctor.options.name", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776670958.1323218 }