{ "type": "URL", "indicator": "https://flawor.lovestoblog.com/lo.php", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://flawor.lovestoblog.com/lo.php", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4255152383, "indicator": "https://flawor.lovestoblog.com/lo.php", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "69e1b46238df27ff6680430a", "name": "Analysis- 12/12/24 Darkgate- 9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.zip (MD5: 71E189A0B08891CFFAB6E656FC49E00A) Malicious activity - Interactive analysis ANY.RUN", "description": "<> Darkgate. Links wouldnt attach. User does not have whatsapp.", "modified": "2026-04-17T07:11:13.591000", "created": "2026-04-17T04:17:38.518000", "tags": [ "delete", "yara detections", "high", "medium", "whatsapp plugin", "whatsapp", "read", "write", "top source", "top destination", "virustotal", "guard", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 57, "FileHash-MD5": 54, "FileHash-SHA1": 50, "FileHash-SHA256": 431, "URL": 328, "hostname": 385, "domain": 409, "email": 51, "CIDR": 40 }, "indicator_count": 1805, "is_author": false, "is_subscribing": null, "subscriber_count": 47, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69af6d35446533a0b810ff30", "name": "URLert Daily Threat Intel \u2014 2026-03-10", "description": "URLert Daily Threat Intel \u2014 2026-03-10\n\nAutomated threat intelligence from URLert (https://urlert.com) \u2014 AI-powered URL and domain analysis.\n\nThreats: 63 | Indicators: 116\nConfirmed: 17 | Likely: 36 | Domain intel: 9 | Manual: 1\nTop threats: Phishing (53), Malware Hosting (4), Unknown (2), Malvertising (1), Exploit Kit (1)\nDomains: 515484-celsius.com, aicotp.com, aicotps.cloud, airtable.com, auroraexchanges.com, binx.vip, blox-gifts.com, bull-coin.top, chpotlemenu.com, connectcity.com.my, cutt.ly, daoasdk.cc, dlproxy...\n\n63 unique threats producing 116 actionable indicators. Generated by URLert automated threat intelligence.", "modified": "2026-04-08T22:28:30.988000", "created": "2026-03-10T01:00:37.499000", "tags": [ "accenture-impersonation", "adult-content-lure", "adware", "aged-domain-repurposed", "aicotps", "airtable-abuse", "alibaba-com-impersonation", "anti-analysis", "apk-distribution", "app-store-impersonation", "apple-impersonation", "automated-scan", "brand-impersonation", "browser-evasion", "browser-extension", "burnable-infrastructure", "business-email-phishing", "bypassing-security", "cacau-show", "captcha-challenge", "carding", "cc-tld", "celsius-impersonation", "chipotle", "cisco-webex-impersonation", "combosquatting", "compromised-accounts", "content-locker", "cotps", "credential-harvesting", "cryptocurrency", "cryptocurrency-fraud", "cryptocurrency-scam", "cryptocurrency-theft", "daily-threat-intel", "dao-impersonation", "data-harvesting", "deceptive-ads", "deceptive-content", "deceptive-pricing", "deceptive-site", "deceptive-tactics", "direct-download", "discord-abuse", "disposable-infrastructure", "domain-classification", "e-commerce-scam", "egypt-post", "eid-al-fitr", "elabd-sweets", "evasion-technique", "exploit-kit-landing-page", "facebook-impersonation", "fake-alert", "fake-apps", "fake-giveaway", "fake-investment", "fake-login", "fake-login-portal", "fake-portal", "fake-prize", "fake-products", "fake-shop", "financial-data-theft", "financial-exploitation", "financial-fraud", "financial-scam", "fiverr-impersonation", "form-phishing", "fraudulent-retail", "gambling-site", "game-repacks", "gaming-device-scam", "gaming-reward-scam", "get-rich-quick", "gibberish-domain", "government-impersonation", "high-risk-domain", "high-yield-investment-program", "hyip", "identity-theft", "investment-scam", "invoice-scam", "ios-targeting", "lead-generation-fraud", "linkedin-lure", "loan-scam", "malaysia", "malicious-download", "malicious-redirect", "malicious-redirection", "malicious-redirects", "malware-delivery", "malware-distribution", "manual-entry", "microsoft-account", "microsoft-outlook", "minecraft", "modded-apps", "mpesa-impersonation", "nebula-x", "new-domain", "newly-registered-domain", "nvidia-impersonation", "payment-harvesting", "payment-scam", "pennsylvania", "phishing", "phishing-kit", "phishing-page", "phishing-scam", "phishing-site", "pig-butchering", "pirated-software", "ponzi-scheme", "potentially-unwanted-programs", "price-scam", "privacy-violation", "product-impersonation", "puma", "push-notification-scam", "questionnaire-scam", "recovery-scam", "redirect", "redirect-chain", "redirector", "referral-scheme", "retail-fraud", "retail-scam", "ru-tld", "rug-pull", "scam", "scam-lure", "scam-network", "scam-site", "security-bypass", "serial-scam-infrastructure", "slot-machine-scam", "social-engineering", "social-media-credentials", "spam", "stolen-credit-cards", "supercell-impersonation", "suspicious-domain", "task-scam", "telefa-ru", "telegram-impersonation", "temu-impersonation", "tnb-impersonation", "toll-scam", "transaction-fraud", "transportation-scam", "typosquatting", "unauthorized-app-distribution", "unregulated-gambling", "untrusted-app-installation", "untrusted-source", "url-shortener", "urlert", "vercel-hosting", "virtual-currency-scam", "virtual-numbers", "wallet-draining", "youth-targeting", "zip-file" ], "references": [ "https://urlert.com/domain/515484-celsius.com", "https://urlert.com/domain/aicotp.com", "https://urlert.com/domain/aicotps.cloud", "https://urlert.com/domain/airtable.com", "https://urlert.com/domain/auroraexchanges.com", "https://urlert.com/domain/binx.vip", "https://urlert.com/domain/blox-gifts.com", "https://urlert.com/domain/bull-coin.top", "https://urlert.com/domain/chpotlemenu.com", "https://urlert.com/domain/connectcity.com.my", "https://urlert.com/domain/cutt.ly", "https://urlert.com/domain/daoasdk.cc", "https://urlert.com/domain/dlproxy.uk", "https://urlert.com/domain/donutstake.com", "https://urlert.com/domain/ey43.com", "https://urlert.com/domain/fitgirl-repacks.site", "https://urlert.com/domain/fulfillbizbd.com", "https://urlert.com/domain/google.com", "https://urlert.com/domain/hsforms.com", "https://urlert.com/domain/hstn.me" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Energy", "Financial Services", "Government", "Logistics / Supply Chain", "Media / Entertainment", "Retail / E-Commerce", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "urlert_intel", "id": "386175", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_386175/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 39, "URL": 33, "hostname": 13 }, "indicator_count": 85, "is_author": false, "is_subscribing": null, "subscriber_count": 23, "modified_text": "11 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 0 } ], "references": [ "https://urlert.com/domain/auroraexchanges.com", "https://urlert.com/domain/dlproxy.uk", "https://urlert.com/domain/aicotps.cloud", "https://urlert.com/domain/airtable.com", "https://urlert.com/domain/bull-coin.top", "https://urlert.com/domain/cutt.ly", "https://urlert.com/domain/515484-celsius.com", "https://urlert.com/domain/donutstake.com", "https://urlert.com/domain/daoasdk.cc", "https://urlert.com/domain/fulfillbizbd.com", "https://urlert.com/domain/ey43.com", "https://urlert.com/domain/fitgirl-repacks.site", "https://urlert.com/domain/connectcity.com.my", "https://urlert.com/domain/aicotp.com", "https://urlert.com/domain/binx.vip", "https://urlert.com/domain/blox-gifts.com", "https://urlert.com/domain/hstn.me", "https://urlert.com/domain/hsforms.com", "https://urlert.com/domain/chpotlemenu.com", "https://urlert.com/domain/google.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [ "Energy", "Media / entertainment", "Logistics / supply chain", "Technology", "Retail / e-commerce", "Financial services", "Government" ], "unique_indicators": 1304 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/lovestoblog.com", "whois": "http://whois.domaintools.com/lovestoblog.com", "domain": "lovestoblog.com", "hostname": "flawor.lovestoblog.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "69e1b46238df27ff6680430a", "name": "Analysis- 12/12/24 Darkgate- 9e4f036dd6fbb45ce414cb5d040b3255b5ccc9ecacbfaf022b631545f9a19a02.zip (MD5: 71E189A0B08891CFFAB6E656FC49E00A) Malicious activity - Interactive analysis ANY.RUN", "description": "<> Darkgate. Links wouldnt attach. User does not have whatsapp.", "modified": "2026-04-17T07:11:13.591000", "created": "2026-04-17T04:17:38.518000", "tags": [ "delete", "yara detections", "high", "medium", "whatsapp plugin", "whatsapp", "read", "write", "top source", "top destination", "virustotal", "guard", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 57, "FileHash-MD5": 54, "FileHash-SHA1": 50, "FileHash-SHA256": 431, "URL": 328, "hostname": 385, "domain": 409, "email": 51, "CIDR": 40 }, "indicator_count": 1805, "is_author": false, "is_subscribing": null, "subscriber_count": 47, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69af6d35446533a0b810ff30", "name": "URLert Daily Threat Intel \u2014 2026-03-10", "description": "URLert Daily Threat Intel \u2014 2026-03-10\n\nAutomated threat intelligence from URLert (https://urlert.com) \u2014 AI-powered URL and domain analysis.\n\nThreats: 63 | Indicators: 116\nConfirmed: 17 | Likely: 36 | Domain intel: 9 | Manual: 1\nTop threats: Phishing (53), Malware Hosting (4), Unknown (2), Malvertising (1), Exploit Kit (1)\nDomains: 515484-celsius.com, aicotp.com, aicotps.cloud, airtable.com, auroraexchanges.com, binx.vip, blox-gifts.com, bull-coin.top, chpotlemenu.com, connectcity.com.my, cutt.ly, daoasdk.cc, dlproxy...\n\n63 unique threats producing 116 actionable indicators. Generated by URLert automated threat intelligence.", "modified": "2026-04-08T22:28:30.988000", "created": "2026-03-10T01:00:37.499000", "tags": [ "accenture-impersonation", "adult-content-lure", "adware", "aged-domain-repurposed", "aicotps", "airtable-abuse", "alibaba-com-impersonation", "anti-analysis", "apk-distribution", "app-store-impersonation", "apple-impersonation", "automated-scan", "brand-impersonation", "browser-evasion", "browser-extension", "burnable-infrastructure", "business-email-phishing", "bypassing-security", "cacau-show", "captcha-challenge", "carding", "cc-tld", "celsius-impersonation", "chipotle", "cisco-webex-impersonation", "combosquatting", "compromised-accounts", "content-locker", "cotps", "credential-harvesting", "cryptocurrency", "cryptocurrency-fraud", "cryptocurrency-scam", "cryptocurrency-theft", "daily-threat-intel", "dao-impersonation", "data-harvesting", "deceptive-ads", "deceptive-content", "deceptive-pricing", "deceptive-site", "deceptive-tactics", "direct-download", "discord-abuse", "disposable-infrastructure", "domain-classification", "e-commerce-scam", "egypt-post", "eid-al-fitr", "elabd-sweets", "evasion-technique", "exploit-kit-landing-page", "facebook-impersonation", "fake-alert", "fake-apps", "fake-giveaway", "fake-investment", "fake-login", "fake-login-portal", "fake-portal", "fake-prize", "fake-products", "fake-shop", "financial-data-theft", "financial-exploitation", "financial-fraud", "financial-scam", "fiverr-impersonation", "form-phishing", "fraudulent-retail", "gambling-site", "game-repacks", "gaming-device-scam", "gaming-reward-scam", "get-rich-quick", "gibberish-domain", "government-impersonation", "high-risk-domain", "high-yield-investment-program", "hyip", "identity-theft", "investment-scam", "invoice-scam", "ios-targeting", "lead-generation-fraud", "linkedin-lure", "loan-scam", "malaysia", "malicious-download", "malicious-redirect", "malicious-redirection", "malicious-redirects", "malware-delivery", "malware-distribution", "manual-entry", "microsoft-account", "microsoft-outlook", "minecraft", "modded-apps", "mpesa-impersonation", "nebula-x", "new-domain", "newly-registered-domain", "nvidia-impersonation", "payment-harvesting", "payment-scam", "pennsylvania", "phishing", "phishing-kit", "phishing-page", "phishing-scam", "phishing-site", "pig-butchering", "pirated-software", "ponzi-scheme", "potentially-unwanted-programs", "price-scam", "privacy-violation", "product-impersonation", "puma", "push-notification-scam", "questionnaire-scam", "recovery-scam", "redirect", "redirect-chain", "redirector", "referral-scheme", "retail-fraud", "retail-scam", "ru-tld", "rug-pull", "scam", "scam-lure", "scam-network", "scam-site", "security-bypass", "serial-scam-infrastructure", "slot-machine-scam", "social-engineering", "social-media-credentials", "spam", "stolen-credit-cards", "supercell-impersonation", "suspicious-domain", "task-scam", "telefa-ru", "telegram-impersonation", "temu-impersonation", "tnb-impersonation", "toll-scam", "transaction-fraud", "transportation-scam", "typosquatting", "unauthorized-app-distribution", "unregulated-gambling", "untrusted-app-installation", "untrusted-source", "url-shortener", "urlert", "vercel-hosting", "virtual-currency-scam", "virtual-numbers", "wallet-draining", "youth-targeting", "zip-file" ], "references": [ "https://urlert.com/domain/515484-celsius.com", "https://urlert.com/domain/aicotp.com", "https://urlert.com/domain/aicotps.cloud", "https://urlert.com/domain/airtable.com", "https://urlert.com/domain/auroraexchanges.com", "https://urlert.com/domain/binx.vip", "https://urlert.com/domain/blox-gifts.com", "https://urlert.com/domain/bull-coin.top", "https://urlert.com/domain/chpotlemenu.com", "https://urlert.com/domain/connectcity.com.my", "https://urlert.com/domain/cutt.ly", "https://urlert.com/domain/daoasdk.cc", "https://urlert.com/domain/dlproxy.uk", "https://urlert.com/domain/donutstake.com", "https://urlert.com/domain/ey43.com", "https://urlert.com/domain/fitgirl-repacks.site", "https://urlert.com/domain/fulfillbizbd.com", "https://urlert.com/domain/google.com", "https://urlert.com/domain/hsforms.com", "https://urlert.com/domain/hstn.me" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "Energy", "Financial Services", "Government", "Logistics / Supply Chain", "Media / Entertainment", "Retail / E-Commerce", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "urlert_intel", "id": "386175", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_386175/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 39, "URL": 33, "hostname": 13 }, "indicator_count": 85, "is_author": false, "is_subscribing": null, "subscriber_count": 23, "modified_text": "11 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://flawor.lovestoblog.com/lo.php", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://flawor.lovestoblog.com/lo.php", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776641783.8897407 }