{ "type": "URL", "indicator": "https://github.com/eed8989/u/raw/main/ud.bat", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://github.com/eed8989/u/raw/main/ud.bat", "type": "url", "type_title": "URL", "validation": [ { "source": "alexa", "message": "Alexa rank: #87", "name": "Listed on Alexa" }, { "source": "akamai", "message": "Akamai rank: #560", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain github.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain github.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4053564397, "indicator": "https://github.com/eed8989/u/raw/main/ud.bat", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 16, "pulses": [ { "id": "69fd7b60289b73182e9a159c", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:52.129000", "created": "2026-05-08T05:57:52.129000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ed982a2ed94c12f67", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:50.241000", "created": "2026-05-08T05:57:50.241000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5d484b29482fbe4cc2", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:49.464000", "created": "2026-05-08T05:57:49.464000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ab51dd45774eac47b", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:46.054000", "created": "2026-05-08T05:57:46.054000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58e8a0903393ffdd7a", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.720000", "created": "2026-05-08T05:57:44.720000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58b4b5d410557d3c34", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.086000", "created": "2026-05-08T05:57:44.086000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3a63bbd9f424b1cbe0", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:14.484000", "created": "2026-05-08T05:57:14.484000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3888a42bcf91770459", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:12.538000", "created": "2026-05-08T05:57:12.538000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b354f93bc9aed606930", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.991000", "created": "2026-05-08T05:57:09.991000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b35900d81ffc451da66", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.372000", "created": "2026-05-08T05:57:09.372000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b341c333a37e7a73ff2", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:08.912000", "created": "2026-05-08T05:57:08.912000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b332f6ea864283eef95", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:07.336000", "created": "2026-05-08T05:57:07.336000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69891e6c45e0e5cd7d52479d", "name": "URLHaus", "description": "", "modified": "2026-03-10T23:00:49.662000", "created": "2026-02-08T23:38:20.162000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 6, "FileHash-MD5": 19, "FileHash-SHA1": 20, "FileHash-SHA256": 3, "URL": 13688, "domain": 308, "hostname": 399 }, "indicator_count": 14443, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "84 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "662e0a50715909a2ce36d1d5", "name": "Jeroen Gui lists (https://file.jeroengui.be)", "description": "A pulse fed with lists taken from https://file.jeroengui.be . I am not him. Visit his website jeroengui.be", "modified": "2025-09-21T05:30:59.802000", "created": "2024-04-28T08:35:28.934000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1089, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tomtomalien", "id": "258713", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_258713/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 162, "modified_text": "254 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "672f70d470cdbab07d3bdb8f", "name": "URLHaus Recent URLs", "description": "", "modified": "2025-05-15T13:30:30.738000", "created": "2024-11-09T14:25:24.551000", "tags": [], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 313720 }, "indicator_count": 313720, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "383 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "67e9d2bd51acfaf1cdc3410b", "name": "URLHaus data - 30-03-2025", "description": "", "modified": "2025-04-29T23:03:30.508000", "created": "2025-03-30T23:24:45.945000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "ClearFake", "SmartLoader", "zip", "exe", "hajime", "ascii", "Encoded", "xworm", "jpg-base64-loader", "opendir", "sh", "CoinMiner", "tar", "powershell", "ps1", "bat", "NetSupport", "rat", "dcrat", "rev-base64-loader", "Formbook", "UACModuleSmokeLoader", "LummaStealer", "Rhadamanthys", "RemcosRAT", "ClickFix", "Lumma", "Braodo", "mimikatz", "PythonStealer", "ua-wget", "Gh0stRAT", "RedLineStealer", "QuasarRAT", "mirai", "gafgyt", "encrypted", "GuLoader", "connectwise", "screenconnect", "script", "infostealer", "revoked-cert", "signed", "stealer", "trojan", "FakeCaptcha" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 56, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 860, "hostname": 35, "domain": 23 }, "indicator_count": 918, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "399 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/", "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell" ], "malware_families": [], "industries": [], "unique_indicators": 1178201 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/github.com", "whois": "http://whois.domaintools.com/github.com", "domain": "github.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 16, "pulses": [ { "id": "69fd7b60289b73182e9a159c", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:52.129000", "created": "2026-05-08T05:57:52.129000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ed982a2ed94c12f67", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:50.241000", "created": "2026-05-08T05:57:50.241000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5d484b29482fbe4cc2", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:49.464000", "created": "2026-05-08T05:57:49.464000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ab51dd45774eac47b", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:46.054000", "created": "2026-05-08T05:57:46.054000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58e8a0903393ffdd7a", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.720000", "created": "2026-05-08T05:57:44.720000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58b4b5d410557d3c34", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.086000", "created": "2026-05-08T05:57:44.086000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3a63bbd9f424b1cbe0", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:14.484000", "created": "2026-05-08T05:57:14.484000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3888a42bcf91770459", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:12.538000", "created": "2026-05-08T05:57:12.538000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b354f93bc9aed606930", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.991000", "created": "2026-05-08T05:57:09.991000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b35900d81ffc451da66", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.372000", "created": "2026-05-08T05:57:09.372000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://github.com/eed8989/u/raw/main/ud.bat", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://github.com/eed8989/u/raw/main/ud.bat", "type": "URL", "found": true, "verdict": "malicious", "url_status": "online", "threat": "malware_download", "tags": [ "Braodo" ], "date_added": "2025-03-30", "last_online": "2025-09-11", "reporter": "abuse_ch", "host": "github.com", "payloads": [ { "filename": "ud.bat", "file_type": "txt", "md5": "fd2d10e7a480e2916918996cb2a488ed", "sha256": "fc345c54a86d32443e86bccaf37046892eef7748f28be5a52da56aa6bfc6b0b3", "signature": "Braodo", "first_seen": "2025-08-16" } ], "error": null }, "from_cache": true, "_cached_at": 1780459739.6109335 }