{ "type": "URL", "indicator": "https://homecaremovers.com/server.png", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://homecaremovers.com/server.png", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4311687173, "indicator": "https://homecaremovers.com/server.png", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 1, "pulses": [ { "id": "69def321be787d12e7d27ee7", "name": "URLHaus data - 14-04-2026 (Part 2)", "description": "", "modified": "2026-05-15T02:03:46.439000", "created": "2026-04-15T02:08:33.755000", "tags": [ "ClearFake", "NetSupport", "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "GuLoader", "c2-monitor-auto", "dropped-by-amadey", "opendir", "ua-wget", "x86", "ConnectBack", "emotet", "exe", "heodo", "connectwise", "rmm", "screenconnect", "zip", "sh", "AsyncRAT", "ascii", "Encoded", "RemcosRAT", "rev-base64-loader", "132-243-173-111-3000", "QuasarRAT", "Amadey", "cred.dll", "d854e4", "plugin", "176-65-139-20", "rat", "PureHVNC", "PureRAT", "hta", "SilentNet", "ACRStealer", "VenomRAT", "banking-trojan-frontend", "Jwr", "PaaS", "phishing", "RBC", "ANZ", "Suncorp", "Qantas", "Lloyds", "Bendigo", "HSBC", "NatWest", "jar", "WeedHack", "CommBank", "Westpac", "Raiffeisen", "Macquarie", "StGeorge", "130-12-180-119-8080", "Tofsee", "91-92-243-242", "176-65-139-42", "LummaStealer", "msi", "AgentTesla", "PhantomStealer", "Formbook", "Loda", "encrypted", "SilverFox", "fake_ssa", "ChromeElevator", "ChromElevator", "stealer", "xml", "m68k", "PowerPC", "SuperH", "sparc" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 253, "hostname": 90, "domain": 12 }, "indicator_count": 355, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 433 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/homecaremovers.com", "whois": "http://whois.domaintools.com/homecaremovers.com", "domain": "homecaremovers.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 1, "pulses": [ { "id": "69def321be787d12e7d27ee7", "name": "URLHaus data - 14-04-2026 (Part 2)", "description": "", "modified": "2026-05-15T02:03:46.439000", "created": "2026-04-15T02:08:33.755000", "tags": [ "ClearFake", "NetSupport", "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "GuLoader", "c2-monitor-auto", "dropped-by-amadey", "opendir", "ua-wget", "x86", "ConnectBack", "emotet", "exe", "heodo", "connectwise", "rmm", "screenconnect", "zip", "sh", "AsyncRAT", "ascii", "Encoded", "RemcosRAT", "rev-base64-loader", "132-243-173-111-3000", "QuasarRAT", "Amadey", "cred.dll", "d854e4", "plugin", "176-65-139-20", "rat", "PureHVNC", "PureRAT", "hta", "SilentNet", "ACRStealer", "VenomRAT", "banking-trojan-frontend", "Jwr", "PaaS", "phishing", "RBC", "ANZ", "Suncorp", "Qantas", "Lloyds", "Bendigo", "HSBC", "NatWest", "jar", "WeedHack", "CommBank", "Westpac", "Raiffeisen", "Macquarie", "StGeorge", "130-12-180-119-8080", "Tofsee", "91-92-243-242", "176-65-139-42", "LummaStealer", "msi", "AgentTesla", "PhantomStealer", "Formbook", "Loda", "encrypted", "SilverFox", "fake_ssa", "ChromeElevator", "ChromElevator", "stealer", "xml", "m68k", "PowerPC", "SuperH", "sparc" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 253, "hostname": 90, "domain": 12 }, "indicator_count": 355, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "17 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://homecaremovers.com/server.png", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://homecaremovers.com/server.png", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [], "date_added": "2026-04-14", "last_online": "2026-05-04", "reporter": "abuse_ch", "host": "homecaremovers.com", "payloads": [ { "filename": "server.png", "file_type": "unknown", "md5": "8d21e4ed8c62f790543e6caf8710e34e", "sha256": "a49224632f7b0eb683e7c84ff483881de3dad4c734b16408a1b27d13276fbd74", "signature": null, "first_seen": "2026-04-14" } ], "error": null }, "from_cache": true, "_cached_at": 1780326535.16861 }