{ "type": "URL", "indicator": "https://login.live.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://login.live.com", "type": "url", "type_title": "URL", "validation": [ { "source": "alexa", "message": "Alexa rank: #18", "name": "Listed on Alexa" }, { "source": "akamai", "message": "Akamai rank: #42", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain live.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain live.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3742605156, "indicator": "https://login.live.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 7, "pulses": [ { "id": "6998d15c75b59044877602c1", "name": "Corrupt.... Files", "description": "beaware", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-20T21:25:48.559000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 706, "FileHash-SHA1": 859, "FileHash-SHA256": 1480, "URL": 743, "domain": 1565, "email": 55, "hostname": 912, "CVE": 54, "CIDR": 27 }, "indicator_count": 6401, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a464c07b076a6022abbe", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-12-06T16:42:12.952000", "created": "2023-12-06T16:42:12.952000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0c0b966ec5b823d2ae7", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer", "description": "", "modified": "2023-12-06T16:26:40.335000", "created": "2023-12-06T16:26:40.335000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a05bc6152413ed0fdbaa", "name": "Social Engineering -Striven Anonymizer", "description": "", "modified": "2023-12-06T16:24:59.615000", "created": "2023-12-06T16:24:59.615000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e26c454e86439fd9462541", "name": "Social Engineering -Striven Anonymizer", "description": "Optin Example: Affected (device w/vulnerabilities or in BotNetwork, etc) clocks on a ' Sponsored Ad' that fits search query. Will view webpage and Optin to be contacted by email and/or telephone. Both methods will likely be required by attacker. Bad actor will call immediately, quality of call can be surprisingly poor (obnoxiously noisy), BA takes assessment, quotes prices much higher than should be. You are desperate because no one else can help. Actor will demand email, will send various attachments, all malicious. Will not look suspicious, (strategy, video introduction, proposal, etc). Once you don't respond you may receive email contact from different email, more attachments. Follow ups...by now bad actor has full use of device. Spyware. Apps auto download, blocked from removal. Incredible cycle.\n\n\nLogin.aspx192.118.8.10 = 192.118.8.10\niphones.orange.co.il\nhttps://www.partner.co.il/n/login?utm_source=sm", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-20T19:40:53.299000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e7c73087130803d20066ef", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer ", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-24T21:10:08.493000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6500a47dd316d0ea5616044d", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-09-12T17:48:45.349000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "MilesIT", "https://login.striven.com/Security/Login.aspx192.118.8.10" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Striven" ], "malware_families": [ "Alf:monitoringtool:androidos/finspy", "Black basta (elf)" ], "industries": [ "Cyber security" ], "unique_indicators": 6123 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/live.com", "whois": "http://whois.domaintools.com/live.com", "domain": "live.com", "hostname": "login.live.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 7, "pulses": [ { "id": "6998d15c75b59044877602c1", "name": "Corrupt.... Files", "description": "beaware", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-20T21:25:48.559000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 706, "FileHash-SHA1": 859, "FileHash-SHA256": 1480, "URL": 743, "domain": 1565, "email": 55, "hostname": 912, "CVE": 54, "CIDR": 27 }, "indicator_count": 6401, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a464c07b076a6022abbe", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-12-06T16:42:12.952000", "created": "2023-12-06T16:42:12.952000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a0c0b966ec5b823d2ae7", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer", "description": "", "modified": "2023-12-06T16:26:40.335000", "created": "2023-12-06T16:26:40.335000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a05bc6152413ed0fdbaa", "name": "Social Engineering -Striven Anonymizer", "description": "", "modified": "2023-12-06T16:24:59.615000", "created": "2023-12-06T16:24:59.615000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28, "URL": 247, "FileHash-SHA256": 705, "hostname": 126, "FileHash-MD5": 17, "FileHash-SHA1": 13 }, "indicator_count": 1136, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e26c454e86439fd9462541", "name": "Social Engineering -Striven Anonymizer", "description": "Optin Example: Affected (device w/vulnerabilities or in BotNetwork, etc) clocks on a ' Sponsored Ad' that fits search query. Will view webpage and Optin to be contacted by email and/or telephone. Both methods will likely be required by attacker. Bad actor will call immediately, quality of call can be surprisingly poor (obnoxiously noisy), BA takes assessment, quotes prices much higher than should be. You are desperate because no one else can help. Actor will demand email, will send various attachments, all malicious. Will not look suspicious, (strategy, video introduction, proposal, etc). Once you don't respond you may receive email contact from different email, more attachments. Follow ups...by now bad actor has full use of device. Spyware. Apps auto download, blocked from removal. Incredible cycle.\n\n\nLogin.aspx192.118.8.10 = 192.118.8.10\niphones.orange.co.il\nhttps://www.partner.co.il/n/login?utm_source=sm", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-20T19:40:53.299000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "64e7c73087130803d20066ef", "name": "PROXY - Defense Evasion \u2022 Malicious Spammer ", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-08-24T21:10:08.493000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 223, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6500a47dd316d0ea5616044d", "name": "Social Engineering - Anonymizer - Qakbot \u221a", "description": "", "modified": "2023-09-19T20:04:24.850000", "created": "2023-09-12T17:48:45.349000", "tags": [ "qakbot", "string", "social engineering", "click", "malspam", "chromeua", "optout", "drmedgeua", "pattern match", "unicode", "optin", "suspicious", "footer", "ansi", "dropped file", "localappdata", "scam", "anonymizer", "Binary Padding", "Apt", "Defense Evasion", "junk files" ], "references": [ "https://login.striven.com/Security/Login.aspx192.118.8.10", "MilesIT" ], "public": 1, "adversary": "Striven", "targeted_countries": [ "United States of America", "Israel" ], "malware_families": [ { "id": "Black Basta (ELF)", "display_name": "Black Basta (ELF)", "target": null }, { "id": "ALF:MonitoringTool:AndroidOS/FinSpy", "display_name": "ALF:MonitoringTool:AndroidOS/FinSpy", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [ "Cyber Security" ], "TLP": "white", "cloned_from": "64e26c454e86439fd9462541", "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 201, "domain": 52, "URL": 443, "FileHash-MD5": 17, "FileHash-SHA256": 738, "FileHash-SHA1": 13 }, "indicator_count": 1464, "is_author": false, "is_subscribing": null, "subscriber_count": 224, "modified_text": "984 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://login.live.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://login.live.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780211220.2049272 }