{
  "type": "URL",
  "indicator": "https://login.yahoo.doc-view.work/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://login.yahoo.doc-view.work/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3658405570,
      "indicator": "https://login.yahoo.doc-view.work/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69c1bd40f81db45dc044697c",
          "name": "Masterkey Clone By CallmeDoris",
          "description": "",
          "modified": "2026-03-23T22:22:56.940000",
          "created": "2026-03-23T22:22:56.940000",
          "tags": [
            "dropped file",
            "chromeua",
            "runtime data",
            "drmedgeua",
            "edgeua",
            "generator",
            "win64",
            "null",
            "template",
            "unknown",
            "critical",
            "addressbar",
            "desktop",
            "dark",
            "light",
            "iframe",
            "cookie",
            "meta",
            "body",
            "legend",
            "dwis",
            "core",
            "tear",
            "malicious",
            "mozilla",
            "strings",
            "qakbot",
            "://masterkey.com.ua/download/MKClientSetup.exe"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "642db7b656049e54b2f71c20",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 949,
            "URL": 5642,
            "CVE": 2,
            "domain": 509,
            "FileHash-SHA256": 293,
            "FileHash-MD5": 550,
            "FileHash-SHA1": 60,
            "email": 5
          },
          "indicator_count": 8010,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "28 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "642db7b656049e54b2f71c20",
          "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100",
          "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness",
          "modified": "2023-05-05T16:00:23.366000",
          "created": "2023-04-05T18:02:30.403000",
          "tags": [
            "dropped file",
            "chromeua",
            "runtime data",
            "drmedgeua",
            "edgeua",
            "generator",
            "win64",
            "null",
            "template",
            "unknown",
            "critical",
            "addressbar",
            "desktop",
            "dark",
            "light",
            "iframe",
            "cookie",
            "meta",
            "body",
            "legend",
            "dwis",
            "core",
            "tear",
            "malicious",
            "mozilla",
            "strings",
            "qakbot",
            "://masterkey.com.ua/download/MKClientSetup.exe"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 949,
            "URL": 5642,
            "CVE": 2,
            "domain": 509,
            "FileHash-SHA256": 293,
            "FileHash-MD5": 550,
            "FileHash-SHA1": 60,
            "email": 5
          },
          "indicator_count": 8010,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "1081 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 8024
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/doc-view.work",
    "whois": "http://whois.domaintools.com/doc-view.work",
    "domain": "doc-view.work",
    "hostname": "login.yahoo.doc-view.work"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69c1bd40f81db45dc044697c",
      "name": "Masterkey Clone By CallmeDoris",
      "description": "",
      "modified": "2026-03-23T22:22:56.940000",
      "created": "2026-03-23T22:22:56.940000",
      "tags": [
        "dropped file",
        "chromeua",
        "runtime data",
        "drmedgeua",
        "edgeua",
        "generator",
        "win64",
        "null",
        "template",
        "unknown",
        "critical",
        "addressbar",
        "desktop",
        "dark",
        "light",
        "iframe",
        "cookie",
        "meta",
        "body",
        "legend",
        "dwis",
        "core",
        "tear",
        "malicious",
        "mozilla",
        "strings",
        "qakbot",
        "://masterkey.com.ua/download/MKClientSetup.exe"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "642db7b656049e54b2f71c20",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 949,
        "URL": 5642,
        "CVE": 2,
        "domain": 509,
        "FileHash-SHA256": 293,
        "FileHash-MD5": 550,
        "FileHash-SHA1": 60,
        "email": 5
      },
      "indicator_count": 8010,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "28 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "642db7b656049e54b2f71c20",
      "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100",
      "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness",
      "modified": "2023-05-05T16:00:23.366000",
      "created": "2023-04-05T18:02:30.403000",
      "tags": [
        "dropped file",
        "chromeua",
        "runtime data",
        "drmedgeua",
        "edgeua",
        "generator",
        "win64",
        "null",
        "template",
        "unknown",
        "critical",
        "addressbar",
        "desktop",
        "dark",
        "light",
        "iframe",
        "cookie",
        "meta",
        "body",
        "legend",
        "dwis",
        "core",
        "tear",
        "malicious",
        "mozilla",
        "strings",
        "qakbot",
        "://masterkey.com.ua/download/MKClientSetup.exe"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 949,
        "URL": 5642,
        "CVE": 2,
        "domain": 509,
        "FileHash-SHA256": 293,
        "FileHash-MD5": 550,
        "FileHash-SHA1": 60,
        "email": 5
      },
      "indicator_count": 8010,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "1081 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://login.yahoo.doc-view.work/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://login.yahoo.doc-view.work/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776723980.2039235
}