{ "type": "URL", "indicator": "https://mjiowe.com/ed29d", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://mjiowe.com/ed29d", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4227346456, "indicator": "https://mjiowe.com/ed29d", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "69a02837827feb0b78fa3ad2", "name": "The Belasco Chain", "description": "The adversary delivers a masterclass in \"Regular Belasco\" stagecraft, utilizing authentic Adobe PIDs to construct a \"living library\" of legitimacy where mundane metadata like SOPHIA.json acts as Gatsby\u2019s \"real but uncut\" volumes to mask a hollowed-out interior. This is a triumph of performative evasion; while researchers marvel at the realism of the set-dressing, MSI50B8.tmp and MSI4F2F.tmp wait in the wings of the Windows\\Installer directory, invisible to the human eye and using NGEN hijacking to bake illicit scripts directly into the OS framework. By employing Cryptnet certificates as \"stage lighting\" to mask C2 handshakes, the malware doesn't just attend the system\u2019s party\u2014it rewrites the invitation to own the house. Unlike the tragic end at West Egg, this Belasco chain is a play that refuses to end; it simply resets the stage, ensuring the performance continues as long as the \"green light\" of the C2 remains active.", "modified": "2026-05-31T01:02:14", "created": "2026-02-26T11:02:15.932000", "tags": [ "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "file type", "sha1", "sha256", "crc32", "filenames c" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2813, "FileHash-SHA1": 2576, "FileHash-SHA256": 8145, "domain": 1903, "hostname": 1502, "URL": 1359, "email": 46, "CVE": 54, "CIDR": 3, "YARA": 7, "JA3": 1, "IPv4": 11 }, "indicator_count": 18420, "is_author": false, "is_subscribing": null, "subscriber_count": 74, "modified_text": "6 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699bf39a4b96d1d4236cf91f", "name": "Suspicious PDF Analysis+Behavioral Summary", "description": "Analysis of network and process logs indicates an attempt to undermine the system\u2019s Root of Trust by manipulating certificate validation files. The attacker is likely using Man-in-the-Middle techniques to force the system to accept revoked or fraudulent certificates. Additionally, suspicious activity within Adobe processes suggests that software update mechanisms are being hijacked to execute malicious code. Immediate isolation is required to prevent the installation of unauthorized software or the interception of encrypted data.", "modified": "2026-05-15T17:51:27.499000", "created": "2026-02-23T06:28:42.282000", "tags": [ "" ], "references": [ "", "TLP: AMBER" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 1892, "FileHash-SHA256": 9944, "FileHash-MD5": 1802, "URL": 225, "hostname": 445, "domain": 284, "CVE": 91, "SSLCertFingerprint": 2, "email": 14, "CIDR": 5 }, "indicator_count": 14704, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "15 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699969651d3b082f6b583fae", "name": "PDFKIT.net", "description": "Data Points. Search tall components CVE's for more info on this.", "modified": "2026-05-15T17:51:25.327000", "created": "2026-02-21T08:14:29.258000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 370, "hostname": 444, "FileHash-SHA1": 1292, "FileHash-SHA256": 4069, "URL": 192, "FileHash-MD5": 1255, "email": 16, "CVE": 58 }, "indicator_count": 7696, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "15 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699c3b796fcaed878ca94c5c", "name": "https://m.vzw.com/wIvzrd8", "description": "the wizard", "modified": "2026-04-18T05:30:18.690000", "created": "2026-02-23T11:35:21.673000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1818, "hostname": 575, "URL": 200, "FileHash-SHA1": 450, "CIDR": 11, "domain": 887, "email": 7, "FileHash-MD5": 402, "CVE": 21 }, "indicator_count": 4371, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "43 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699ffe2a0a48bdf23d11efb4", "name": "Cardconnect Ecosystem", "description": "The cardconnect.com infrastructure reveals a fragmented and high-risk network topology characterized by an atypical shift from Fastly edge delivery to Radware-Ukraine (AS30779) routing. While core transaction processing remains anchored within Fiserv (AS11121/AS39992) and status monitoring is partitioned to AWS, the persistent resolution of root and www traffic to Ukrainian IP space (176.100.165.28) creates a significant geolocation anomaly for a US financial entity. This volatility, coupled with orphaned NXDOMAIN records and inconsistent CNAME nesting (aliasing vendor-specific subdomains like idexx and frazer to centralized b2c/fts endpoints), suggests a non-unified deployment strategy that complicates the domain\u2019s security perimeter and increases its exposure to DNS-based interception.", "modified": "2026-04-13T23:46:24.779000", "created": "2026-02-26T08:02:50.501000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 301, "FileHash-SHA256": 198, "hostname": 1359, "URL": 229, "email": 8, "FileHash-SHA1": 49, "CIDR": 4, "FileHash-MD5": 11, "CVE": 2 }, "indicator_count": 2161, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6998deba4fb8e0ab5abd3b7e", "name": "Trojan Malware", "description": "A full report on the malware that infected the Windows operating system (Win32) from 1992 to 2018, as compiled by the University of South Africa, has been released by researchers at King's College London.", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-20T22:22:50.689000", "tags": [ "contacted", "date", "file score", "exploit", "ids detections", "tls handshake", "failure yara", "alerts", "labs pulses", "pulses", "sodinokibi", "ransomware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 32, "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 4, "domain": 48, "hostname": 34, "URL": 35, "email": 2 }, "indicator_count": 165, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699a4bf3e44c12a506ceef6c", "name": "\"Fake Time Stamp Responder\"", "description": "Fake TimeStamping Services CA, which uses time-stamping technology, is being investigated by the Department of Health, Social Security and the US National Security Agency (NSS) for fraud.", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-22T00:21:07.499000", "tags": [ "fake timestamp", "timestamping", "ca valid", "from", "usage ff", "algorithm", "thumbprint", "thumbprint md5", "serial number", "b0 dd" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "URL": 20, "CVE": 34, "hostname": 8, "domain": 13 }, "indicator_count": 81, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699a8339b9e516069852d3e2", "name": "Whitelist Shell", "description": "Data Point for Further Review", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-22T04:16:57.040000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 39, "FileHash-MD5": 2, "FileHash-SHA1": 2, "hostname": 194, "email": 6, "URL": 187, "domain": 263, "CVE": 30 }, "indicator_count": 723, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699da4b51b83807ed9e7442e", "name": "GKG.NET + Verizon Infrastructure- Potential Domain Compromise & Financial Fraud Campaign", "description": "Verizon Domain Resolves Here. Financial Concern: CCV checker v1.0 by kid1232.exe (14/72) is a specialized tool for validating stolen credit cards. Its presence is an interesting finding.\nInfrastructure Targeting: The files Master Domain Database (2).xlsx and Accredited-Registrars-202602220056.csv suggest the actor is collecting data on registrars to facilitate Supply Chain Attacks or large-scale domain thefts.\nActive Compromise: The PDF metrosanantonioliving.com DNS Zones and the FireShot screenshot of GKG's DNS configuration page are direct evidence of a \"live\" account takeover or unauthorized configuration of a victim's domain.\nThe Heavy Hitter: The Win32 EXE ending in ...13547c3 with 45/70 detections is likely the primary Infostealer or RAT used to harvest the credentials for these GKG accounts.", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-24T13:16:37.558000", "tags": [ "algorithm", "key identifier", "x509v3 subject", "v3 serial", "number", "cbe oglobalsign", "r6 alphassl", "validity", "subject public", "key info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 356, "FileHash-SHA1": 126, "FileHash-SHA256": 615, "URL": 266, "hostname": 187, "FileHash-MD5": 108, "email": 14, "CIDR": 2, "CVE": 15 }, "indicator_count": 1689, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699e98024aa93957a620e117", "name": "Cellbrite Domain Irregularities", "description": "The domain displays a \"hardened\" posture typical of high-value targets, though some indicators suggest potential misconfigurations or recent shifts in ownership/management. The domain utilizes multiple clientProhibited flags (Transfer, Update, Delete). This is a \"Registry Lock\" equivalent, ensuring no changes can be made without out-of-band authentication.\n\nExpiration Discrepancy: * Domain Expiration: Feb 24, 2026. (yesterday)\n\nSSL Certificate Validity: April 2026.\nresearcher observations: It is highly irregular for a certificate to outlast the domain registration. This often points to a \"just-in-time\" renewal process or a domain that was recently recovered. Furthermore, the reliance on ParkLogic nameservers indicates a sophisticated approach to traffic routing, likely for load balancing or threat mitigation. Delegation signed: No - Expiration Yesterday (entered 1:32est 2/25/26)", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-25T06:34:42.619000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 431, "hostname": 1625, "FileHash-SHA1": 661, "FileHash-SHA256": 4617, "URL": 359, "FileHash-MD5": 635, "CVE": 43, "email": 22, "CIDR": 6 }, "indicator_count": 8399, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699fbc709300e0ad353443f8", "name": "SLIMWARE Simple Installer WIN 32 EXE", "description": "The full text of the full transcript of this year's EU Referendum, which will take place on 26 March 2017, has been published on Facebook and Twitter, with the hashtag \"proceeding\".", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-26T03:22:24.798000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 78, "FileHash-SHA1": 76, "FileHash-SHA256": 1466, "domain": 268, "hostname": 199, "URL": 193, "CVE": 23, "CIDR": 1, "email": 3 }, "indicator_count": 2307, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "", "TLP: AMBER" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [ "" ], "unique_indicators": 32765 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/mjiowe.com", "whois": "http://whois.domaintools.com/mjiowe.com", "domain": "mjiowe.com", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "69a02837827feb0b78fa3ad2", "name": "The Belasco Chain", "description": "The adversary delivers a masterclass in \"Regular Belasco\" stagecraft, utilizing authentic Adobe PIDs to construct a \"living library\" of legitimacy where mundane metadata like SOPHIA.json acts as Gatsby\u2019s \"real but uncut\" volumes to mask a hollowed-out interior. This is a triumph of performative evasion; while researchers marvel at the realism of the set-dressing, MSI50B8.tmp and MSI4F2F.tmp wait in the wings of the Windows\\Installer directory, invisible to the human eye and using NGEN hijacking to bake illicit scripts directly into the OS framework. By employing Cryptnet certificates as \"stage lighting\" to mask C2 handshakes, the malware doesn't just attend the system\u2019s party\u2014it rewrites the invitation to own the house. Unlike the tragic end at West Egg, this Belasco chain is a play that refuses to end; it simply resets the stage, ensuring the performance continues as long as the \"green light\" of the C2 remains active.", "modified": "2026-05-31T01:02:14", "created": "2026-02-26T11:02:15.932000", "tags": [ "file size", "mwdb", "bazaar", "sha3384", "ssdeep", "file type", "sha1", "sha256", "crc32", "filenames c" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2813, "FileHash-SHA1": 2576, "FileHash-SHA256": 8145, "domain": 1903, "hostname": 1502, "URL": 1359, "email": 46, "CVE": 54, "CIDR": 3, "YARA": 7, "JA3": 1, "IPv4": 11 }, "indicator_count": 18420, "is_author": false, "is_subscribing": null, "subscriber_count": 74, "modified_text": "6 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699bf39a4b96d1d4236cf91f", "name": "Suspicious PDF Analysis+Behavioral Summary", "description": "Analysis of network and process logs indicates an attempt to undermine the system\u2019s Root of Trust by manipulating certificate validation files. The attacker is likely using Man-in-the-Middle techniques to force the system to accept revoked or fraudulent certificates. Additionally, suspicious activity within Adobe processes suggests that software update mechanisms are being hijacked to execute malicious code. Immediate isolation is required to prevent the installation of unauthorized software or the interception of encrypted data.", "modified": "2026-05-15T17:51:27.499000", "created": "2026-02-23T06:28:42.282000", "tags": [ "" ], "references": [ "", "TLP: AMBER" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "" ], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 1892, "FileHash-SHA256": 9944, "FileHash-MD5": 1802, "URL": 225, "hostname": 445, "domain": 284, "CVE": 91, "SSLCertFingerprint": 2, "email": 14, "CIDR": 5 }, "indicator_count": 14704, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "15 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699969651d3b082f6b583fae", "name": "PDFKIT.net", "description": "Data Points. Search tall components CVE's for more info on this.", "modified": "2026-05-15T17:51:25.327000", "created": "2026-02-21T08:14:29.258000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 370, "hostname": 444, "FileHash-SHA1": 1292, "FileHash-SHA256": 4069, "URL": 192, "FileHash-MD5": 1255, "email": 16, "CVE": 58 }, "indicator_count": 7696, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "15 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699c3b796fcaed878ca94c5c", "name": "https://m.vzw.com/wIvzrd8", "description": "the wizard", "modified": "2026-04-18T05:30:18.690000", "created": "2026-02-23T11:35:21.673000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1818, "hostname": 575, "URL": 200, "FileHash-SHA1": 450, "CIDR": 11, "domain": 887, "email": 7, "FileHash-MD5": 402, "CVE": 21 }, "indicator_count": 4371, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "43 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699ffe2a0a48bdf23d11efb4", "name": "Cardconnect Ecosystem", "description": "The cardconnect.com infrastructure reveals a fragmented and high-risk network topology characterized by an atypical shift from Fastly edge delivery to Radware-Ukraine (AS30779) routing. While core transaction processing remains anchored within Fiserv (AS11121/AS39992) and status monitoring is partitioned to AWS, the persistent resolution of root and www traffic to Ukrainian IP space (176.100.165.28) creates a significant geolocation anomaly for a US financial entity. This volatility, coupled with orphaned NXDOMAIN records and inconsistent CNAME nesting (aliasing vendor-specific subdomains like idexx and frazer to centralized b2c/fts endpoints), suggests a non-unified deployment strategy that complicates the domain\u2019s security perimeter and increases its exposure to DNS-based interception.", "modified": "2026-04-13T23:46:24.779000", "created": "2026-02-26T08:02:50.501000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 301, "FileHash-SHA256": 198, "hostname": 1359, "URL": 229, "email": 8, "FileHash-SHA1": 49, "CIDR": 4, "FileHash-MD5": 11, "CVE": 2 }, "indicator_count": 2161, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "47 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6998deba4fb8e0ab5abd3b7e", "name": "Trojan Malware", "description": "A full report on the malware that infected the Windows operating system (Win32) from 1992 to 2018, as compiled by the University of South Africa, has been released by researchers at King's College London.", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-20T22:22:50.689000", "tags": [ "contacted", "date", "file score", "exploit", "ids detections", "tls handshake", "failure yara", "alerts", "labs pulses", "pulses", "sodinokibi", "ransomware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 32, "FileHash-MD5": 5, "FileHash-SHA1": 5, "FileHash-SHA256": 4, "domain": 48, "hostname": 34, "URL": 35, "email": 2 }, "indicator_count": 165, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699a4bf3e44c12a506ceef6c", "name": "\"Fake Time Stamp Responder\"", "description": "Fake TimeStamping Services CA, which uses time-stamping technology, is being investigated by the Department of Health, Social Security and the US National Security Agency (NSS) for fraud.", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-22T00:21:07.499000", "tags": [ "fake timestamp", "timestamping", "ca valid", "from", "usage ff", "algorithm", "thumbprint", "thumbprint md5", "serial number", "b0 dd" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "URL": 20, "CVE": 34, "hostname": 8, "domain": 13 }, "indicator_count": 81, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699a8339b9e516069852d3e2", "name": "Whitelist Shell", "description": "Data Point for Further Review", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-22T04:16:57.040000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 39, "FileHash-MD5": 2, "FileHash-SHA1": 2, "hostname": 194, "email": 6, "URL": 187, "domain": 263, "CVE": 30 }, "indicator_count": 723, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699da4b51b83807ed9e7442e", "name": "GKG.NET + Verizon Infrastructure- Potential Domain Compromise & Financial Fraud Campaign", "description": "Verizon Domain Resolves Here. Financial Concern: CCV checker v1.0 by kid1232.exe (14/72) is a specialized tool for validating stolen credit cards. Its presence is an interesting finding.\nInfrastructure Targeting: The files Master Domain Database (2).xlsx and Accredited-Registrars-202602220056.csv suggest the actor is collecting data on registrars to facilitate Supply Chain Attacks or large-scale domain thefts.\nActive Compromise: The PDF metrosanantonioliving.com DNS Zones and the FireShot screenshot of GKG's DNS configuration page are direct evidence of a \"live\" account takeover or unauthorized configuration of a victim's domain.\nThe Heavy Hitter: The Win32 EXE ending in ...13547c3 with 45/70 detections is likely the primary Infostealer or RAT used to harvest the credentials for these GKG accounts.", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-24T13:16:37.558000", "tags": [ "algorithm", "key identifier", "x509v3 subject", "v3 serial", "number", "cbe oglobalsign", "r6 alphassl", "validity", "subject public", "key info" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 356, "FileHash-SHA1": 126, "FileHash-SHA256": 615, "URL": 266, "hostname": 187, "FileHash-MD5": 108, "email": 14, "CIDR": 2, "CVE": 15 }, "indicator_count": 1689, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "699e98024aa93957a620e117", "name": "Cellbrite Domain Irregularities", "description": "The domain displays a \"hardened\" posture typical of high-value targets, though some indicators suggest potential misconfigurations or recent shifts in ownership/management. The domain utilizes multiple clientProhibited flags (Transfer, Update, Delete). This is a \"Registry Lock\" equivalent, ensuring no changes can be made without out-of-band authentication.\n\nExpiration Discrepancy: * Domain Expiration: Feb 24, 2026. (yesterday)\n\nSSL Certificate Validity: April 2026.\nresearcher observations: It is highly irregular for a certificate to outlast the domain registration. This often points to a \"just-in-time\" renewal process or a domain that was recently recovered. Furthermore, the reliance on ParkLogic nameservers indicates a sophisticated approach to traffic routing, likely for load balancing or threat mitigation. Delegation signed: No - Expiration Yesterday (entered 1:32est 2/25/26)", "modified": "2026-04-01T00:44:45.494000", "created": "2026-02-25T06:34:42.619000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 431, "hostname": 1625, "FileHash-SHA1": 661, "FileHash-SHA256": 4617, "URL": 359, "FileHash-MD5": 635, "CVE": 43, "email": 22, "CIDR": 6 }, "indicator_count": 8399, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "60 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://mjiowe.com/ed29d", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://mjiowe.com/ed29d", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780212883.031723 }