{ "type": "URL", "indicator": "https://monolot.email.cz", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://monolot.email.cz", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3534105969, "indicator": "https://monolot.email.cz", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "6570a7c9f6bf793f823e6398", "name": "Qakbot attacks. As strong as before?", "description": "", "modified": "2023-12-06T16:56:41.266000", "created": "2023-12-06T16:56:41.266000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "hostname": 1177, "FileHash-SHA256": 2150, "domain": 620, "URL": 3016, "FileHash-MD5": 519, "FileHash-SHA1": 292 }, "indicator_count": 7775, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570915d02969ef86a60ff54", "name": "remote-access.net - vt json upload", "description": "", "modified": "2023-12-06T15:21:01.697000", "created": "2023-12-06T15:21:01.697000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 513, "hostname": 563, "URL": 1961, "domain": 497, "FileHash-MD5": 44, "FileHash-SHA1": 37 }, "indicator_count": 3617, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "651e79f50ce42abe29702324", "name": "Qakbot attacks. As strong as before?", "description": "command and control\nRedlinestealer\nQakbot\nNoName057\nAzorult\nBlack Rat\nbrowser malware \nBanker\nTheft\nPhishing", "modified": "2023-11-04T07:02:32.756000", "created": "2023-10-05T08:55:16.736000", "tags": [ "blacklist https", "rstunf", "tad436770", "united", "anonymizer", "mail spammer", "malicious host", "cyber threat", "heur", "phishing", "malware", "team", "control server", "qakbot", "redline stealer", "malicious", "asyncrat", "cobalt strike", "download", "cisco umbrella", "site", "safe site", "malicious url", "paypal", "team phishing", "detection list", "blacklist", "azorult", "service", "runescape", "facebook", "bank", "alexa", "blacknet rat", "stealer", "noname057", "ip summary", "url summary", "summary", "sample", "samples", "attack", "tsara", "tsara brashears", "boeing", "apple id", "samsung", "telegrafix", "trellian", "dumping", "fiies shared", "browser malware", "cyber criminal", "cyber crime", "brashears", "hybrid", "analysis" ], "references": [], "public": 1, "adversary": "Qakbot", "targeted_countries": [ "United States of America", "Japan", "Argentina" ], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3016, "domain": 620, "hostname": 1177, "FileHash-MD5": 519, "FileHash-SHA1": 292, "FileHash-SHA256": 2150, "CVE": 1 }, "indicator_count": 7775, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "939 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1a715b26eb6e3ff58875", "name": "Qakbot attacks. As strong as before?", "description": "", "modified": "2023-11-04T07:02:32.756000", "created": "2023-10-30T02:52:33.136000", "tags": [ "blacklist https", "rstunf", "tad436770", "united", "anonymizer", "mail spammer", "malicious host", "cyber threat", "heur", "phishing", "malware", "team", "control server", "qakbot", "redline stealer", "malicious", "asyncrat", "cobalt strike", "download", "cisco umbrella", "site", "safe site", "malicious url", "paypal", "team phishing", "detection list", "blacklist", "azorult", "service", "runescape", "facebook", "bank", "alexa", "blacknet rat", "stealer", "noname057", "ip summary", "url summary", "summary", "sample", "samples", "attack", "tsara", "tsara brashears", "boeing", "apple id", "samsung", "telegrafix", "trellian", "dumping", "fiies shared", "browser malware", "cyber criminal", "cyber crime", "brashears", "hybrid", "analysis" ], "references": [], "public": 1, "adversary": "Qakbot", "targeted_countries": [ "United States of America", "Japan", "Argentina" ], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": "651e79f50ce42abe29702324", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3016, "domain": 620, "hostname": 1177, "FileHash-MD5": 519, "FileHash-SHA1": 292, "FileHash-SHA256": 2150, "CVE": 1 }, "indicator_count": 7775, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "939 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62f681740f9fa7e4b25cd98a", "name": "remote-access.net - vt json upload", "description": "", "modified": "2022-09-11T00:00:26.117000", "created": "2022-08-12T16:36:04.710000", "tags": [], "references": [ "g8a0e6480d5734a2491b0cc048c08e6c68fd49eb0721a43f49e7686a1006f9a0b.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1961, "hostname": 563, "FileHash-SHA256": 513, "domain": 497, "CVE": 2, "FileHash-MD5": 44, "FileHash-SHA1": 37 }, "indicator_count": 3617, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1359 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "g8a0e6480d5734a2491b0cc048c08e6c68fd49eb0721a43f49e7686a1006f9a0b.json" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Qakbot" ], "malware_families": [], "industries": [], "unique_indicators": 11460 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/email.cz", "whois": "http://whois.domaintools.com/email.cz", "domain": "email.cz", "hostname": "monolot.email.cz" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "6570a7c9f6bf793f823e6398", "name": "Qakbot attacks. As strong as before?", "description": "", "modified": "2023-12-06T16:56:41.266000", "created": "2023-12-06T16:56:41.266000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "hostname": 1177, "FileHash-SHA256": 2150, "domain": 620, "URL": 3016, "FileHash-MD5": 519, "FileHash-SHA1": 292 }, "indicator_count": 7775, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570915d02969ef86a60ff54", "name": "remote-access.net - vt json upload", "description": "", "modified": "2023-12-06T15:21:01.697000", "created": "2023-12-06T15:21:01.697000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 513, "hostname": 563, "URL": 1961, "domain": 497, "FileHash-MD5": 44, "FileHash-SHA1": 37 }, "indicator_count": 3617, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "651e79f50ce42abe29702324", "name": "Qakbot attacks. As strong as before?", "description": "command and control\nRedlinestealer\nQakbot\nNoName057\nAzorult\nBlack Rat\nbrowser malware \nBanker\nTheft\nPhishing", "modified": "2023-11-04T07:02:32.756000", "created": "2023-10-05T08:55:16.736000", "tags": [ "blacklist https", "rstunf", "tad436770", "united", "anonymizer", "mail spammer", "malicious host", "cyber threat", "heur", "phishing", "malware", "team", "control server", "qakbot", "redline stealer", "malicious", "asyncrat", "cobalt strike", "download", "cisco umbrella", "site", "safe site", "malicious url", "paypal", "team phishing", "detection list", "blacklist", "azorult", "service", "runescape", "facebook", "bank", "alexa", "blacknet rat", "stealer", "noname057", "ip summary", "url summary", "summary", "sample", "samples", "attack", "tsara", "tsara brashears", "boeing", "apple id", "samsung", "telegrafix", "trellian", "dumping", "fiies shared", "browser malware", "cyber criminal", "cyber crime", "brashears", "hybrid", "analysis" ], "references": [], "public": 1, "adversary": "Qakbot", "targeted_countries": [ "United States of America", "Japan", "Argentina" ], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 30, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3016, "domain": 620, "hostname": 1177, "FileHash-MD5": 519, "FileHash-SHA1": 292, "FileHash-SHA256": 2150, "CVE": 1 }, "indicator_count": 7775, "is_author": false, "is_subscribing": null, "subscriber_count": 231, "modified_text": "939 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "653f1a715b26eb6e3ff58875", "name": "Qakbot attacks. As strong as before?", "description": "", "modified": "2023-11-04T07:02:32.756000", "created": "2023-10-30T02:52:33.136000", "tags": [ "blacklist https", "rstunf", "tad436770", "united", "anonymizer", "mail spammer", "malicious host", "cyber threat", "heur", "phishing", "malware", "team", "control server", "qakbot", "redline stealer", "malicious", "asyncrat", "cobalt strike", "download", "cisco umbrella", "site", "safe site", "malicious url", "paypal", "team phishing", "detection list", "blacklist", "azorult", "service", "runescape", "facebook", "bank", "alexa", "blacknet rat", "stealer", "noname057", "ip summary", "url summary", "summary", "sample", "samples", "attack", "tsara", "tsara brashears", "boeing", "apple id", "samsung", "telegrafix", "trellian", "dumping", "fiies shared", "browser malware", "cyber criminal", "cyber crime", "brashears", "hybrid", "analysis" ], "references": [], "public": 1, "adversary": "Qakbot", "targeted_countries": [ "United States of America", "Japan", "Argentina" ], "malware_families": [], "attack_ids": [ { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": "651e79f50ce42abe29702324", "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3016, "domain": 620, "hostname": 1177, "FileHash-MD5": 519, "FileHash-SHA1": 292, "FileHash-SHA256": 2150, "CVE": 1 }, "indicator_count": 7775, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "939 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62f681740f9fa7e4b25cd98a", "name": "remote-access.net - vt json upload", "description": "", "modified": "2022-09-11T00:00:26.117000", "created": "2022-08-12T16:36:04.710000", "tags": [], "references": [ "g8a0e6480d5734a2491b0cc048c08e6c68fd49eb0721a43f49e7686a1006f9a0b.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1961, "hostname": 563, "FileHash-SHA256": 513, "domain": 497, "CVE": 2, "FileHash-MD5": 44, "FileHash-SHA1": 37 }, "indicator_count": 3617, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1359 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://monolot.email.cz", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://monolot.email.cz", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780278523.2062147 }