{
  "type": "URL",
  "indicator": "https://notepad-plus-plus.org/favicon.ico",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://notepad-plus-plus.org/favicon.ico",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "whitelist",
        "message": "Whitelisted domain notepad-plus-plus.org",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain notepad-plus-plus.org",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3658403347,
      "indicator": "https://notepad-plus-plus.org/favicon.ico",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69c1bd40f81db45dc044697c",
          "name": "Masterkey Clone By CallmeDoris",
          "description": "",
          "modified": "2026-03-23T22:22:56.940000",
          "created": "2026-03-23T22:22:56.940000",
          "tags": [
            "dropped file",
            "chromeua",
            "runtime data",
            "drmedgeua",
            "edgeua",
            "generator",
            "win64",
            "null",
            "template",
            "unknown",
            "critical",
            "addressbar",
            "desktop",
            "dark",
            "light",
            "iframe",
            "cookie",
            "meta",
            "body",
            "legend",
            "dwis",
            "core",
            "tear",
            "malicious",
            "mozilla",
            "strings",
            "qakbot",
            "://masterkey.com.ua/download/MKClientSetup.exe"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "642db7b656049e54b2f71c20",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 949,
            "URL": 5642,
            "CVE": 2,
            "domain": 509,
            "FileHash-SHA256": 293,
            "FileHash-MD5": 550,
            "FileHash-SHA1": 60,
            "email": 5
          },
          "indicator_count": 8010,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "28 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709a384e3e8573cf5ecac4",
          "name": "v2 - kopat electronic door security  with hybrid scan data",
          "description": "",
          "modified": "2023-12-06T15:58:48.938000",
          "created": "2023-12-06T15:58:48.938000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1569,
            "URL": 3824,
            "email": 8,
            "domain": 290,
            "hostname": 189,
            "FileHash-MD5": 576,
            "FileHash-SHA1": 52
          },
          "indicator_count": 6508,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "645932281e34157197d4cbe4",
          "name": "v2 - kopat electronic door security  with hybrid scan data",
          "description": "",
          "modified": "2023-05-08T17:32:24.648000",
          "created": "2023-05-08T17:32:24.648000",
          "tags": [
            "dropped file",
            "null",
            "varchar",
            "gecko",
            "pcap",
            "pcap processing",
            "win64",
            "khtml",
            "span",
            "cookie",
            "path",
            "mozi",
            "roboto",
            "class",
            "mozilla",
            "body",
            "form",
            "window",
            "accept",
            "meta",
            "iframe",
            "contact",
            "4629",
            "trim",
            "embed",
            "dwis",
            "test",
            "tear",
            "qakbot",
            "tecv",
            "1inb",
            "a3ob",
            "u9p10dkhttps",
            "windir",
            "openurl c",
            "l10dkhttps",
            "charset",
            "w6t2hm",
            "is6bi"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3824,
            "hostname": 189,
            "domain": 290,
            "FileHash-SHA256": 1569,
            "email": 8,
            "IPv4": 27,
            "FileHash-MD5": 576,
            "FileHash-SHA1": 52
          },
          "indicator_count": 6535,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 95,
          "modified_text": "1078 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "642db7b656049e54b2f71c20",
          "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100",
          "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness",
          "modified": "2023-05-05T16:00:23.366000",
          "created": "2023-04-05T18:02:30.403000",
          "tags": [
            "dropped file",
            "chromeua",
            "runtime data",
            "drmedgeua",
            "edgeua",
            "generator",
            "win64",
            "null",
            "template",
            "unknown",
            "critical",
            "addressbar",
            "desktop",
            "dark",
            "light",
            "iframe",
            "cookie",
            "meta",
            "body",
            "legend",
            "dwis",
            "core",
            "tear",
            "malicious",
            "mozilla",
            "strings",
            "qakbot",
            "://masterkey.com.ua/download/MKClientSetup.exe"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 949,
            "URL": 5642,
            "CVE": 2,
            "domain": 509,
            "FileHash-SHA256": 293,
            "FileHash-MD5": 550,
            "FileHash-SHA1": 60,
            "email": 5
          },
          "indicator_count": 8010,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "1081 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d",
        "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 10976
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/notepad-plus-plus.org",
    "whois": "http://whois.domaintools.com/notepad-plus-plus.org",
    "domain": "notepad-plus-plus.org",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69c1bd40f81db45dc044697c",
      "name": "Masterkey Clone By CallmeDoris",
      "description": "",
      "modified": "2026-03-23T22:22:56.940000",
      "created": "2026-03-23T22:22:56.940000",
      "tags": [
        "dropped file",
        "chromeua",
        "runtime data",
        "drmedgeua",
        "edgeua",
        "generator",
        "win64",
        "null",
        "template",
        "unknown",
        "critical",
        "addressbar",
        "desktop",
        "dark",
        "light",
        "iframe",
        "cookie",
        "meta",
        "body",
        "legend",
        "dwis",
        "core",
        "tear",
        "malicious",
        "mozilla",
        "strings",
        "qakbot",
        "://masterkey.com.ua/download/MKClientSetup.exe"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "642db7b656049e54b2f71c20",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 949,
        "URL": 5642,
        "CVE": 2,
        "domain": 509,
        "FileHash-SHA256": 293,
        "FileHash-MD5": 550,
        "FileHash-SHA1": 60,
        "email": 5
      },
      "indicator_count": 8010,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "28 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709a384e3e8573cf5ecac4",
      "name": "v2 - kopat electronic door security  with hybrid scan data",
      "description": "",
      "modified": "2023-12-06T15:58:48.938000",
      "created": "2023-12-06T15:58:48.938000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1569,
        "URL": 3824,
        "email": 8,
        "domain": 290,
        "hostname": 189,
        "FileHash-MD5": 576,
        "FileHash-SHA1": 52
      },
      "indicator_count": 6508,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "866 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "645932281e34157197d4cbe4",
      "name": "v2 - kopat electronic door security  with hybrid scan data",
      "description": "",
      "modified": "2023-05-08T17:32:24.648000",
      "created": "2023-05-08T17:32:24.648000",
      "tags": [
        "dropped file",
        "null",
        "varchar",
        "gecko",
        "pcap",
        "pcap processing",
        "win64",
        "khtml",
        "span",
        "cookie",
        "path",
        "mozi",
        "roboto",
        "class",
        "mozilla",
        "body",
        "form",
        "window",
        "accept",
        "meta",
        "iframe",
        "contact",
        "4629",
        "trim",
        "embed",
        "dwis",
        "test",
        "tear",
        "qakbot",
        "tecv",
        "1inb",
        "a3ob",
        "u9p10dkhttps",
        "windir",
        "openurl c",
        "l10dkhttps",
        "charset",
        "w6t2hm",
        "is6bi"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/5ea6b6bdf0a82359f7f73c6095b6c8891be485234e5544ef18a000136617a1b6/645767842cd19c9c560f0381"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3824,
        "hostname": 189,
        "domain": 290,
        "FileHash-SHA256": 1569,
        "email": 8,
        "IPv4": 27,
        "FileHash-MD5": 576,
        "FileHash-SHA1": 52
      },
      "indicator_count": 6535,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 95,
      "modified_text": "1078 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "642db7b656049e54b2f71c20",
      "name": "masterkey.com.ua/download/MKClientSetup.exe - hybrid 100/100",
      "description": "The entire \"Ad\" eco system is compromised via all main channels , ie google, bing, msn etc utilising many top level domains and brands, its truly the biggest suppky chain attack ever known. So enormously thats its unbelievable and I guess many peeps just cant see it because its simply to overwhelming to consider a reality p plus many perhaps cant digest the advanced use of AI and self repairing neural networks along that are designed to work on standard default configs. its not till you step out of the defaults that you start to see nefariousness",
      "modified": "2023-05-05T16:00:23.366000",
      "created": "2023-04-05T18:02:30.403000",
      "tags": [
        "dropped file",
        "chromeua",
        "runtime data",
        "drmedgeua",
        "edgeua",
        "generator",
        "win64",
        "null",
        "template",
        "unknown",
        "critical",
        "addressbar",
        "desktop",
        "dark",
        "light",
        "iframe",
        "cookie",
        "meta",
        "body",
        "legend",
        "dwis",
        "core",
        "tear",
        "malicious",
        "mozilla",
        "strings",
        "qakbot",
        "://masterkey.com.ua/download/MKClientSetup.exe"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/41859e0b198fbe88772ef12c577023c0481ec19867e410bab335e67fea87c1bb/642ca80cde2048242a0e097d"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 949,
        "URL": 5642,
        "CVE": 2,
        "domain": 509,
        "FileHash-SHA256": 293,
        "FileHash-MD5": 550,
        "FileHash-SHA1": 60,
        "email": 5
      },
      "indicator_count": 8010,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "1081 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://notepad-plus-plus.org/favicon.ico",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://notepad-plus-plus.org/favicon.ico",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776745431.324055
}