{ "type": "URL", "indicator": "https://paste.ee/d/1QtpX", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://paste.ee/d/1QtpX", "type": "url", "type_title": "URL", "validation": [ { "source": "whitelist", "message": "Whitelisted domain paste.ee", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4009955461, "indicator": "https://paste.ee/d/1QtpX", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "672f70d470cdbab07d3bdb8f", "name": "URLHaus Recent URLs", "description": "", "modified": "2025-05-15T13:30:30.738000", "created": "2024-11-09T14:25:24.551000", "tags": [], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 313720 }, "indicator_count": 313720, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "380 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6753914772db45d10cac9064", "name": "URLHaus data - 06-12-2024", "description": "", "modified": "2025-01-06T23:11:01.995000", "created": "2024-12-07T00:05:27.047000", "tags": [ "32-bit", "arm", "elf", "Mozi", "mips", "mirai", "SocGholish", "sh", "ua-wget", "ddos", "ascii", "rat", "opendir", "AgentTesla", "exe", "xml-opendir", "fake alert pdf", "Amos", "dmg", "macOS", "redir-302", "us-safari", "ua-safari", "AsyncRAT", "lnk", "PythonStealer", "LummaStealer", "dcrat", "Neshta", "Ahmyth", "apk", "c2", "L3mon", "Manager", "gafgyt", "ConnectBack", "CoinMiner", "pyinstaller", "BillGates", "emotet", "heodo", "tedy", "shellscript", "Braodo", "jjjdnmaaf", "stealer", "malxmr", "rekoobe", "Vidar", "Formbook", "mimikatz", "Stealc", "MeduzaStealer", "Amadey", "meterpreter", "Socks5Systemz", "Loki", "Metasploit", "lokibot", "hajime", "PureLogStealer", "donutloader", "Mellat.apk", "meduza", "njRAT", "rev-base64-loader", "trojan", "invokerbot", "powershell", "pyspy", "monero", "turtleloader", "kmsactivator", "Valyria", "php", "webshell", "backdoor", "shellbot", "discordrat", "htaloader", "bitbucket", "remcos", "paste.ee", "Encoded", "base64-loader", "VenomRAT", "discordapp", "lunastealer", "BlankGrabber", "BABADEDA", "BankMellat", "geo", "GossRAT", "IRATA", "IRN", "pw-1", "zip", "smsspy", "boxter", "alfa-team", "ps", "cloudflare", "reverseshell", "base64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 80, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 18, "domain": 17 }, "indicator_count": 1035, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 313207 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/paste.ee", "whois": "http://whois.domaintools.com/paste.ee", "domain": "paste.ee", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "672f70d470cdbab07d3bdb8f", "name": "URLHaus Recent URLs", "description": "", "modified": "2025-05-15T13:30:30.738000", "created": "2024-11-09T14:25:24.551000", "tags": [], "references": [ "https://urlhaus.abuse.ch/downloads/csv_recent/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ameermane", "id": "77501", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 313720 }, "indicator_count": 313720, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "380 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6753914772db45d10cac9064", "name": "URLHaus data - 06-12-2024", "description": "", "modified": "2025-01-06T23:11:01.995000", "created": "2024-12-07T00:05:27.047000", "tags": [ "32-bit", "arm", "elf", "Mozi", "mips", "mirai", "SocGholish", "sh", "ua-wget", "ddos", "ascii", "rat", "opendir", "AgentTesla", "exe", "xml-opendir", "fake alert pdf", "Amos", "dmg", "macOS", "redir-302", "us-safari", "ua-safari", "AsyncRAT", "lnk", "PythonStealer", "LummaStealer", "dcrat", "Neshta", "Ahmyth", "apk", "c2", "L3mon", "Manager", "gafgyt", "ConnectBack", "CoinMiner", "pyinstaller", "BillGates", "emotet", "heodo", "tedy", "shellscript", "Braodo", "jjjdnmaaf", "stealer", "malxmr", "rekoobe", "Vidar", "Formbook", "mimikatz", "Stealc", "MeduzaStealer", "Amadey", "meterpreter", "Socks5Systemz", "Loki", "Metasploit", "lokibot", "hajime", "PureLogStealer", "donutloader", "Mellat.apk", "meduza", "njRAT", "rev-base64-loader", "trojan", "invokerbot", "powershell", "pyspy", "monero", "turtleloader", "kmsactivator", "Valyria", "php", "webshell", "backdoor", "shellbot", "discordrat", "htaloader", "bitbucket", "remcos", "paste.ee", "Encoded", "base64-loader", "VenomRAT", "discordapp", "lunastealer", "BlankGrabber", "BABADEDA", "BankMellat", "geo", "GossRAT", "IRATA", "IRN", "pw-1", "zip", "smsspy", "boxter", "alfa-team", "ps", "cloudflare", "reverseshell", "base64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 80, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 18, "domain": 17 }, "indicator_count": 1035, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://paste.ee/d/1QtpX", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://paste.ee/d/1QtpX", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "paste.ee" ], "date_added": "2024-12-06", "last_online": "2024-12-06", "reporter": "abus3reports", "host": "paste.ee", "payloads": [ { "filename": null, "file_type": "txt", "md5": "988e5d25fad110e97be3a8dc9cd74d9b", "sha256": "e54165d4fee26efaa7b0d721836404b415d503f3d6fb61a89c564507164e48d6", "signature": null, "first_seen": "2024-12-06" } ], "error": null }, "from_cache": true, "_cached_at": 1780233942.679888 }