{ "type": "URL", "indicator": "https://paste.ee/d/DtTkc6OX/0", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://paste.ee/d/DtTkc6OX/0", "type": "url", "type_title": "URL", "validation": [ { "source": "whitelist", "message": "Whitelisted domain paste.ee", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4068899295, "indicator": "https://paste.ee/d/DtTkc6OX/0", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "683202092d4ff2099430b6d3", "name": "urlhaus 30days", "description": "", "modified": "2026-02-09T00:11:12.303000", "created": "2025-05-24T17:29:45.368000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 61, "FileHash-SHA1": 4, "FileHash-SHA256": 31, "URL": 28057, "domain": 435, "hostname": 423 }, "indicator_count": 29011, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "113 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68a585f6fe22e6b98e61d01a", "name": "DarkCloud", "description": "", "modified": "2025-09-19T08:01:01.648000", "created": "2025-08-20T08:23:18.831000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 121, "FileHash-MD5": 22, "FileHash-SHA1": 21, "FileHash-SHA256": 194, "domain": 9, "hostname": 16 }, "indicator_count": 383, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "255 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6827dad4b77a6e572c18884f", "name": "URLHaus data - 16-05-2025", "description": "", "modified": "2025-06-16T00:01:51.438000", "created": "2025-05-17T00:39:48.027000", "tags": [ "SocGholish", "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ascii", "base64-loader", "Encoded", "decoy", "PDF", "sh", "hta", "xworm", "rat", "RemcosRAT", "powershell", "ps1", "rev-base64-loader", "doc", "Formbook", "AgentTesla", "hajime", "wget-ua", "gafgyt", "LummaStealer", "ua-wget", "opendir", "CoinMiner", "exe", "GuLoader", "encrypted", "GOBackdoor", "GhostSocks", "RedLineStealer", "js", "NetSupport", "censys", "apk", "BankMellat", "GossRAT", "IRATA", "Mellat.apk", "WsgiDAV", "AmosStealer", "botnetdomain", "moobot", "DarkVisionRAT", "botnet", "dropper", "CobaltStrike", "backdoor", "sshdkit" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 72, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 948, "hostname": 7, "domain": 22 }, "indicator_count": 977, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "351 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 41796 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/paste.ee", "whois": "http://whois.domaintools.com/paste.ee", "domain": "paste.ee", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "683202092d4ff2099430b6d3", "name": "urlhaus 30days", "description": "", "modified": "2026-02-09T00:11:12.303000", "created": "2025-05-24T17:29:45.368000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 61, "FileHash-SHA1": 4, "FileHash-SHA256": 31, "URL": 28057, "domain": 435, "hostname": 423 }, "indicator_count": 29011, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "113 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68a585f6fe22e6b98e61d01a", "name": "DarkCloud", "description": "", "modified": "2025-09-19T08:01:01.648000", "created": "2025-08-20T08:23:18.831000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 121, "FileHash-MD5": 22, "FileHash-SHA1": 21, "FileHash-SHA256": 194, "domain": 9, "hostname": 16 }, "indicator_count": 383, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "255 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6827dad4b77a6e572c18884f", "name": "URLHaus data - 16-05-2025", "description": "", "modified": "2025-06-16T00:01:51.438000", "created": "2025-05-17T00:39:48.027000", "tags": [ "SocGholish", "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ascii", "base64-loader", "Encoded", "decoy", "PDF", "sh", "hta", "xworm", "rat", "RemcosRAT", "powershell", "ps1", "rev-base64-loader", "doc", "Formbook", "AgentTesla", "hajime", "wget-ua", "gafgyt", "LummaStealer", "ua-wget", "opendir", "CoinMiner", "exe", "GuLoader", "encrypted", "GOBackdoor", "GhostSocks", "RedLineStealer", "js", "NetSupport", "censys", "apk", "BankMellat", "GossRAT", "IRATA", "Mellat.apk", "WsgiDAV", "AmosStealer", "botnetdomain", "moobot", "DarkVisionRAT", "botnet", "dropper", "CobaltStrike", "backdoor", "sshdkit" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 72, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 948, "hostname": 7, "domain": 22 }, "indicator_count": 977, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "351 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://paste.ee/d/DtTkc6OX/0", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://paste.ee/d/DtTkc6OX/0", "type": "URL", "found": true, "verdict": "malicious", "url_status": "offline", "threat": "malware_download", "tags": [ "ascii", "powershell", "ps1", "rat", "RemcosRAT" ], "date_added": "2025-05-16", "last_online": "2025-05-16", "reporter": "abuse_ch", "host": "paste.ee", "payloads": [ { "filename": "0", "file_type": "txt", "md5": "e56a9c69a902f3e882c14390ec7e024b", "sha256": "66c1daab07f7cccb0685c4dc69802ea122ed22c7122708917938adc8fa4da016", "signature": null, "first_seen": "2025-05-16" } ], "error": null }, "from_cache": true, "_cached_at": 1780373581.2145336 }