{ "type": "URL", "indicator": "https://ponintnykqwm.shop/api", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ponintnykqwm.shop/api", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3949131723, "indicator": "https://ponintnykqwm.shop/api", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 15, "pulses": [ { "id": "69fd7b60289b73182e9a159c", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:52.129000", "created": "2026-05-08T05:57:52.129000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ed982a2ed94c12f67", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:50.241000", "created": "2026-05-08T05:57:50.241000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5d484b29482fbe4cc2", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:49.464000", "created": "2026-05-08T05:57:49.464000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ab51dd45774eac47b", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:46.054000", "created": "2026-05-08T05:57:46.054000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58e8a0903393ffdd7a", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.720000", "created": "2026-05-08T05:57:44.720000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58b4b5d410557d3c34", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.086000", "created": "2026-05-08T05:57:44.086000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3a63bbd9f424b1cbe0", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:14.484000", "created": "2026-05-08T05:57:14.484000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3888a42bcf91770459", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:12.538000", "created": "2026-05-08T05:57:12.538000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b354f93bc9aed606930", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.991000", "created": "2026-05-08T05:57:09.991000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b35900d81ffc451da66", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.372000", "created": "2026-05-08T05:57:09.372000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b341c333a37e7a73ff2", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:08.912000", "created": "2026-05-08T05:57:08.912000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b332f6ea864283eef95", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:07.336000", "created": "2026-05-08T05:57:07.336000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "662e0a50715909a2ce36d1d5", "name": "Jeroen Gui lists (https://file.jeroengui.be)", "description": "A pulse fed with lists taken from https://file.jeroengui.be . I am not him. Visit his website jeroengui.be", "modified": "2025-09-21T05:30:59.802000", "created": "2024-04-28T08:35:28.934000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1089, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tomtomalien", "id": "258713", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_258713/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 161, "modified_text": "252 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f9aeff2d03baeab048999c", "name": "ACTIVIDAD MALICIOSA | Relacionada con Lumma Stealer 29-09-2024", "description": "Lumma Stealer es un tipo de software malicioso dise\u00f1ado para robar informaci\u00f3n confidencial de los dispositivos infectados. Este malware se infiltra en los sistemas y extrae datos personales, como nombres de usuario, contrase\u00f1as, informaci\u00f3n bancaria y detalles de tarjetas de cr\u00e9dito. LummaStealer puede afectar varias cuentas, incluidas redes sociales, correos electr\u00f3nicos y monederos de criptomonedas. Los delincuentes pueden usar la informaci\u00f3n robada para chantaje, suplantaci\u00f3n de identidad, y realizar transacciones fraudulentas, lo que puede causar serios problemas de privacidad y p\u00e9rdidas econ\u00f3micas significativas para las v\u00edctimas.", "modified": "2024-10-29T19:03:15.889000", "created": "2024-09-29T19:48:15.170000", "tags": [ "access", "discovery", "ta0001 initial", "t1003 data", "local system", "t1033 system", "t1057 process", "t1082 system", "t1087 account" ], "references": [ "https://www.virustotal.com/graph/embed/g7d7074ccf4734ca7b2f24ee7f2c4b7c6a06b0a63e14c4010b93967adb2fae722?theme=light", "https://darfe.es/ciberwiki/index.php?title=Lumma", "https://www.alertasyseguridad.net/repositorio-ioc/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "esoporteingenieria2020", "id": "121604", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_121604/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 242, "FileHash-MD5": 6, "FileHash-SHA1": 6, "FileHash-SHA256": 6, "domain": 262 }, "indicator_count": 522, "is_author": false, "is_subscribing": null, "subscriber_count": 269, "modified_text": "579 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66dc92a9d4b3777935101506", "name": "Bilalkhanicom", "description": "According to profile on Sinisterly : Date of Birth: 08-08-1994", "modified": "2024-10-07T00:01:17.424000", "created": "2024-09-07T17:51:37.399000", "tags": [ "onlyfans", "osint", "79017473945" ], "references": [ "https://otx.alienvault.com/pulse/66dacf5908285fb712140ae3", "https://m.facebook.com/story.php/?story_fbid=871427598419035&id=100066554077374", "https://www.reddit.com/user/bilalkhanicom/", "https://gist.github.com/bilalkhanicom", "https://github.com/userbesty/img", "https://www.joesandbox.com/analysis/1498574/0/iochtml", "https://www.facebook.com/iSecDad/photos/i-analyzed-a-domainurl-caffegclasiqwpshop-related-to-lumma-stealer-and-here-is-w/871449548416840/", "https://community.emergingthreats.net/t/metastealer-v-5-tls", "https://www.modifiedapk.com/about-us/", "https://sonicmenuwithprices.us/", "https://starbuckmenusprice.com/", "https://firehousesubsmenuprice.com", "https://www.linkedin.com/posts/garettm_remote-employees-work-longer-and-harder-activity-7089230941591646208-YxzA", "https://www.virustotal.com/graph/ga0b0a090b5b1476bbcd32d5c5656ab7d45e0caba73bf4fe5a2acea9ef06e789c", "https://www.flickr.com/photos/188857522@N05/", "https://www.thegeometryspot.net/contact-us/", "https://sinister.ly/User-bilalkhanicom", "https://www.tiktokmodapk.com/contact-us/", "", "https://web.archive.org/web/20170506152209/https://plus.google.com/106280489128042886215", "https://m.facebook.com/story.php/?story_fbid=1070578713849464&id=549343275193013", "https://t.me/adrikadi", "https://web.archive.org/web/20190824062945/https://www.blogger.com/profile/02522833090080869297", "https://web.archive.org/web/20161202024732/http://lobatandawgs.com/index.php?do=feedback", "https://www.virustotal.com/gui/file/ebd70bd74476885d5e86a5abc8652f6e10c53eebceb41269e7e007e294f3ef19/details" ], "public": 1, "adversary": "Bilalkhanicom", "targeted_countries": [], "malware_families": [ { "id": "Lummac stealer", "display_name": "Lummac stealer", "target": null }, { "id": "MetaStealer", "display_name": "MetaStealer", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 1, "FileHash-SHA256": 22, "domain": 1, "URL": 4, "email": 1 }, "indicator_count": 31, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "601 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "", "https://otx.alienvault.com/pulse/66dacf5908285fb712140ae3", "https://www.reddit.com/user/bilalkhanicom/", "https://www.virustotal.com/gui/file/ebd70bd74476885d5e86a5abc8652f6e10c53eebceb41269e7e007e294f3ef19/details", "https://web.archive.org/web/20190824062945/https://www.blogger.com/profile/02522833090080869297", "https://www.flickr.com/photos/188857522@N05/", "https://darfe.es/ciberwiki/index.php?title=Lumma", "https://m.facebook.com/story.php/?story_fbid=871427598419035&id=100066554077374", "https://www.virustotal.com/graph/ga0b0a090b5b1476bbcd32d5c5656ab7d45e0caba73bf4fe5a2acea9ef06e789c", "https://www.thegeometryspot.net/contact-us/", "https://www.modifiedapk.com/about-us/", "https://web.archive.org/web/20170506152209/https://plus.google.com/106280489128042886215", "https://t.me/adrikadi", "https://www.facebook.com/iSecDad/photos/i-analyzed-a-domainurl-caffegclasiqwpshop-related-to-lumma-stealer-and-here-is-w/871449548416840/", "https://www.alertasyseguridad.net/repositorio-ioc/", "https://sinister.ly/User-bilalkhanicom", "https://www.virustotal.com/graph/embed/g7d7074ccf4734ca7b2f24ee7f2c4b7c6a06b0a63e14c4010b93967adb2fae722?theme=light", "https://sonicmenuwithprices.us/", "https://firehousesubsmenuprice.com", "https://www.tiktokmodapk.com/contact-us/", "https://github.com/userbesty/img", "https://web.archive.org/web/20161202024732/http://lobatandawgs.com/index.php?do=feedback", "https://m.facebook.com/story.php/?story_fbid=1070578713849464&id=549343275193013", "https://starbuckmenusprice.com/", "https://www.joesandbox.com/analysis/1498574/0/iochtml", "https://community.emergingthreats.net/t/metastealer-v-5-tls", "https://gist.github.com/bilalkhanicom", "https://www.linkedin.com/posts/garettm_remote-employees-work-longer-and-harder-activity-7089230941591646208-YxzA" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Bilalkhanicom", "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell" ], "malware_families": [ "Lumma stealer", "Lummac stealer", "Metastealer" ], "industries": [], "unique_indicators": 895914 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/ponintnykqwm.shop", "whois": "http://whois.domaintools.com/ponintnykqwm.shop", "domain": "ponintnykqwm.shop", "hostname": "Unavailable" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 15, "pulses": [ { "id": "69fd7b60289b73182e9a159c", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:52.129000", "created": "2026-05-08T05:57:52.129000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ed982a2ed94c12f67", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:50.241000", "created": "2026-05-08T05:57:50.241000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5d484b29482fbe4cc2", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:49.464000", "created": "2026-05-08T05:57:49.464000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b5ab51dd45774eac47b", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:46.054000", "created": "2026-05-08T05:57:46.054000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58e8a0903393ffdd7a", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.720000", "created": "2026-05-08T05:57:44.720000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b58b4b5d410557d3c34", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:44.086000", "created": "2026-05-08T05:57:44.086000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3a63bbd9f424b1cbe0", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:14.484000", "created": "2026-05-08T05:57:14.484000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b3888a42bcf91770459", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:12.538000", "created": "2026-05-08T05:57:12.538000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b354f93bc9aed606930", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.991000", "created": "2026-05-08T05:57:09.991000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69fd7b35900d81ffc451da66", "name": "Credit tomtomalien -2years ago - [Jeroen Gui lists (https://file.jeroengui.be) CREATED 2 YEARS AGO]", "description": "", "modified": "2026-05-08T05:57:09.372000", "created": "2026-05-08T05:57:09.372000", "tags": [ "phishing", "jeroengui", "jeroen", "gui", "malware", "web", "shell", "scam", "malicious" ], "references": [], "public": 1, "adversary": "phishing ; jeroengui ; jeroen ; gui ; malware ; web ; shell", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "662e0a50715909a2ce36d1d5", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "URL": 905612 }, "indicator_count": 905613, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ponintnykqwm.shop/api", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ponintnykqwm.shop/api", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780255726.7934306 }