{
  "type": "URL",
  "indicator": "https://ppy.ddns-ip.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ppy.ddns-ip.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4165838838,
      "indicator": "https://ppy.ddns-ip.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "694d7d426afd8c1c816ddb9e",
          "name": "Apple \u2022 IRS | ELF:DDoS |\tUnix.Trojan.Gafgyt redirects and blocks US taxpayers from making payments to IRS",
          "description": "This truly requires further research. This is a serious issue. There is are US adversaries blocking fiscally financial taxpayers from paying genie income taxes, threatening a levy, and other financially damaging consequences. It\u2019s clear to me the website is fraudulent. One target is an Apple user and an accountant. \n\n\nThere have been millions on financial crimes against this victim who I am now labeling a \u2018target\u2019. There are 4 other females\u2019 going through same thing. Losing assets, unable to reconcile taxes despite",
          "modified": "2026-01-24T17:05:40.719000",
          "created": "2025-12-25T18:06:58.222000",
          "tags": [
            "united",
            "et trojan",
            "hello ssl",
            "whitelisted",
            "unknown",
            "ciphersuite",
            "sessionid",
            "asnone",
            "united kingdom",
            "show",
            "write",
            "virustotal",
            "drweb",
            "vipre",
            "mcafee",
            "panda",
            "malware",
            "pandex!gen1",
            "et",
            "aaaa",
            "present sep",
            "gmt secure",
            "passive dns",
            "urls",
            "gmt cache",
            "service",
            "title",
            "brazil as16625",
            "akamai",
            "top source",
            "tcp include",
            "top destination",
            "source source",
            "destination",
            "port",
            "gtmkv978zl",
            "utc gzy6fm95cs5",
            "utc na",
            "utc google",
            "analytics na",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "access att",
            "bad traffic",
            "et info",
            "tls handshake",
            "failure",
            "windir",
            "openurl c",
            "prefetch2",
            "dns requests",
            "domain address",
            "poland unknown",
            "ip address",
            "search",
            "present oct",
            "a domains",
            "body head",
            "document moved",
            "unique",
            "maxage86400",
            "httponly",
            "google safe",
            "browsing",
            "whois",
            "virustotal api",
            "screenshots",
            "comments",
            "pragma",
            "data upload",
            "extraction",
            "type",
            "extr",
            "delete c",
            "writeconsolew",
            "windows",
            "t1045",
            "read c",
            "susp",
            "dock",
            "win64",
            "alerts",
            "icmp traffic",
            "pdb path",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "lumen",
            "lumen ip",
            "public bgp",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity lpl141",
            "handle",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "status",
            "showing",
            "domain",
            "trojan",
            "trojandropper",
            "next associated",
            "fastly error",
            "please",
            "sea p",
            "mozilla",
            "accept",
            "ipv4 add",
            "files",
            "location united",
            "america flag",
            "america asn",
            "nethandle",
            "net4",
            "net40000",
            "lpl141",
            "llc orgid",
            "city",
            "la postalcode",
            "dynamicloader",
            "write c",
            "medium",
            "named pipe",
            "yara rule",
            "high",
            "ms windows",
            "encrypt",
            "pegasus",
            "markus",
            "smartassembly",
            "next",
            "msie",
            "t1063",
            "windows nt",
            "fastly",
            "foundry",
            "palantir",
            "bgp",
            "webkit bugzilla",
            "record value",
            "content type",
            "bugzilla",
            "meta",
            "present nov",
            "entries",
            "atom",
            "apple",
            "chrome",
            "moved",
            "apple center",
            "gmt content",
            "name servers",
            "servers",
            "expiration date",
            "pulse submit",
            "url analysis",
            "date",
            "apple server",
            "apple dns",
            "asp.bet",
            "data collection",
            "bgp ip",
            "lumen control",
            "lumen admin",
            "level 3",
            "ipv4",
            "reverse dns",
            "found",
            "hostname add",
            "present jul",
            "present jun",
            "belize",
            "unknown ns",
            "present aug",
            "domain add",
            "creation date",
            "failed",
            "enter sc",
            "extra data",
            "include",
            "review exclude",
            "america united",
            "dns resolutions",
            "linuxgafgyt feb"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "United Kingdom of Great Britain and Northern Ireland",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Pandex!gen1",
              "display_name": "Pandex!gen1",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Lumen IP",
              "display_name": "Lumen IP",
              "target": null
            },
            {
              "id": "Win.Malware.Msilperseus-6989564-0",
              "display_name": "Win.Malware.Msilperseus-6989564-0",
              "target": null
            },
            {
              "id": "Unknown Malware \u2018Can't access file\u2019",
              "display_name": "Unknown Malware \u2018Can't access file\u2019",
              "target": null
            },
            {
              "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
              "target": null
            },
            {
              "id": "Win.Trojan.Fenomengame-8",
              "display_name": "Win.Trojan.Fenomengame-8",
              "target": null
            },
            {
              "id": "ALF:JASYP:Trojan:Win3",
              "display_name": "ALF:JASYP:Trojan:Win3",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Muldrop",
              "display_name": "TrojanDropper:Win32/Muldrop",
              "target": "/malware/TrojanDropper:Win32/Muldrop"
            },
            {
              "id": "Appleservice",
              "display_name": "Appleservice",
              "target": null
            },
            {
              "id": "ELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0",
              "display_name": "ELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Mirai Sim Swap",
              "display_name": "Mirai Sim Swap",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            }
          ],
          "industries": [
            "Government",
            "Finance",
            "Telecommunications",
            "Technology",
            "Civil Society",
            "IRS"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4187,
            "hostname": 1574,
            "FileHash-SHA256": 2387,
            "FileHash-MD5": 189,
            "FileHash-SHA1": 161,
            "domain": 800,
            "CVE": 1,
            "email": 13,
            "CIDR": 1,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9317,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "85 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6946fdbb4a22dc28d60d6ca2",
          "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
          "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
          "modified": "2026-01-19T19:04:41.997000",
          "created": "2025-12-20T19:49:15.713000",
          "tags": [
            "doomscroller",
            "browsehappy",
            "xpirat",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "united",
            "tlsv1",
            "execution",
            "dock",
            "write",
            "persistence",
            "encrypt",
            "meta",
            "browse happy",
            "worry",
            "body doctype",
            "online",
            "gmt server",
            "a domains",
            "ipv4 add",
            "win32",
            "trojandropper",
            "title",
            "date",
            "unknown",
            "post http",
            "cryptexportkey",
            "cryptgenkey",
            "calgrc4",
            "expiro",
            "temple",
            "xserver",
            "adversaries",
            "worry wordpress"
          ],
          "references": [
            "Xpirat = doomscroller.io"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Xpirat",
              "display_name": "Xpirat",
              "target": null
            },
            {
              "id": "Expiro",
              "display_name": "Expiro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            },
            {
              "id": "T1423",
              "name": "Network Service Scanning",
              "display_name": "T1423 - Network Service Scanning"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 5576,
            "domain": 1502,
            "FileHash-MD5": 116,
            "FileHash-SHA1": 73,
            "FileHash-SHA256": 1041,
            "SSLCertFingerprint": 1,
            "hostname": 1951
          },
          "indicator_count": 10260,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "89 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Xpirat = doomscroller.io"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Expiro",
            "Mirai sim swap",
            "Lumen ip",
            "Appleservice",
            "Unknown malware \u2018can't access file\u2019",
            "Elf:ddos-s\\ [trj]\t\tunix.trojan.gafgyt-6981154-0",
            "Et",
            "Alf:jasyp:trojan:win3",
            "Win.trojan.fenomengame-8",
            "Mirai",
            "Alf:jasyp:trojan:win32/ircbot!atmn",
            "Win.malware.msilperseus-6989564-0",
            "Xpirat",
            "Pandex!gen1",
            "Trojandropper:win32/muldrop"
          ],
          "industries": [
            "Civil society",
            "Telecommunications",
            "Technology",
            "Irs",
            "Finance",
            "Government"
          ],
          "unique_indicators": 19862
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ddns-ip.net",
    "whois": "http://whois.domaintools.com/ddns-ip.net",
    "domain": "ddns-ip.net",
    "hostname": "ppy.ddns-ip.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "694d7d426afd8c1c816ddb9e",
      "name": "Apple \u2022 IRS | ELF:DDoS |\tUnix.Trojan.Gafgyt redirects and blocks US taxpayers from making payments to IRS",
      "description": "This truly requires further research. This is a serious issue. There is are US adversaries blocking fiscally financial taxpayers from paying genie income taxes, threatening a levy, and other financially damaging consequences. It\u2019s clear to me the website is fraudulent. One target is an Apple user and an accountant. \n\n\nThere have been millions on financial crimes against this victim who I am now labeling a \u2018target\u2019. There are 4 other females\u2019 going through same thing. Losing assets, unable to reconcile taxes despite",
      "modified": "2026-01-24T17:05:40.719000",
      "created": "2025-12-25T18:06:58.222000",
      "tags": [
        "united",
        "et trojan",
        "hello ssl",
        "whitelisted",
        "unknown",
        "ciphersuite",
        "sessionid",
        "asnone",
        "united kingdom",
        "show",
        "write",
        "virustotal",
        "drweb",
        "vipre",
        "mcafee",
        "panda",
        "malware",
        "pandex!gen1",
        "et",
        "aaaa",
        "present sep",
        "gmt secure",
        "passive dns",
        "urls",
        "gmt cache",
        "service",
        "title",
        "brazil as16625",
        "akamai",
        "top source",
        "tcp include",
        "top destination",
        "source source",
        "destination",
        "port",
        "gtmkv978zl",
        "utc gzy6fm95cs5",
        "utc na",
        "utc google",
        "analytics na",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "access att",
        "bad traffic",
        "et info",
        "tls handshake",
        "failure",
        "windir",
        "openurl c",
        "prefetch2",
        "dns requests",
        "domain address",
        "poland unknown",
        "ip address",
        "search",
        "present oct",
        "a domains",
        "body head",
        "document moved",
        "unique",
        "maxage86400",
        "httponly",
        "google safe",
        "browsing",
        "whois",
        "virustotal api",
        "screenshots",
        "comments",
        "pragma",
        "data upload",
        "extraction",
        "type",
        "extr",
        "delete c",
        "writeconsolew",
        "windows",
        "t1045",
        "read c",
        "susp",
        "dock",
        "win64",
        "alerts",
        "icmp traffic",
        "pdb path",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "lumen",
        "lumen ip",
        "public bgp",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity lpl141",
        "handle",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "status",
        "showing",
        "domain",
        "trojan",
        "trojandropper",
        "next associated",
        "fastly error",
        "please",
        "sea p",
        "mozilla",
        "accept",
        "ipv4 add",
        "files",
        "location united",
        "america flag",
        "america asn",
        "nethandle",
        "net4",
        "net40000",
        "lpl141",
        "llc orgid",
        "city",
        "la postalcode",
        "dynamicloader",
        "write c",
        "medium",
        "named pipe",
        "yara rule",
        "high",
        "ms windows",
        "encrypt",
        "pegasus",
        "markus",
        "smartassembly",
        "next",
        "msie",
        "t1063",
        "windows nt",
        "fastly",
        "foundry",
        "palantir",
        "bgp",
        "webkit bugzilla",
        "record value",
        "content type",
        "bugzilla",
        "meta",
        "present nov",
        "entries",
        "atom",
        "apple",
        "chrome",
        "moved",
        "apple center",
        "gmt content",
        "name servers",
        "servers",
        "expiration date",
        "pulse submit",
        "url analysis",
        "date",
        "apple server",
        "apple dns",
        "asp.bet",
        "data collection",
        "bgp ip",
        "lumen control",
        "lumen admin",
        "level 3",
        "ipv4",
        "reverse dns",
        "found",
        "hostname add",
        "present jul",
        "present jun",
        "belize",
        "unknown ns",
        "present aug",
        "domain add",
        "creation date",
        "failed",
        "enter sc",
        "extra data",
        "include",
        "review exclude",
        "america united",
        "dns resolutions",
        "linuxgafgyt feb"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "United Kingdom of Great Britain and Northern Ireland",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Pandex!gen1",
          "display_name": "Pandex!gen1",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Lumen IP",
          "display_name": "Lumen IP",
          "target": null
        },
        {
          "id": "Win.Malware.Msilperseus-6989564-0",
          "display_name": "Win.Malware.Msilperseus-6989564-0",
          "target": null
        },
        {
          "id": "Unknown Malware \u2018Can't access file\u2019",
          "display_name": "Unknown Malware \u2018Can't access file\u2019",
          "target": null
        },
        {
          "id": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "display_name": "ALF:JASYP:Trojan:Win32/IRCbot!atmn",
          "target": null
        },
        {
          "id": "Win.Trojan.Fenomengame-8",
          "display_name": "Win.Trojan.Fenomengame-8",
          "target": null
        },
        {
          "id": "ALF:JASYP:Trojan:Win3",
          "display_name": "ALF:JASYP:Trojan:Win3",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Muldrop",
          "display_name": "TrojanDropper:Win32/Muldrop",
          "target": "/malware/TrojanDropper:Win32/Muldrop"
        },
        {
          "id": "Appleservice",
          "display_name": "Appleservice",
          "target": null
        },
        {
          "id": "ELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0",
          "display_name": "ELF:DDoS-S\\ [Trj]\t\tUnix.Trojan.Gafgyt-6981154-0",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Mirai Sim Swap",
          "display_name": "Mirai Sim Swap",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        }
      ],
      "industries": [
        "Government",
        "Finance",
        "Telecommunications",
        "Technology",
        "Civil Society",
        "IRS"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4187,
        "hostname": 1574,
        "FileHash-SHA256": 2387,
        "FileHash-MD5": 189,
        "FileHash-SHA1": 161,
        "domain": 800,
        "CVE": 1,
        "email": 13,
        "CIDR": 1,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9317,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "85 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6946fdbb4a22dc28d60d6ca2",
      "name": "Expiro - DoomScroller \u2022 BrowseHappy | Part 2",
      "description": "Pulse: \u00c2\u00a31.1bn.io.com, a search engine for the most popular websites on the planet, is now available on Facebook, Twitter, Instagram and YouTube.",
      "modified": "2026-01-19T19:04:41.997000",
      "created": "2025-12-20T19:49:15.713000",
      "tags": [
        "doomscroller",
        "browsehappy",
        "xpirat",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "united",
        "tlsv1",
        "execution",
        "dock",
        "write",
        "persistence",
        "encrypt",
        "meta",
        "browse happy",
        "worry",
        "body doctype",
        "online",
        "gmt server",
        "a domains",
        "ipv4 add",
        "win32",
        "trojandropper",
        "title",
        "date",
        "unknown",
        "post http",
        "cryptexportkey",
        "cryptgenkey",
        "calgrc4",
        "expiro",
        "temple",
        "xserver",
        "adversaries",
        "worry wordpress"
      ],
      "references": [
        "Xpirat = doomscroller.io"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Xpirat",
          "display_name": "Xpirat",
          "target": null
        },
        {
          "id": "Expiro",
          "display_name": "Expiro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        },
        {
          "id": "T1423",
          "name": "Network Service Scanning",
          "display_name": "T1423 - Network Service Scanning"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 5576,
        "domain": 1502,
        "FileHash-MD5": 116,
        "FileHash-SHA1": 73,
        "FileHash-SHA256": 1041,
        "SSLCertFingerprint": 1,
        "hostname": 1951
      },
      "indicator_count": 10260,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "89 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ppy.ddns-ip.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ppy.ddns-ip.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776618593.038972
}