{
  "type": "URL",
  "indicator": "https://protectorapp.online/adspect-file.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://protectorapp.online/adspect-file.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4151637132,
      "indicator": "https://protectorapp.online/adspect-file.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6916aa77dacfe4a69f394336",
          "name": "EbeeNov2025 Pt3",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2025-12-20T21:02:55.026000",
          "created": "2025-11-14T04:05:11.738000",
          "tags": [
            "filehashmd5",
            "filehashsha1",
            "filehashsha256"
          ],
          "references": [
            "Nov.Week2.csv"
          ],
          "public": 1,
          "adversary": "SmudgedSerpent, Sneaky Malware, XLoader, DragonForce, NGATE Android Malware, Phatom Raven, TA4428",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 4,
            "FileHash-MD5": 157,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 131,
            "URL": 117,
            "domain": 263,
            "hostname": 18,
            "email": 1
          },
          "indicator_count": 791,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 39,
          "modified_text": "163 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "691e2a1b39d5c5c5a8db2f5e",
          "name": "npm Malware Campaign Uses Adspect Cloaking to Deliver Malicious Redirects",
          "description": "A recent malware campaign targeting npm packages has been identified, utilizing a technique known as Adspect cloaking to deliver malicious redirects. Several malicious npm packages\u2014specifically named dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830\u2014contain a 39 kB malicious payload. The differences among these packages primarily pertain to their Adspect configurations and the URLs they reference.\n\nUpon a visitor's interaction with a compromised webpage, the malware collects various data points about the user, including IP address, device and browser information, locale, referrer, host, browsing content, and the time of the request. This information is then transmitted to the Adspect API via a proxy endpoint identified in the code (notably elements including \"adspect-proxy\"), allowing the threat actor to build detailed fingerprints of potential victims.",
          "modified": "2025-11-19T20:35:39.017000",
          "created": "2025-11-19T20:35:39.017000",
          "tags": [
            "fake webpage"
          ],
          "references": [
            "https://socket.dev/blog/npm-malware-campaign-uses-adspect-cloaking-to-deliver-malicious-redirects"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7,
            "domain": 3,
            "hostname": 1
          },
          "indicator_count": 11,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 541,
          "modified_text": "194 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://socket.dev/blog/npm-malware-campaign-uses-adspect-cloaking-to-deliver-malicious-redirects",
        "Nov.Week2.csv"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "SmudgedSerpent, Sneaky Malware, XLoader, DragonForce, NGATE Android Malware, Phatom Raven, TA4428"
          ],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 886
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/protectorapp.online",
    "whois": "http://whois.domaintools.com/protectorapp.online",
    "domain": "protectorapp.online",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6916aa77dacfe4a69f394336",
      "name": "EbeeNov2025 Pt3",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2025-12-20T21:02:55.026000",
      "created": "2025-11-14T04:05:11.738000",
      "tags": [
        "filehashmd5",
        "filehashsha1",
        "filehashsha256"
      ],
      "references": [
        "Nov.Week2.csv"
      ],
      "public": 1,
      "adversary": "SmudgedSerpent, Sneaky Malware, XLoader, DragonForce, NGATE Android Malware, Phatom Raven, TA4428",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 4,
        "FileHash-MD5": 157,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 131,
        "URL": 117,
        "domain": 263,
        "hostname": 18,
        "email": 1
      },
      "indicator_count": 791,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 39,
      "modified_text": "163 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "691e2a1b39d5c5c5a8db2f5e",
      "name": "npm Malware Campaign Uses Adspect Cloaking to Deliver Malicious Redirects",
      "description": "A recent malware campaign targeting npm packages has been identified, utilizing a technique known as Adspect cloaking to deliver malicious redirects. Several malicious npm packages\u2014specifically named dsidospsodlks, applicationooks21, application-phskck, integrator-filescrypt2025, integrator-2829, and integrator-2830\u2014contain a 39 kB malicious payload. The differences among these packages primarily pertain to their Adspect configurations and the URLs they reference.\n\nUpon a visitor's interaction with a compromised webpage, the malware collects various data points about the user, including IP address, device and browser information, locale, referrer, host, browsing content, and the time of the request. This information is then transmitted to the Adspect API via a proxy endpoint identified in the code (notably elements including \"adspect-proxy\"), allowing the threat actor to build detailed fingerprints of potential victims.",
      "modified": "2025-11-19T20:35:39.017000",
      "created": "2025-11-19T20:35:39.017000",
      "tags": [
        "fake webpage"
      ],
      "references": [
        "https://socket.dev/blog/npm-malware-campaign-uses-adspect-cloaking-to-deliver-malicious-redirects"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7,
        "domain": 3,
        "hostname": 1
      },
      "indicator_count": 11,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 541,
      "modified_text": "194 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://protectorapp.online/adspect-file.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://protectorapp.online/adspect-file.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780373247.4168253
}