{ "type": "URL", "indicator": "https://s.gmx.dk/...", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://s.gmx.dk/...", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3407587993, "indicator": "https://s.gmx.dk/...", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "68d877d6231fc1cbe1792ee1", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:38.895000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d877e28416d81633bae1ad", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:50.976000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6261cdbea0bb54792ef9ac53", "name": "1and1.com - malware hosting and creation", "description": "Promise.com, or Promise.js, is a new type of word, and here is the full text of its first-ever translation:-a-word, a-d.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T21:33:50.899000", "tags": [ "noclickid", "error", "aborted", "xmlhttprequest", "typeof e", "cx bus", "genesys telecom", "labs", "promise", "lnull", "typeof t", "date", "typeof", "typeof define", "installtrigger", "weakset", "sfunction", "uk tv", "regexp", "custom code", "typeerror", "sufeffxa0", "typeof symbol", "azaz09", "library loaded", "page top", "path", "query string", "customevent", "afunction", "string", "pfunction", "mfunction", "dfunction", "march", "typeof o", "null", "stackframe", "object", "function", "array", "definition", "rhino", "factory", "isnumber", "plugin", "chrome pdf", "rejected", "target", "event", "started", "engaged", "trident", "internal", "parseint", "growheight", "cdata", "this", "system", "named", "invalid hex3", "invalid hex6", "uinguserid", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "vui", "anda", "tente", "outubro", "trackingclient", "srpanj", "rabu", "vasaris", "copyright", "closure library", "window", "value", "image", "800px", "40px", "i18n", "blockedemail", "typeof i18n", "hubspot", "captcha", "please", "april", "august", "close", "february", "june", "form", "klik", "click", "next", "blank", "este", "rserver", "mais", "void", "number", "uint8array", "fnumber", "xhfunction", "yhfunction", "aw10804098076", "code", "qe", "aw428360528", "aw10816288188", "aw10814683072" ], "references": [ "xfe-URL-Ionos.de-stix2-2.1-export.json", "xfe-URL-1and1.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=AW-10814683072&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-10816288188&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-476125975&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-428360528&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-10804098076&l=dataLayer&cx=c", "https://js-na1.hs-scripts.com/8230984.js", "https://js.hsleadflows.net/leadflows.js", "https://cdn.taboola.com/libtrc/unip/1123688/tfa.js", "https://pagead2.googlesyndication.com/pagead/js/r20220419/r20110914/elements/html/omrhp.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://amplify.outbrain.com/cp/obtp.js", "https://uir.uimserv.net/sid/", "https://apps.mypurecloud.de/journey/sdk/js/web/v1/ac.js", "https://www.ionos.com/modules/frontend-applications-common/script/components/stacktrace.js", "https://www.ionos.com/modules/hosting-common/script/privacy/bundle.js", "https://cdn.ionos.com/nk/9c2134ba72b4/6c2bd2fdffdc/launch-67fb473cc73f.min.js", "https://cdn.ionos.de/nk/9c2134ba72b4/6c2bd2fdffdc/0ced1406e60f/RC5068cb5aadbc4ec1a9aa72b8a74193e0-source.min.js", "https://unpkg.com/web-vitals@1.0.1/dist/web-vitals.umd.js", "https://apps.mypurecloud.de/widgets/9.0/cxbus.min.js", "https://tr.outbrain.com/cachedClickId?marketerId=001649abe8bf7b4d6841e1cae4cb770f72" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "UK TV", "display_name": "UK TV", "target": null }, { "id": "Vui", "display_name": "Vui", "target": null }, { "id": "Outubro", "display_name": "Outubro", "target": null }, { "id": "Tente", "display_name": "Tente", "target": null }, { "id": "Anda", "display_name": "Anda", "target": null }, { "id": "Vasaris", "display_name": "Vasaris", "target": null }, { "id": "Rabu", "display_name": "Rabu", "target": null }, { "id": "Srpanj", "display_name": "Srpanj", "target": null }, { "id": "TrackingClient", "display_name": "TrackingClient", "target": null }, { "id": "Qe", "display_name": "Qe", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3592, "FileHash-SHA256": 402, "hostname": 1610, "domain": 553, "CVE": 1, "FileHash-MD5": 1 }, "indicator_count": 6159, "is_author": false, "is_subscribing": null, "subscriber_count": 72, "modified_text": "1430 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623e282be492aa3d2c19223a", "name": "EvanTurk.com", "description": "", "modified": "2022-04-24T00:01:15.470000", "created": "2022-03-25T20:38:03.947000", "tags": [ "redacted for", "server", "privacy tech", "privacy admin", "date", "email", "registrar abuse", "registrar", "ionos se", "country", "code" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1089, "hostname": 409, "FileHash-SHA256": 51, "domain": 562, "email": 2 }, "indicator_count": 2113, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "https://cdn.ionos.de/nk/9c2134ba72b4/6c2bd2fdffdc/0ced1406e60f/RC5068cb5aadbc4ec1a9aa72b8a74193e0-source.min.js", "https://cdn.taboola.com/libtrc/unip/1123688/tfa.js", "https://apps.mypurecloud.de/journey/sdk/js/web/v1/ac.js", "https://uir.uimserv.net/sid/", "https://www.googletagmanager.com/gtag/js?id=AW-476125975&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-10804098076&l=dataLayer&cx=c", "https://www.ionos.com/modules/hosting-common/script/privacy/bundle.js", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "DiabloFans ClapBack: Google. Com", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "https://unpkg.com/web-vitals@1.0.1/dist/web-vitals.umd.js", "https://cdn.ionos.com/nk/9c2134ba72b4/6c2bd2fdffdc/launch-67fb473cc73f.min.js", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)", "xfe-URL-Ionos.de-stix2-2.1-export.json", "https://tr.outbrain.com/cachedClickId?marketerId=001649abe8bf7b4d6841e1cae4cb770f72", "https://js-na1.hs-scripts.com/8230984.js", "https://www.googletagmanager.com/gtag/js?id=AW-10816288188&l=dataLayer&cx=c", "https://amplify.outbrain.com/cp/obtp.js", "https://apps.mypurecloud.de/widgets/9.0/cxbus.min.js", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://pagead2.googlesyndication.com/pagead/js/r20220419/r20110914/elements/html/omrhp.js", "https://js.hsleadflows.net/leadflows.js", "https://www.googletagmanager.com/gtag/js?id=AW-10814683072&l=dataLayer&cx=c", "xfe-URL-1and1.com-stix2-2.1-export.json", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "https://www.ionos.com/modules/frontend-applications-common/script/components/stacktrace.js", "https://www.googletagmanager.com/gtag/js?id=AW-428360528&l=dataLayer&cx=c", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Tente", "Srpanj", "Vui", "Win.virus.polyransom-5704625-0", "Outubro", "Rabu", "Qe", "Tofsee", "Uk tv", "Trackingclient", "Vasaris", "Win.packer.pkr_ce1a-9980177-0", "Virus.virlock/nabucur", "Anda", "Trojan:win32/vflooder", "Unix.dropper.mirai-7135870-0" ], "industries": [], "unique_indicators": 13444 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/gmx.dk", "whois": "http://whois.domaintools.com/gmx.dk", "domain": "gmx.dk", "hostname": "s.gmx.dk" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "68d877d6231fc1cbe1792ee1", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:38.895000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68d877e28416d81633bae1ad", "name": "PolyRansom attack through malicious actor on threat platforms", "description": "Virlock , PolyRansom and multiple other attacks through malicious actor using social engineering tactics. Has a rigged platform. Goal -\n to gain complete command and control of users in great platforms. Has infected at least a single device.\n#domainrobot #socialengineeeing #Tofsee\n#Trojan:Win32/Vflooder\n#Unix.Dropper.Mirai-7135870-0\n#Virus.Virlock/Nabucur\n#Win.Packer.pkr_ce1a-9980177-0\n#Win.Virus.PolyRansom", "modified": "2025-10-27T22:02:25.163000", "created": "2025-09-27T23:48:50.976000", "tags": [ "iocs", "indicator role", "write c", "intel", "ms windows", "medium", "pe32", "delete", "ids detections", "yara detections", "write", "malware", "delete c", "windows", "high", "port", "encrypt", "tofsee", "stream", "passive dns", "http", "ip address", "related nids", "files location", "united states", "united", "win32", "trojan", "mtb may", "twitter", "hellspawn", "worm", "title", "emails", "servers", "get http", "dns resolutions", "http traffic", "command", "control ta0011", "protocol t1071", "match info", "t1573 severity", "info", "request", "windows nt", "win64", "khtml", "gecko", "response", "present sep", "aaaa", "resolved ips", "ip traffic", "displayname", "yara rule", "loaderid", "name servers", "urls", "domain robot", "mail", "moved", "media gmbh", "info file", "network dropped", "duration cuckoo", "version file", "machine label", "manager", "shutdown", "host", "generic http", "exe upload", "inbound", "outbound", "markus", "certificate", "record value", "object", "path", "server", "registrar abuse", "contact email", "contact phone", "registrar iana", "registrar url", "diablo", "gandi sas", "gandi", "diablo attacks", "bluemind", "alberta", "domain add", "asn as16625", "akamai", "less whois", "registrar", "metrobytmobile", "t mobile", "metro", "present jul", "present jun", "present aug", "germany unknown", "germany", "invalid url", "ipv4 add", "frankfurt", "main", "no entries", "entrust", "hostname add", "files loading", "mimic", "first address", "medium attempts", "process", "explorer", "windows startup", "kuwiqsma", "match medium", "medium installs", "installs", "t regdword", "user", "ntcreatefile", "filehandle", "createfilew", "getfilesize", "blpdqe", "jjqcpluanwwhg", "u0012", "desiredaccess", "keyhandle", "ntopenkeyex", "u001aw", "u0018", "read", "next", "tags none", "file type", "date september", "am size", "imphash pehash", "richhash", "south korea", "taiwan as3462", "as21928", "china as4134", "as4766 korea", "china as4837", "as9318 sk", "as701 verizon", "verizon", "tcp syn", "infectednight", "resolverror", "tref neutral", "ck technique", "technique id", "tofsee high", "overview whois", "pulses", "tags", "related tags", "more external", "resources whois", "urlvoid", "tavao.exe", "learn", "ck id", "name tactics", "suspicious", "informative", "adversaries", "defense evasion", "spawns", "access att", "ascii text", "pattern match", "mitre att", "size", "meta", "null", "error", "click", "roboto", "hybrid", "general", "local", "starfield", "strings", "refresh", "tools", "onload", "span", "iframe", "found", "t1480 execution", "backdoor", "a domains", "russia", "next associated", "link", "windir", "interesting", "show technique", "ck matrix", "network traffic", "t1071", "t1057", "lowfi", "gameforprofits", "game att", "night got", "job done infected" ], "references": [ "DiabloFans ClapBack: Google. Com", "Crowdsourced IDS: ET HUNTING Terse Unencrypted Request for Google - Likely Connectivity Check Rule Match", "CS\u2019d IDS: ET HUNTING SUSPICIOUS Possible automated connectivity check (www.google.com) Rule Match", "Crowdsourced IDS: Matches rule SURICATA HTTP missing Host header", "Crowdsourced IDS: Unique rule identifier: This rule belongs to a private collection", "MetrobyT-mobile", "UA Alberta | Somehow I don\u2019t think this is part of a match but rather an attack. Mimic", "Unix.Dropper.Mirai inc. 100.181.126.203 \u2022 United States\tAS21928 t-mobile usa inc.", "Unix.Dropper.Mirai inc. 1 Korea Telecom 1.107.218.24 \u2022 South Korea\tAS4766", "Unix.Dropper.Mirai inc. 1 Telstra Corporation Ltd 1.125.165.62 \u2022 Australia AS1221 Telstra", "Unix.Dropper.Mirai inc. 1 Verizon : 100.10.95.119 United States \u2022 AS701 Verizon", "Sigma: Matches rule System File Execution Location Anomaly by Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali (Nextron Systems)" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Tofsee", "display_name": "Tofsee", "target": null }, { "id": "Win.Packer.pkr_ce1a-9980177-0", "display_name": "Win.Packer.pkr_ce1a-9980177-0", "target": null }, { "id": "Trojan:Win32/Vflooder", "display_name": "Trojan:Win32/Vflooder", "target": "/malware/Trojan:Win32/Vflooder" }, { "id": "Virus.Virlock/Nabucur", "display_name": "Virus.Virlock/Nabucur", "target": null }, { "id": "Win.Virus.PolyRansom-5704625-0", "display_name": "Win.Virus.PolyRansom-5704625-0", "target": null }, { "id": "Unix.Dropper.Mirai-7135870-0", "display_name": "Unix.Dropper.Mirai-7135870-0", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1202", "name": "Indirect Command Execution", "display_name": "T1202 - Indirect Command Execution" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1548", "name": "Abuse Elevation Control Mechanism", "display_name": "T1548 - Abuse Elevation Control Mechanism" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1480", "name": "Execution Guardrails", "display_name": "T1480 - Execution Guardrails" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1568", "name": "Dynamic Resolution", "display_name": "T1568 - Dynamic Resolution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 450, "FileHash-SHA1": 435, "FileHash-SHA256": 2092, "URL": 646, "domain": 593, "SSLCertFingerprint": 9, "hostname": 657, "email": 13 }, "indicator_count": 4895, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "174 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6261cdbea0bb54792ef9ac53", "name": "1and1.com - malware hosting and creation", "description": "Promise.com, or Promise.js, is a new type of word, and here is the full text of its first-ever translation:-a-word, a-d.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T21:33:50.899000", "tags": [ "noclickid", "error", "aborted", "xmlhttprequest", "typeof e", "cx bus", "genesys telecom", "labs", "promise", "lnull", "typeof t", "date", "typeof", "typeof define", "installtrigger", "weakset", "sfunction", "uk tv", "regexp", "custom code", "typeerror", "sufeffxa0", "typeof symbol", "azaz09", "library loaded", "page top", "path", "query string", "customevent", "afunction", "string", "pfunction", "mfunction", "dfunction", "march", "typeof o", "null", "stackframe", "object", "function", "array", "definition", "rhino", "factory", "isnumber", "plugin", "chrome pdf", "rejected", "target", "event", "started", "engaged", "trident", "internal", "parseint", "growheight", "cdata", "this", "system", "named", "invalid hex3", "invalid hex6", "uinguserid", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "vui", "anda", "tente", "outubro", "trackingclient", "srpanj", "rabu", "vasaris", "copyright", "closure library", "window", "value", "image", "800px", "40px", "i18n", "blockedemail", "typeof i18n", "hubspot", "captcha", "please", "april", "august", "close", "february", "june", "form", "klik", "click", "next", "blank", "este", "rserver", "mais", "void", "number", "uint8array", "fnumber", "xhfunction", "yhfunction", "aw10804098076", "code", "qe", "aw428360528", "aw10816288188", "aw10814683072" ], "references": [ "xfe-URL-Ionos.de-stix2-2.1-export.json", "xfe-URL-1and1.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=AW-10814683072&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-10816288188&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-476125975&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-428360528&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=AW-10804098076&l=dataLayer&cx=c", "https://js-na1.hs-scripts.com/8230984.js", "https://js.hsleadflows.net/leadflows.js", "https://cdn.taboola.com/libtrc/unip/1123688/tfa.js", "https://pagead2.googlesyndication.com/pagead/js/r20220419/r20110914/elements/html/omrhp.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://amplify.outbrain.com/cp/obtp.js", "https://uir.uimserv.net/sid/", "https://apps.mypurecloud.de/journey/sdk/js/web/v1/ac.js", "https://www.ionos.com/modules/frontend-applications-common/script/components/stacktrace.js", "https://www.ionos.com/modules/hosting-common/script/privacy/bundle.js", "https://cdn.ionos.com/nk/9c2134ba72b4/6c2bd2fdffdc/launch-67fb473cc73f.min.js", "https://cdn.ionos.de/nk/9c2134ba72b4/6c2bd2fdffdc/0ced1406e60f/RC5068cb5aadbc4ec1a9aa72b8a74193e0-source.min.js", "https://unpkg.com/web-vitals@1.0.1/dist/web-vitals.umd.js", "https://apps.mypurecloud.de/widgets/9.0/cxbus.min.js", "https://tr.outbrain.com/cachedClickId?marketerId=001649abe8bf7b4d6841e1cae4cb770f72" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "UK TV", "display_name": "UK TV", "target": null }, { "id": "Vui", "display_name": "Vui", "target": null }, { "id": "Outubro", "display_name": "Outubro", "target": null }, { "id": "Tente", "display_name": "Tente", "target": null }, { "id": "Anda", "display_name": "Anda", "target": null }, { "id": "Vasaris", "display_name": "Vasaris", "target": null }, { "id": "Rabu", "display_name": "Rabu", "target": null }, { "id": "Srpanj", "display_name": "Srpanj", "target": null }, { "id": "TrackingClient", "display_name": "TrackingClient", "target": null }, { "id": "Qe", "display_name": "Qe", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3592, "FileHash-SHA256": 402, "hostname": 1610, "domain": 553, "CVE": 1, "FileHash-MD5": 1 }, "indicator_count": 6159, "is_author": false, "is_subscribing": null, "subscriber_count": 72, "modified_text": "1430 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623e282be492aa3d2c19223a", "name": "EvanTurk.com", "description": "", "modified": "2022-04-24T00:01:15.470000", "created": "2022-03-25T20:38:03.947000", "tags": [ "redacted for", "server", "privacy tech", "privacy admin", "date", "email", "registrar abuse", "registrar", "ionos se", "country", "code" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1089, "hostname": 409, "FileHash-SHA256": 51, "domain": 562, "email": 2 }, "indicator_count": 2113, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1457 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "type": "URL", "indicator": "https://s.gmx.dk/...", "stats": { "malicious": 0, "suspicious": 0, "harmless": 62, "undetected": 10, "total": 72, "verdict": "clean", "ratio": "0/72" }, "verdict": "clean", "ratio": "0/72", "final_url": "https://s.gmx.dk/...", "title": "GMX", "reputation": 0, "tags": [], "top_detections": [], "last_analysis": 1580013120, "error": null }, "abuseipdb": null, "urlhaus": { "indicator": "https://s.gmx.dk/...", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776650411.2744093 }