{ "type": "URL", "indicator": "https://strefa.pana.gov.pl/content/css/loading.css", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://strefa.pana.gov.pl/content/css/loading.css", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3918126208, "indicator": "https://strefa.pana.gov.pl/content/css/loading.css", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "6701c8e87c91ff0ff82cddbb", "name": "Podgl\u0105d zmian na wniosku danych osobowych lub obywatelstwa dzia\u0142alno\u015bci gospodarczej. Ceidg.gov.pl - Centralna Ewidencja i Informacja o Dzia\u0142alno\u015bci Gospodarczej", "description": "Dane wej\u015bciowe do CEIDG z uprawnieniami \u201ejednego okienka\u201d, CEIDG prze\u015ble informacje o zmianie w twojej firmie do skarbowego, GUS, ZUS/ KRUS i do rejestr\u00f3w regulowanych (je\u015bli twoja dzia\u0142alno\u015b\u0107 wymaga\u0142a koncesji lub podlegaj\u0105cej).\nDokonana operacja o dzia\u0142alno\u015bci gospodarczej wybodaeth \u00c2\u00a31.5m (\u20ac2.3m)", "modified": "2025-07-29T16:17:40.086000", "created": "2024-10-05T23:16:56.227000", "tags": [ "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g", "prosz czeka", "pobierz plik", "serwer" ], "references": [ "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=949ec1d7-6fce-48f1-af89-8177c16efaf5&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=949ec1d7-6fce-48f1-af89-8177c16efaf5", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=01440425-663c-42e1-a224-c59fa9e7db55&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=01440425-663c-42e1-a224-c59fa9e7db55", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=b2418699-3375-4b39-bfb8-c9ce3005ea8b&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=b2418699-3375-4b39-bfb8-c9ce3005ea8b", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=9b024ef2-9f20-417e-ad7f-e918925d03e6&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=9b024ef2-9f20-417e-ad7f-e918925d03e6", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=a9b1805b-892e-4171-bd4b-d4519fb65185", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=d4271593-cfcf-4222-8422-59418a5dbfae&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=d4271593-cfcf-4222-8422-59418a5dbfae", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=c1af4558-3788-44e6-898e-f1ec13ee95c7", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=4d261d23-a418-4b4a-bcf3-95e19e085bab&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=4d261d23-a418-4b4a-bcf3-95e19e085bab", "2929ce76b91264510628184c6e91849e19bc0db038cc3aadc0d2b67fb2423bed" ], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [ { "id": "Serwer", "display_name": "Serwer", "target": null } ], "attack_ids": [ { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1553.006", "name": "Code Signing Policy Modification", "display_name": "T1553.006 - Code Signing Policy Modification" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1553.005", "name": "Mark-of-the-Web Bypass", "display_name": "T1553.005 - Mark-of-the-Web Bypass" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 129, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 5, "URL": 357, "IPv4": 82, "hostname": 194, "domain": 43, "FileHash-SHA256": 426, "FileHash-MD5": 102, "FileHash-SHA1": 100, "CVE": 9, "IPv6": 2, "YARA": 1 }, "indicator_count": 1321, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "265 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68264b46efd11dda1a3d4026", "name": "e-mikrofirma.mf.gov.pl", "description": "Here is the full text of the statement by the Polish government on the GeoTrust TLS RSA CA G1, which was published on 28 April 2017:. and here is a full summary:", "modified": "2025-06-14T19:02:08.307000", "created": "2025-05-15T20:15:02.867000", "tags": [ "wygasy niegodny", "geotrust sha256", "ssl ca", "zaufania", "geotrust tls", "rsa ca", "geotrust ssl", "nieznany", "wicej", "historia", "zawarto po", "nowy email", "nowy telefon", "nowy faks", "nowy kraj", "nask wicej", "nowy serwer", "ministry", "poland txt" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "SSLCertFingerprint": 5, "hostname": 660, "FileHash-SHA256": 224, "domain": 153, "URL": 1153, "CVE": 1, "FileHash-MD5": 17, "FileHash-SHA1": 16, "CIDR": 3 }, "indicator_count": 2232, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6665c84b687c5e16b95e8f8e", "name": "94.152.152.223 v65023.niebieski.net Cyber_Folks S.A. (vgt.pl)", "description": "SHA1 32223ade25c4a1d39cb8ac13042e8e6dfe3ca78f , SHA1 \n 99987c1ee1ddb7fd113abd65c836fbb71c3da4da\n Role: UPX , Ransomware , Trojan , Mirai , Buschido Mirai antywirusowe\nWin.Trojan.VBGeneric-6735875-0 , Robak:Win32/Mofksys.RND!MTB", "modified": "2024-12-31T01:53:43.222000", "created": "2024-06-09T15:20:43.178000", "tags": [ "expiration", "no expiration", "url http", "url https", "hostname", "domain", "ipv4", "filehashsha256", "fh no", "filehashmd5", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "pl o", "unizeto", "sa ou", "urzd", "certum cn" ], "references": [ "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591", "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71", "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527" ], "public": 1, "adversary": "TrojanDownloader:Win32/Nemucod", "targeted_countries": [ "Poland", "United States of America", "Germany", "Netherlands" ], "malware_families": [ { "id": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce PL", "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce PL", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.004", "name": "Compile After Delivery", "display_name": "T1027.004 - Compile After Delivery" }, { "id": "T1027.003", "name": "Steganography", "display_name": "T1027.003 - Steganography" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027.001", "name": "Binary Padding", "display_name": "T1027.001 - Binary Padding" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1553.006", "name": "Code Signing Policy Modification", "display_name": "T1553.006 - Code Signing Policy Modification" }, { "id": "T1553.004", "name": "Install Root Certificate", "display_name": "T1553.004 - Install Root Certificate" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566.001", "name": "Spearphishing Attachment", "display_name": "T1566.001 - Spearphishing Attachment" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055.011", "name": "Extra Window Memory Injection", "display_name": "T1055.011 - Extra Window Memory Injection" }, { "id": "T1055.008", "name": "Ptrace System Calls", "display_name": "T1055.008 - Ptrace System Calls" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1036.001", "name": "Invalid Code Signature", "display_name": "T1036.001 - Invalid Code Signature" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3205, "FileHash-SHA1": 2671, "FileHash-SHA256": 11469, "SSLCertFingerprint": 6, "URL": 5435, "domain": 1356, "email": 55, "hostname": 2205, "CVE": 13, "YARA": 4, "CIDR": 1, "IPv4": 25, "FileHash-IMPHASH": 1, "BitcoinAddress": 2, "IPv6": 13 }, "indicator_count": 26461, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "475 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d3e0652560b9b323d0e5a0", "name": "validator/site/nu-script.js at main \u00b7 validator/validator \u00b7 GitHub 128.30.52.73", "description": "GitHub is the world's most advanced open source platform, powered by artificial intelligence (AI), and you can now access all your code, repositories, users, issues and other data at any time.", "modified": "2024-12-17T14:35:28.041000", "created": "2024-09-01T03:32:53.350000", "tags": [ "sign", "github", "github copilot", "search", "validator", "code issues", "pull", "wiki security", "skip", "navigation", "write", "star", "footer", "valid", "algorithm", "thumbprint", "serial number", "from", "valid from", "pca issuer", "microsoft root", "signing ca", "microsoft code", "class" ], "references": [ "https://github.com/validator/validator/blob/main/site/nu-script.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 29, "URL": 140, "FileHash-MD5": 21, "email": 1, "FileHash-SHA256": 74, "domain": 17, "hostname": 42, "IPv4": 8, "CVE": 1 }, "indicator_count": 333, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "489 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d0a996b288ca46ab7e63ae", "name": "CEIDG (www.pitprojekt.pl , pitprojekt.pl) jak otworzy\u0107 firm\u0119, jak rozpocz\u0105\u0107 biznes, dzia\u0142alno\u015b\u0107 gospodarcza zak\u0142adanie, jak rozpocz\u0105\u0107 dzia\u0142alno\u015b\u0107 gospodarcz\u0105", "description": "Zawarte zasoby wed\u0142ug j\u0119zyka \u00c2\u00a31.1bn, a total of 7.4bn euros ($9.6bn; \u00a36.3bn)", "modified": "2024-12-05T21:16:06.820000", "created": "2024-08-29T17:02:13.392000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4501, "URL": 4559, "hostname": 1957, "domain": 729, "FileHash-MD5": 903, "FileHash-SHA1": 849, "IPv4": 180, "email": 3, "IPv6": 2, "CVE": 1 }, "indicator_count": 13684, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "500 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "670c5ff728e6e5b891e26e45", "name": "IOC", "description": "", "modified": "2024-10-14T00:04:07.913000", "created": "2024-10-14T00:04:07.913000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": "66d0a996b288ca46ab7e63ae", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "WayneState", "id": "296756", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4243, "URL": 4550, "hostname": 1957, "domain": 729, "FileHash-MD5": 801, "FileHash-SHA1": 747, "IPv4": 180, "email": 3, "IPv6": 2 }, "indicator_count": 13212, "is_author": false, "is_subscribing": null, "subscriber_count": 4, "modified_text": "553 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=01440425-663c-42e1-a224-c59fa9e7db55", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=4d261d23-a418-4b4a-bcf3-95e19e085bab&source=versionChange&history=true", "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=949ec1d7-6fce-48f1-af89-8177c16efaf5", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=949ec1d7-6fce-48f1-af89-8177c16efaf5&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=a9b1805b-892e-4171-bd4b-d4519fb65185", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=9b024ef2-9f20-417e-ad7f-e918925d03e6&source=versionChange&history=true", "https://github.com/validator/validator/blob/main/site/nu-script.js", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=9b024ef2-9f20-417e-ad7f-e918925d03e6", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=01440425-663c-42e1-a224-c59fa9e7db55&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/", "2929ce76b91264510628184c6e91849e19bc0db038cc3aadc0d2b67fb2423bed", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=4d261d23-a418-4b4a-bcf3-95e19e085bab", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=c1af4558-3788-44e6-898e-f1ec13ee95c7", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=b2418699-3375-4b39-bfb8-c9ce3005ea8b", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=d4271593-cfcf-4222-8422-59418a5dbfae&source=versionChange&history=true", "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=d4271593-cfcf-4222-8422-59418a5dbfae", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=b2418699-3375-4b39-bfb8-c9ce3005ea8b&source=versionChange&history=true", "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "TrojanDownloader:Win32/Nemucod" ], "malware_families": [ "Serwer a przed\u0142u\u017cenie sesji #{text} wojcieszyce pl", "Serwer" ], "industries": [], "unique_indicators": 40342 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/pana.gov.pl", "whois": "http://whois.domaintools.com/pana.gov.pl", "domain": "pana.gov.pl", "hostname": "strefa.pana.gov.pl" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "6701c8e87c91ff0ff82cddbb", "name": "Podgl\u0105d zmian na wniosku danych osobowych lub obywatelstwa dzia\u0142alno\u015bci gospodarczej. Ceidg.gov.pl - Centralna Ewidencja i Informacja o Dzia\u0142alno\u015bci Gospodarczej", "description": "Dane wej\u015bciowe do CEIDG z uprawnieniami \u201ejednego okienka\u201d, CEIDG prze\u015ble informacje o zmianie w twojej firmie do skarbowego, GUS, ZUS/ KRUS i do rejestr\u00f3w regulowanych (je\u015bli twoja dzia\u0142alno\u015b\u0107 wymaga\u0142a koncesji lub podlegaj\u0105cej).\nDokonana operacja o dzia\u0142alno\u015bci gospodarczej wybodaeth \u00c2\u00a31.5m (\u20ac2.3m)", "modified": "2025-07-29T16:17:40.086000", "created": "2024-10-05T23:16:56.227000", "tags": [ "ceidg.gov.pl - centralna ewidencja i informacja o dzia\u0142alno\u015bci g", "prosz czeka", "pobierz plik", "serwer" ], "references": [ "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=949ec1d7-6fce-48f1-af89-8177c16efaf5&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=949ec1d7-6fce-48f1-af89-8177c16efaf5", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=01440425-663c-42e1-a224-c59fa9e7db55&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=01440425-663c-42e1-a224-c59fa9e7db55", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=b2418699-3375-4b39-bfb8-c9ce3005ea8b&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=b2418699-3375-4b39-bfb8-c9ce3005ea8b", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=9b024ef2-9f20-417e-ad7f-e918925d03e6&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=9b024ef2-9f20-417e-ad7f-e918925d03e6", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=a9b1805b-892e-4171-bd4b-d4519fb65185", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=d4271593-cfcf-4222-8422-59418a5dbfae&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=d4271593-cfcf-4222-8422-59418a5dbfae", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=c1af4558-3788-44e6-898e-f1ec13ee95c7", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoryViewerPage.aspx?aid=4d261d23-a418-4b4a-bcf3-95e19e085bab&source=versionChange&history=true", "https://aplikacja.ceidg.gov.pl/CEIDG/CEIDG.Public.UI/HistoricalEntityView.aspx?hId=4d261d23-a418-4b4a-bcf3-95e19e085bab", "2929ce76b91264510628184c6e91849e19bc0db038cc3aadc0d2b67fb2423bed" ], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [ { "id": "Serwer", "display_name": "Serwer", "target": null } ], "attack_ids": [ { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1553.006", "name": "Code Signing Policy Modification", "display_name": "T1553.006 - Code Signing Policy Modification" }, { "id": "T1553.001", "name": "Gatekeeper Bypass", "display_name": "T1553.001 - Gatekeeper Bypass" }, { "id": "T1553.005", "name": "Mark-of-the-Web Bypass", "display_name": "T1553.005 - Mark-of-the-Web Bypass" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 129, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "email": 5, "URL": 357, "IPv4": 82, "hostname": 194, "domain": 43, "FileHash-SHA256": 426, "FileHash-MD5": 102, "FileHash-SHA1": 100, "CVE": 9, "IPv6": 2, "YARA": 1 }, "indicator_count": 1321, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "265 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "68264b46efd11dda1a3d4026", "name": "e-mikrofirma.mf.gov.pl", "description": "Here is the full text of the statement by the Polish government on the GeoTrust TLS RSA CA G1, which was published on 28 April 2017:. and here is a full summary:", "modified": "2025-06-14T19:02:08.307000", "created": "2025-05-15T20:15:02.867000", "tags": [ "wygasy niegodny", "geotrust sha256", "ssl ca", "zaufania", "geotrust tls", "rsa ca", "geotrust ssl", "nieznany", "wicej", "historia", "zawarto po", "nowy email", "nowy telefon", "nowy faks", "nowy kraj", "nask wicej", "nowy serwer", "ministry", "poland txt" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "SSLCertFingerprint": 5, "hostname": 660, "FileHash-SHA256": 224, "domain": 153, "URL": 1153, "CVE": 1, "FileHash-MD5": 17, "FileHash-SHA1": 16, "CIDR": 3 }, "indicator_count": 2232, "is_author": false, "is_subscribing": null, "subscriber_count": 122, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6665c84b687c5e16b95e8f8e", "name": "94.152.152.223 v65023.niebieski.net Cyber_Folks S.A. (vgt.pl)", "description": "SHA1 32223ade25c4a1d39cb8ac13042e8e6dfe3ca78f , SHA1 \n 99987c1ee1ddb7fd113abd65c836fbb71c3da4da\n Role: UPX , Ransomware , Trojan , Mirai , Buschido Mirai antywirusowe\nWin.Trojan.VBGeneric-6735875-0 , Robak:Win32/Mofksys.RND!MTB", "modified": "2024-12-31T01:53:43.222000", "created": "2024-06-09T15:20:43.178000", "tags": [ "expiration", "no expiration", "url http", "url https", "hostname", "domain", "ipv4", "filehashsha256", "fh no", "filehashmd5", "https odcisk", "palca jarma", "https dane", "v3 numer", "odcisk palca", "pl o", "unizeto", "sa ou", "urzd", "certum cn" ], "references": [ "https://viz.greynoise.io/analysis/f3d70a4f-14b1-4d26-8617-98d591", "https://viz.greynoise.io/analysis/a40cf3ce-d048-47c1-94b7-730b71", "https://viz.greynoise.io/analysis/4627bc3a-0238-4f2f-ad5c-c50527" ], "public": 1, "adversary": "TrojanDownloader:Win32/Nemucod", "targeted_countries": [ "Poland", "United States of America", "Germany", "Netherlands" ], "malware_families": [ { "id": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce PL", "display_name": "Serwer A Przed\u0142u\u017cenie sesji #{text} Wojcieszyce PL", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1027.005", "name": "Indicator Removal from Tools", "display_name": "T1027.005 - Indicator Removal from Tools" }, { "id": "T1027.004", "name": "Compile After Delivery", "display_name": "T1027.004 - Compile After Delivery" }, { "id": "T1027.003", "name": "Steganography", "display_name": "T1027.003 - Steganography" }, { "id": "T1027.002", "name": "Software Packing", "display_name": "T1027.002 - Software Packing" }, { "id": "T1027.001", "name": "Binary Padding", "display_name": "T1027.001 - Binary Padding" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1059.002", "name": "AppleScript", "display_name": "T1059.002 - AppleScript" }, { "id": "T1553.006", "name": "Code Signing Policy Modification", "display_name": "T1553.006 - Code Signing Policy Modification" }, { "id": "T1553.004", "name": "Install Root Certificate", "display_name": "T1553.004 - Install Root Certificate" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1566.001", "name": "Spearphishing Attachment", "display_name": "T1566.001 - Spearphishing Attachment" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1055.011", "name": "Extra Window Memory Injection", "display_name": "T1055.011 - Extra Window Memory Injection" }, { "id": "T1055.008", "name": "Ptrace System Calls", "display_name": "T1055.008 - Ptrace System Calls" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1036.001", "name": "Invalid Code Signature", "display_name": "T1036.001 - Invalid Code Signature" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3205, "FileHash-SHA1": 2671, "FileHash-SHA256": 11469, "SSLCertFingerprint": 6, "URL": 5435, "domain": 1356, "email": 55, "hostname": 2205, "CVE": 13, "YARA": 4, "CIDR": 1, "IPv4": 25, "FileHash-IMPHASH": 1, "BitcoinAddress": 2, "IPv6": 13 }, "indicator_count": 26461, "is_author": false, "is_subscribing": null, "subscriber_count": 141, "modified_text": "475 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d3e0652560b9b323d0e5a0", "name": "validator/site/nu-script.js at main \u00b7 validator/validator \u00b7 GitHub 128.30.52.73", "description": "GitHub is the world's most advanced open source platform, powered by artificial intelligence (AI), and you can now access all your code, repositories, users, issues and other data at any time.", "modified": "2024-12-17T14:35:28.041000", "created": "2024-09-01T03:32:53.350000", "tags": [ "sign", "github", "github copilot", "search", "validator", "code issues", "pull", "wiki security", "skip", "navigation", "write", "star", "footer", "valid", "algorithm", "thumbprint", "serial number", "from", "valid from", "pca issuer", "microsoft root", "signing ca", "microsoft code", "class" ], "references": [ "https://github.com/validator/validator/blob/main/site/nu-script.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 29, "URL": 140, "FileHash-MD5": 21, "email": 1, "FileHash-SHA256": 74, "domain": 17, "hostname": 42, "IPv4": 8, "CVE": 1 }, "indicator_count": 333, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "489 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66d0a996b288ca46ab7e63ae", "name": "CEIDG (www.pitprojekt.pl , pitprojekt.pl) jak otworzy\u0107 firm\u0119, jak rozpocz\u0105\u0107 biznes, dzia\u0142alno\u015b\u0107 gospodarcza zak\u0142adanie, jak rozpocz\u0105\u0107 dzia\u0142alno\u015b\u0107 gospodarcz\u0105", "description": "Zawarte zasoby wed\u0142ug j\u0119zyka \u00c2\u00a31.1bn, a total of 7.4bn euros ($9.6bn; \u00a36.3bn)", "modified": "2024-12-05T21:16:06.820000", "created": "2024-08-29T17:02:13.392000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4501, "URL": 4559, "hostname": 1957, "domain": 729, "FileHash-MD5": 903, "FileHash-SHA1": 849, "IPv4": 180, "email": 3, "IPv6": 2, "CVE": 1 }, "indicator_count": 13684, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "500 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "670c5ff728e6e5b891e26e45", "name": "IOC", "description": "", "modified": "2024-10-14T00:04:07.913000", "created": "2024-10-14T00:04:07.913000", "tags": [ "admin", "asset", "dufur", "jnswj", "3px center", "saxla", "zjloj", "whasz htm", "oszczdno", "png ikona", "rt angielski", "angielski usa", "wersja rt", "narzuta chi2", "plik", "whasz", "bogaty hash", "sha256", "ssdeep", "schema", "strings", "guid", "blob", "sha256 file", "type type", "vhash", "imphash", "bvgquf", "cblrxf", "coqbmf", "efq78c", "gkrikb", "hdvrde", "hlo3ef", "izt63", "jnoxi", "kg2exe", "pejzasz", "rticon english", "english us", "chi2", "png rticon", "ico rtgroupicon", "code signing", "algorithm", "serial number", "sectigo public", "thumbprint", "rsa time", "valid from", "name sectigo", "valid", "valid usage", "ascii text", "neutral", "data rtcursor", "data rtdialog", "default", "rticon maori", "ceidg", "informacja o", "usugi", "z wniosek", "sprawd", "zarejestruj spk", "centralna", "ewidencja", "strona gwna", "formularze i", "sha1", "pehash", "richhash", "authentihash", "skrt", "system", "podaj", "windows z", "kreator", "dostawca", "wifi", "nazwa typ", "md5 nazwa", "imphasz", "kropelka", "smyczki", "zasb manifestu", "neutralny", "ikona rt", "zawarte zasoby", "md5 chi2", "ikonagrupyrt", "rtmanifest", "zawarte", "sha256 typ" ], "references": [ "https://aplikacja.ceidg.gov.pl/ceidg.cms.engine/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": "66d0a996b288ca46ab7e63ae", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "WayneState", "id": "296756", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 4243, "URL": 4550, "hostname": 1957, "domain": 729, "FileHash-MD5": 801, "FileHash-SHA1": 747, "IPv4": 180, "email": 3, "IPv6": 2 }, "indicator_count": 13212, "is_author": false, "is_subscribing": null, "subscriber_count": 4, "modified_text": "553 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://strefa.pana.gov.pl/content/css/loading.css", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://strefa.pana.gov.pl/content/css/loading.css", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776713803.792233 }