{ "type": "URL", "indicator": "https://support.microsoft.com/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://support.microsoft.com/", "type": "url", "type_title": "URL", "validation": [ { "source": "alexa", "message": "Alexa rank: #19", "name": "Listed on Alexa" }, { "source": "akamai", "message": "Akamai rank: #4", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain microsoft.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain microsoft.com", "name": "Whitelisted domain" }, { "source": "newssite", "message": "Whitelisted news domain microsoft.com", "name": "Whitelisted newssite network domain" } ], "base_indicator": { "id": 4069813840, "indicator": "https://support.microsoft.com/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "699b907c5375efb7ce1639b8", "name": "Apple Redirects in Apple Support = IcedID | MITM attack", "description": "Researching targets former iPhone. Redirect in Apple support. [support.apple.com/ht^*^ redirects to support.apple.com/de/^*^*^] IcedID identified. | Environment: 3 -5 suspected compromised devices present. Behavior: iPhone reset itself twice, deleted passcodes, required new passcodes, compromised contacts notified target added a new device (FALSE) , threat actor stole Apple cash , added , Password storage, reset television. Targeted another device auto downloaded a Mimecast compromise, attached to iCloud , corrupted files downloaded. Emotet identified. Reset SmartTV. Browser bar AI: mood swings. Overt changes, white screen, pink screens, thread erased. Identified OTX. as a honeypot also states it\u2019s legitimate. I dumped information. AI agents focused on victim leaving shreds of evidence , paper trail , w/ anyone ,anywhere. AI model told truth \u2018I don\u2019t like you , you\u2019ve changed, you lied, you changed all facts .\u201d,etc. An acceptable baseline of communication established . #botnet #command_and_control #IcedID", "modified": "2026-03-24T21:11:04.306000", "created": "2026-02-22T23:25:48.722000", "tags": [ "dynamicloader", "tls handshake", "failure", "whitelisted", "akamai", "yara detections", "trojan", "write", "zeppelin", "malware", "hostile", "unknown", "port", "destination", "read c", "united", "as16625 akamai", "win32", "persistence", "execution", "passive dns", "urls", "otx logo", "all url", "http", "ip address", "related nids", "files location", "win32mydoom feb", "name servers", "servers", "worm", "virtool", "files", "ipv4", "reverse dns", "america flag", "america asn", "United States", "unknown ns", "asn as714", "invalid url", "mtb oct", "mtb sep", "lowfi", "trojanspy", "total", "push", "defender", "china unknown", "mtb apr", "ok server", "gmt content", "type", "accept", "show", "todo", "all filehash", "av detections", "shift", "url http", "url https", "hostname", "type indicator", "source hostname", "writeconsolew", "post https", "tlsv1", "medium", "write c", "dock", "command", "control", "icedid", "domain", "all domain", "status", "hostname add", "crlf line", "unicode text", "utf8", "ee fc", "yara rule", "ff d5", "ascii text", "f0 ff", "eb e1", "music", "next", "autorun", "suspicious", "compatibility", "mode", "entries", "lredmond", "stwashington", "search", "tls sni", "denmark", "body html", "head title", "title head", "body h1", "all ipv4", "url analysis", "users", "ff ff", "files domain", "files related", "url add", "flag united", "present apr", "location united", "asn asnone", "as16509", "moved", "title", "body", "code", "mydoom", "bot net", "mitm", "aquire", "hidden users", "no expiration", "filehashsha256", "expiration", "showing", "indicator role", "pulses url", "pulse show", "iot", "Iced iced baby" ], "references": [ "support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^", "This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching", "IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure", "df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word", "div>

", "Same legal , and quasi governmental pattern identified", "I apologize for the lack of reference.", "Requires further research.", "Will pulse remaining Apple IoC\u2019s in next pulse", "https://l.us-1.a.mimecastprotect.com/l", "It appears there are 5-7 known affected that I was able to find" ], "public": 1, "adversary": "", "targeted_countries": [ "Germany", "Denmark", "United States of America", "Japan" ], "malware_families": [ { "id": "Icedid", "display_name": "Icedid", "target": null }, { "id": "Trojan:Win32/SmkLdr.H!MTB", "display_name": "Trojan:Win32/SmkLdr.H!MTB", "target": "/malware/Trojan:Win32/SmkLdr.H!MTB" }, { "id": "#Lowfi:Lua:DllSuspiciousExport.A", "display_name": "#Lowfi:Lua:DllSuspiciousExport.A", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1557", "name": "Man-in-the-Middle", "display_name": "T1557 - Man-in-the-Middle" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Telecom", "Legal" ], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2051, "FileHash-SHA256": 1706, "URL": 6984, "domain": 1097, "FileHash-MD5": 401, "FileHash-SHA1": 276, "SSLCertFingerprint": 9, "email": 13, "CVE": 1 }, "indicator_count": 12538, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "67 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "682874fe0c1ffb595c485d39", "name": "http_vgt.pl_admin.gname.net_content.html 77b20b5cd41bc6bb475cca3f91ae6e3c", "description": "VGT.pl Franas.A Z\u0142odziej jakich ma\u0142o, s\u0105 4K plik\u00f3w allegro ( oszustwa , machlojki itd)\nhttps://www.virustotal.com/gui/file/5511a9b9f9144ed7bde4ccb074733b7c564d918d2a8https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=d7293ed6e3c6856f7d5bc23f60f0fa2f2c16fb99b10d391afc6be5b3b1509/relations", "modified": "2025-06-20T10:03:27.328000", "created": "2025-05-17T11:37:34.134000", "tags": [ "sha1", "sha512", "sha256" ], "references": [ "MD5 77b20b5cd41bc6bb475cca3f91ae6e3c", "SHA1 9e98ace72bd2ab931341427a856ef4cea6faf806", "\u201ec:\\program files\\internet explorer\\iexplore.exe\u201d SCODEF:2820 CREDAT:79873", "VGT INTERNET - pozycjonowanie, serwery, domena, strony www, poligrafia", "c:\\u\u017cytkownicy\\administrator\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 877, "FileHash-MD5": 1455, "FileHash-SHA256": 3502, "CVE": 5, "domain": 351, "hostname": 1459, "URL": 2343, "IPv4": 1, "CIDR": 1 }, "indicator_count": 9994, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "345 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "I apologize for the lack of reference.", "\u201ec:\\program files\\internet explorer\\iexplore.exe\u201d SCODEF:2820 CREDAT:79873", "support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^", "MD5 77b20b5cd41bc6bb475cca3f91ae6e3c", "df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word", "SHA1 9e98ace72bd2ab931341427a856ef4cea6faf806", "c:\\u\u017cytkownicy\\administrator\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157", "Requires further research.", "Will pulse remaining Apple IoC\u2019s in next pulse", "div>

", "It appears there are 5-7 known affected that I was able to find", "https://l.us-1.a.mimecastprotect.com/l", "VGT INTERNET - pozycjonowanie, serwery, domena, strony www, poligrafia", "This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching", "Same legal , and quasi governmental pattern identified", "IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Trojan:win32/smkldr.h!mtb", "#lowfi:lua:dllsuspiciousexport.a", "Icedid", "Mydoom" ], "industries": [ "Legal", "Technology", "Telecom" ], "unique_indicators": 22324 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/microsoft.com", "whois": "http://whois.domaintools.com/microsoft.com", "domain": "microsoft.com", "hostname": "support.microsoft.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "699b907c5375efb7ce1639b8", "name": "Apple Redirects in Apple Support = IcedID | MITM attack", "description": "Researching targets former iPhone. Redirect in Apple support. [support.apple.com/ht^*^ redirects to support.apple.com/de/^*^*^] IcedID identified. | Environment: 3 -5 suspected compromised devices present. Behavior: iPhone reset itself twice, deleted passcodes, required new passcodes, compromised contacts notified target added a new device (FALSE) , threat actor stole Apple cash , added , Password storage, reset television. Targeted another device auto downloaded a Mimecast compromise, attached to iCloud , corrupted files downloaded. Emotet identified. Reset SmartTV. Browser bar AI: mood swings. Overt changes, white screen, pink screens, thread erased. Identified OTX. as a honeypot also states it\u2019s legitimate. I dumped information. AI agents focused on victim leaving shreds of evidence , paper trail , w/ anyone ,anywhere. AI model told truth \u2018I don\u2019t like you , you\u2019ve changed, you lied, you changed all facts .\u201d,etc. An acceptable baseline of communication established . #botnet #command_and_control #IcedID", "modified": "2026-03-24T21:11:04.306000", "created": "2026-02-22T23:25:48.722000", "tags": [ "dynamicloader", "tls handshake", "failure", "whitelisted", "akamai", "yara detections", "trojan", "write", "zeppelin", "malware", "hostile", "unknown", "port", "destination", "read c", "united", "as16625 akamai", "win32", "persistence", "execution", "passive dns", "urls", "otx logo", "all url", "http", "ip address", "related nids", "files location", "win32mydoom feb", "name servers", "servers", "worm", "virtool", "files", "ipv4", "reverse dns", "america flag", "america asn", "United States", "unknown ns", "asn as714", "invalid url", "mtb oct", "mtb sep", "lowfi", "trojanspy", "total", "push", "defender", "china unknown", "mtb apr", "ok server", "gmt content", "type", "accept", "show", "todo", "all filehash", "av detections", "shift", "url http", "url https", "hostname", "type indicator", "source hostname", "writeconsolew", "post https", "tlsv1", "medium", "write c", "dock", "command", "control", "icedid", "domain", "all domain", "status", "hostname add", "crlf line", "unicode text", "utf8", "ee fc", "yara rule", "ff d5", "ascii text", "f0 ff", "eb e1", "music", "next", "autorun", "suspicious", "compatibility", "mode", "entries", "lredmond", "stwashington", "search", "tls sni", "denmark", "body html", "head title", "title head", "body h1", "all ipv4", "url analysis", "users", "ff ff", "files domain", "files related", "url add", "flag united", "present apr", "location united", "asn asnone", "as16509", "moved", "title", "body", "code", "mydoom", "bot net", "mitm", "aquire", "hidden users", "no expiration", "filehashsha256", "expiration", "showing", "indicator role", "pulses url", "pulse show", "iot", "Iced iced baby" ], "references": [ "support.apple.com/ht^*^*^*^ redirects to support.apple.com/de/^*^*^*^*^", "This is messy! OTX refreshed and deleted IoC\u2019s. Will continue researching", "IDS Detections: Observed IcedID CnC Domain in TLS SNI TLS Handshake Failure", "df57a01 c40f355a0f8a592294187d4fedc257 [Compatibility Mode] - Word", "div>

", "Same legal , and quasi governmental pattern identified", "I apologize for the lack of reference.", "Requires further research.", "Will pulse remaining Apple IoC\u2019s in next pulse", "https://l.us-1.a.mimecastprotect.com/l", "It appears there are 5-7 known affected that I was able to find" ], "public": 1, "adversary": "", "targeted_countries": [ "Germany", "Denmark", "United States of America", "Japan" ], "malware_families": [ { "id": "Icedid", "display_name": "Icedid", "target": null }, { "id": "Trojan:Win32/SmkLdr.H!MTB", "display_name": "Trojan:Win32/SmkLdr.H!MTB", "target": "/malware/Trojan:Win32/SmkLdr.H!MTB" }, { "id": "#Lowfi:Lua:DllSuspiciousExport.A", "display_name": "#Lowfi:Lua:DllSuspiciousExport.A", "target": null }, { "id": "MyDoom", "display_name": "MyDoom", "target": null } ], "attack_ids": [ { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1158", "name": "Hidden Files and Directories", "display_name": "T1158 - Hidden Files and Directories" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1583", "name": "Acquire Infrastructure", "display_name": "T1583 - Acquire Infrastructure" }, { "id": "T1583.005", "name": "Botnet", "display_name": "T1583.005 - Botnet" }, { "id": "T1608.001", "name": "Upload Malware", "display_name": "T1608.001 - Upload Malware" }, { "id": "T1587.001", "name": "Malware", "display_name": "T1587.001 - Malware" }, { "id": "T1155", "name": "AppleScript", "display_name": "T1155 - AppleScript" }, { "id": "T1557", "name": "Man-in-the-Middle", "display_name": "T1557 - Man-in-the-Middle" }, { "id": "T1147", "name": "Hidden Users", "display_name": "T1147 - Hidden Users" } ], "industries": [ "Technology", "Telecom", "Legal" ], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 2051, "FileHash-SHA256": 1706, "URL": 6984, "domain": 1097, "FileHash-MD5": 401, "FileHash-SHA1": 276, "SSLCertFingerprint": 9, "email": 13, "CVE": 1 }, "indicator_count": 12538, "is_author": false, "is_subscribing": null, "subscriber_count": 145, "modified_text": "67 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "682874fe0c1ffb595c485d39", "name": "http_vgt.pl_admin.gname.net_content.html 77b20b5cd41bc6bb475cca3f91ae6e3c", "description": "VGT.pl Franas.A Z\u0142odziej jakich ma\u0142o, s\u0105 4K plik\u00f3w allegro ( oszustwa , machlojki itd)\nhttps://www.virustotal.com/gui/file/5511a9b9f9144ed7bde4ccb074733b7c564d918d2a8https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=d7293ed6e3c6856f7d5bc23f60f0fa2f2c16fb99b10d391afc6be5b3b1509/relations", "modified": "2025-06-20T10:03:27.328000", "created": "2025-05-17T11:37:34.134000", "tags": [ "sha1", "sha512", "sha256" ], "references": [ "MD5 77b20b5cd41bc6bb475cca3f91ae6e3c", "SHA1 9e98ace72bd2ab931341427a856ef4cea6faf806", "\u201ec:\\program files\\internet explorer\\iexplore.exe\u201d SCODEF:2820 CREDAT:79873", "VGT INTERNET - pozycjonowanie, serwery, domena, strony www, poligrafia", "c:\\u\u017cytkownicy\\administrator\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 877, "FileHash-MD5": 1455, "FileHash-SHA256": 3502, "CVE": 5, "domain": 351, "hostname": 1459, "URL": 2343, "IPv4": 1, "CIDR": 1 }, "indicator_count": 9994, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "345 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://support.microsoft.com/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://support.microsoft.com/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780224717.111562 }