{
  "type": "URL",
  "indicator": "https://wall.qqsvip9.top",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://wall.qqsvip9.top",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3526268241,
      "indicator": "https://wall.qqsvip9.top",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69479bd1714bb9552aeb3623",
          "name": "Cyber trails of malicious actor KillNet by skocherhan",
          "description": "",
          "modified": "2025-12-21T07:03:45.053000",
          "created": "2025-12-21T07:03:45.053000",
          "tags": [],
          "references": [
            "https://raw.githubusercontent.com/securityscorecard/SSC-Threat-Intel-IoCs/master/KillNet-DDoS-Blocklist/proxylist.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6758fd5afdfe6960ccda2cca",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 28942,
            "FileHash-SHA256": 2586,
            "hostname": 15671,
            "domain": 9429,
            "CVE": 4
          },
          "indicator_count": 56632,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "120 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6758fd5afdfe6960ccda2cca",
          "name": "Cyber trails of malicious actor KillNet",
          "description": "",
          "modified": "2024-12-11T02:47:54.379000",
          "created": "2024-12-11T02:47:54.379000",
          "tags": [],
          "references": [
            "https://raw.githubusercontent.com/securityscorecard/SSC-Threat-Intel-IoCs/master/KillNet-DDoS-Blocklist/proxylist.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 28942,
            "FileHash-SHA256": 2586,
            "hostname": 15671,
            "domain": 9429,
            "CVE": 4
          },
          "indicator_count": 56632,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 180,
          "modified_text": "495 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "636a217526898c071749bd0a",
          "name": "https://ws.batch.com/a/1.15.2/tr/598066D72A5454EC66758407DF4A1",
          "description": "",
          "modified": "2022-12-08T09:02:19.931000",
          "created": "2022-11-08T09:29:25.441000",
          "tags": [
            "runtime data",
            "size",
            "runtime process",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "ansi",
            "seen",
            "sha256",
            "strings",
            "hybrid",
            "general",
            "click",
            "hosts"
          ],
          "references": [
            "This website uses cookies to enhance your browsing experience. Please note that by continuing to use this site you consent to the terms of our Data Protection Policy.  ACCEPT Logo  Sandbox   Quick Scans   File Collections  Resources   Request Info  More   no specific threat AV Detection: Marked as clean Link   Twitter   E-Mail https://ws.batch.com/a/1.15.2/tr/598066D72A5454EC66758407DF4A14  This report is generated from a file or URL submitted to this webservice on November 7th 2022 20:48:50 (UTC) and actio"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 229,
            "hostname": 136,
            "domain": 58,
            "FileHash-SHA256": 367,
            "FileHash-MD5": 49,
            "FileHash-SHA1": 49
          },
          "indicator_count": 888,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 391,
          "modified_text": "1229 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e400370539f2ffde908c3e",
          "name": "HFX1ENG-11.12.0.31.exe",
          "description": "External References\nhttp://dyna.dnsever.com/download/DDNSClient_1.0.0.5.zip \nhttps://www.virustotal.com/gui/collection/1d3bf0f66e482e0aea068b1a8826742eeddf8b7961487ffae68efbd6af7b2eee \nhttps://www.virustotal.com/graph/g10e6caece98c45f68a446bca1b5327150fdac5b1aba34ef4803ad2cdcaa4bba0\nExternal User Tags\n#http://dyna.dnsever.com/download/ddnsclient_1.0.0.5.zip",
          "modified": "2022-08-28T00:01:38.268000",
          "created": "2022-07-29T15:43:51.689000",
          "tags": [
            "sha256",
            "memoryfile scan",
            "ansi",
            "unicode",
            "runtime data",
            "switch",
            "case",
            "autoit script",
            "autoit",
            "hotkey ansi",
            "verisign",
            "accept",
            "obsolete",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "source",
            "indicator",
            "observed import",
            "y ansi",
            "n ansi",
            "pattern match",
            "path",
            "entropy",
            "class",
            "hybrid",
            "close",
            "click",
            "strings",
            "suspicious"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/1e8e4936d1349855cec3e7f03e245a3a36bf549e35f7d2b1393ac8bc2d00bd48/62e304f35560d609b73f175a",
            "08bbf243bca2dd89b5b7b34736e1b81c  SHA256: 1e8e4936d1349855cec3e7f03e245a3a36bf549e35f7d2b1393ac8bc2d00bd48"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 292,
            "hostname": 99,
            "domain": 83,
            "FileHash-SHA256": 9,
            "FileHash-MD5": 10,
            "FileHash-SHA1": 1,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 497,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 391,
          "modified_text": "1331 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "This website uses cookies to enhance your browsing experience. Please note that by continuing to use this site you consent to the terms of our Data Protection Policy.  ACCEPT Logo  Sandbox   Quick Scans   File Collections  Resources   Request Info  More   no specific threat AV Detection: Marked as clean Link   Twitter   E-Mail https://ws.batch.com/a/1.15.2/tr/598066D72A5454EC66758407DF4A14  This report is generated from a file or URL submitted to this webservice on November 7th 2022 20:48:50 (UTC) and actio",
        "https://raw.githubusercontent.com/securityscorecard/SSC-Threat-Intel-IoCs/master/KillNet-DDoS-Blocklist/proxylist.txt",
        "https://hybrid-analysis.com/sample/1e8e4936d1349855cec3e7f03e245a3a36bf549e35f7d2b1393ac8bc2d00bd48/62e304f35560d609b73f175a",
        "08bbf243bca2dd89b5b7b34736e1b81c  SHA256: 1e8e4936d1349855cec3e7f03e245a3a36bf549e35f7d2b1393ac8bc2d00bd48"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 57929
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/qqsvip9.top",
    "whois": "http://whois.domaintools.com/qqsvip9.top",
    "domain": "qqsvip9.top",
    "hostname": "wall.qqsvip9.top"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69479bd1714bb9552aeb3623",
      "name": "Cyber trails of malicious actor KillNet by skocherhan",
      "description": "",
      "modified": "2025-12-21T07:03:45.053000",
      "created": "2025-12-21T07:03:45.053000",
      "tags": [],
      "references": [
        "https://raw.githubusercontent.com/securityscorecard/SSC-Threat-Intel-IoCs/master/KillNet-DDoS-Blocklist/proxylist.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6758fd5afdfe6960ccda2cca",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 28942,
        "FileHash-SHA256": 2586,
        "hostname": 15671,
        "domain": 9429,
        "CVE": 4
      },
      "indicator_count": 56632,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "120 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6758fd5afdfe6960ccda2cca",
      "name": "Cyber trails of malicious actor KillNet",
      "description": "",
      "modified": "2024-12-11T02:47:54.379000",
      "created": "2024-12-11T02:47:54.379000",
      "tags": [],
      "references": [
        "https://raw.githubusercontent.com/securityscorecard/SSC-Threat-Intel-IoCs/master/KillNet-DDoS-Blocklist/proxylist.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 28942,
        "FileHash-SHA256": 2586,
        "hostname": 15671,
        "domain": 9429,
        "CVE": 4
      },
      "indicator_count": 56632,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 180,
      "modified_text": "495 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "636a217526898c071749bd0a",
      "name": "https://ws.batch.com/a/1.15.2/tr/598066D72A5454EC66758407DF4A1",
      "description": "",
      "modified": "2022-12-08T09:02:19.931000",
      "created": "2022-11-08T09:29:25.441000",
      "tags": [
        "runtime data",
        "size",
        "runtime process",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "ansi",
        "seen",
        "sha256",
        "strings",
        "hybrid",
        "general",
        "click",
        "hosts"
      ],
      "references": [
        "This website uses cookies to enhance your browsing experience. Please note that by continuing to use this site you consent to the terms of our Data Protection Policy.  ACCEPT Logo  Sandbox   Quick Scans   File Collections  Resources   Request Info  More   no specific threat AV Detection: Marked as clean Link   Twitter   E-Mail https://ws.batch.com/a/1.15.2/tr/598066D72A5454EC66758407DF4A14  This report is generated from a file or URL submitted to this webservice on November 7th 2022 20:48:50 (UTC) and actio"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 229,
        "hostname": 136,
        "domain": 58,
        "FileHash-SHA256": 367,
        "FileHash-MD5": 49,
        "FileHash-SHA1": 49
      },
      "indicator_count": 888,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 391,
      "modified_text": "1229 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e400370539f2ffde908c3e",
      "name": "HFX1ENG-11.12.0.31.exe",
      "description": "External References\nhttp://dyna.dnsever.com/download/DDNSClient_1.0.0.5.zip \nhttps://www.virustotal.com/gui/collection/1d3bf0f66e482e0aea068b1a8826742eeddf8b7961487ffae68efbd6af7b2eee \nhttps://www.virustotal.com/graph/g10e6caece98c45f68a446bca1b5327150fdac5b1aba34ef4803ad2cdcaa4bba0\nExternal User Tags\n#http://dyna.dnsever.com/download/ddnsclient_1.0.0.5.zip",
      "modified": "2022-08-28T00:01:38.268000",
      "created": "2022-07-29T15:43:51.689000",
      "tags": [
        "sha256",
        "memoryfile scan",
        "ansi",
        "unicode",
        "runtime data",
        "switch",
        "case",
        "autoit script",
        "autoit",
        "hotkey ansi",
        "verisign",
        "accept",
        "obsolete",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "source",
        "indicator",
        "observed import",
        "y ansi",
        "n ansi",
        "pattern match",
        "path",
        "entropy",
        "class",
        "hybrid",
        "close",
        "click",
        "strings",
        "suspicious"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/1e8e4936d1349855cec3e7f03e245a3a36bf549e35f7d2b1393ac8bc2d00bd48/62e304f35560d609b73f175a",
        "08bbf243bca2dd89b5b7b34736e1b81c  SHA256: 1e8e4936d1349855cec3e7f03e245a3a36bf549e35f7d2b1393ac8bc2d00bd48"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 292,
        "hostname": 99,
        "domain": 83,
        "FileHash-SHA256": 9,
        "FileHash-MD5": 10,
        "FileHash-SHA1": 1,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 497,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 391,
      "modified_text": "1331 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://wall.qqsvip9.top",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://wall.qqsvip9.top",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776728976.297443
}