{ "type": "URL", "indicator": "https://whois.arin.net/rest/org/SG-679", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://whois.arin.net/rest/org/SG-679", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #6937", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain arin.net", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain arin.net", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4286614719, "indicator": "https://whois.arin.net/rest/org/SG-679", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "69f2e790b5ca86510c384c2c", "name": "14.5k win[exe] comm, 14 ref, 89hxTrojans with ARINOPS -199.", "description": "[The following has been published on the website of the International Organization for the Prevention of Electronic Illness (IOC), which is based in the United States, and is subject to a security rev]\nCertificate before 8/20 expired. Client lost access to phone Aug 22-Sept 15 no reason given. Clients ADT alarm went of wehn sectigo cert expired Sept 8. Client went into Apple man in suit \"unlocked phone\" Sept 15. Was this a jailbreak?", "modified": "2026-05-30T05:18:49.034000", "created": "2026-04-30T05:24:32.866000", "tags": [ "win32", "trojan", "united", "as393225", "mtb may", "mtb mar", "passive dns", "ip address", "backdoor", "mtb apr", "url analysis", "level", "title", "mirai", "orgtechhandle", "arin operations", "orgnochandle", "kassim", "oneill", "michael j", "nethandle", "net199", "net1990000", "arinops", "address range", "cidr", "network name", "allocation type", "whois server", "entity arinops", "handle", "key identifier", "x509v3 subject", "full name", "v3 serial", "number", "cus odigicert", "inc cndigicert", "global g2", "tls rsa", "sha256", "date" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 215, "FileHash-SHA1": 178, "FileHash-SHA256": 594, "domain": 12, "CIDR": 60, "URL": 122, "hostname": 72, "email": 7, "CVE": 1 }, "indicator_count": 1261, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69f2e7933eca244995760f32", "name": "14.5k win[exe] comm, 14 ref, 89hxTrojans with ARINOPS -199.", "description": "[The following has been published on the website of the International Organization for the Prevention of Electronic Illness (IOC), which is based in the United States, and is subject to a security rev]\nCertificate before 8/20 expired. Client lost access to phone Aug 22-Sept 15 no reason given. Clients ADT alarm went of wehn sectigo cert expired Sept 8. Client went into Apple man in suit \"unlocked phone\" Sept 15. Was this a jailbreak?", "modified": "2026-05-30T05:18:49.034000", "created": "2026-04-30T05:24:35.619000", "tags": [ "win32", "trojan", "united", "as393225", "mtb may", "mtb mar", "passive dns", "ip address", "backdoor", "mtb apr", "url analysis", "level", "title", "mirai", "orgtechhandle", "arin operations", "orgnochandle", "kassim", "oneill", "michael j", "nethandle", "net199", "net1990000", "arinops", "address range", "cidr", "network name", "allocation type", "whois server", "entity arinops", "handle", "key identifier", "x509v3 subject", "full name", "v3 serial", "number", "cus odigicert", "inc cndigicert", "global g2", "tls rsa", "sha256", "date" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mirai", "display_name": "Mirai", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 152, "FileHash-SHA1": 153, "FileHash-SHA256": 495, "domain": 2, "CIDR": 1, "URL": 70, "hostname": 7, "email": 5 }, "indicator_count": 885, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69ca5d583057aaefed16789a", "name": "CAPE Sandbox- Stealc Config CNCs\thttp://170.130.55.38\\/ad23d4a47cfd4c13.php botnet\tnewbuild2", "description": "A complete list of details about who is registered on the Whois website:..1.0/16:30 GMT on 1 January 2019. (00:00 GMT).-1: