{
  "type": "URL",
  "indicator": "https://www.i3d.net/gpu-server/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.i3d.net/gpu-server/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3774582283,
      "indicator": "https://www.i3d.net/gpu-server/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "65336ac2b48ca82aeb55aeed",
          "name": "Woodynet.net,Id3.net and me.",
          "description": "The saga continues - But without invoking the jinx I'll focus on the data: Woodynet.net and Id3.net have been my (notso)friendly unoptoutable-dns-resolvers i'm assuming since all of this kicked off now nearing over 1.5+ years ago. I was finally able to dump my iPhone12 in which I had had since this all started and with that really gain some leg and breathing room. But, I'm still being pumped malicious software in the form of ISO's, linux packages, Windows Updates, and so on. And these are the nexus right here. I was able to net a solid bounty from Hybrid-Analysis including 15+ trojans, about 10 different backdoors, and a slew of other collateral that honestly surprised me as Criminalip and OTX weren't wanting to speak the same language in terms of IOC translations from them to the pulse. I'm trying in vain to find the beacon(s) or whatever they're using to keep persistence.",
          "modified": "2024-02-14T21:43:43.324000",
          "created": "2023-10-21T06:08:02.798000",
          "tags": [
            "ip lookup",
            "port check",
            "vulnerability scanner",
            "attack surface",
            "cyber threat intelligence",
            "cti",
            "asm",
            "domain",
            "exploit",
            "phishing",
            "ip address",
            "united",
            "criminal",
            "historical",
            "information",
            "ai spera",
            "search engine",
            "ip search",
            "english english",
            "franais",
            "contact",
            "china",
            "ip location",
            "ip owner",
            "internet",
            "ip locator",
            "remember",
            "dp ip",
            "ip checker",
            "lookup",
            "strong",
            "summary",
            "ip information",
            "pricing login",
            "score",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "ansi",
            "data",
            "decrypted ssl",
            "windows nt",
            "threat level",
            "runtime data",
            "okserver",
            "date",
            "ffffff",
            "plugin",
            "path",
            "stop",
            "mask",
            "accept",
            "click",
            "prop",
            "error",
            "template",
            "class",
            "core",
            "span",
            "body",
            "suspicious",
            "back",
            "cluster",
            "null",
            "form",
            "zbot",
            "bounce",
            "this",
            "linear",
            "window",
            "ticker",
            "tick",
            "import",
            "orbit",
            "config",
            "main",
            "android",
            "cookie",
            "trident",
            "vidc",
            "hybrid",
            "close",
            "hosts",
            "general",
            "local",
            "mozilla",
            "strings",
            "podcast",
            "team",
            "june",
            "criminal ip",
            "engine",
            "resource",
            "dropped file",
            "pattern match",
            "script",
            "noscript",
            "connectivity",
            "bare metal",
            "iframe",
            "enterprise",
            "discord",
            "twitter",
            "facebook",
            "meta",
            "media",
            "story",
            "tools",
            "tokyo",
            "rocket",
            "fullscreen",
            "next",
            "small",
            "bare",
            "font",
            "helvetica",
            "arial",
            "tbody",
            "dnssec",
            "woodynet",
            "paris",
            "hong",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please"
          ],
          "references": [
            "https://www.criminalip.io/asset/report/69.166.14.38",
            "https://www.criminalip.io/asset/report/114.215.222.125",
            "https://dnschecker.org/ip-location.php?ip=31.204.146.148",
            "https://www.criminalip.io/domain/report?scan_id=8544746",
            "https://hybrid-analysis.com/sample/ab4672795b872e01bc7411fec294eab22d54e97b133769a3de306d9633fa24d6/5efec3f6b03bcb74f200310b",
            "https://www.criminalip.io/images/search/domain/category/icon_page_redirections.svg",
            "https://www.criminalip.io/domain/report?scan_id=8544687",
            "https://hybrid-analysis.com/sample/ab4672795b872e01bc7411fec294eab22d54e97b133769a3de306d9633fa24d6/653366aac5f632cbbf0f0000",
            "https://hybrid-analysis.com/sample/020fe56e2d49ead60b67a1e20b43ee0846c493c7edb3118b34c5c964fc131794/6533667318fa4c29320ec174",
            "https://hybrid-analysis.com/sample/2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unknown",
              "display_name": "Unknown",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1016",
              "name": "System Network Configuration Discovery",
              "display_name": "T1016 - System Network Configuration Discovery"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            }
          ],
          "industries": [
            "individuals"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Merkd1904",
            "id": "196517",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 268,
            "hostname": 50,
            "domain": 61,
            "FileHash-MD5": 112,
            "FileHash-SHA1": 110,
            "FileHash-SHA256": 110,
            "email": 9
          },
          "indicator_count": 720,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 74,
          "modified_text": "837 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.criminalip.io/domain/report?scan_id=8544687",
        "https://hybrid-analysis.com/sample/ab4672795b872e01bc7411fec294eab22d54e97b133769a3de306d9633fa24d6/5efec3f6b03bcb74f200310b",
        "https://www.criminalip.io/asset/report/69.166.14.38",
        "https://www.criminalip.io/images/search/domain/category/icon_page_redirections.svg",
        "https://hybrid-analysis.com/sample/020fe56e2d49ead60b67a1e20b43ee0846c493c7edb3118b34c5c964fc131794/6533667318fa4c29320ec174",
        "https://dnschecker.org/ip-location.php?ip=31.204.146.148",
        "https://hybrid-analysis.com/sample/2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e",
        "https://www.criminalip.io/asset/report/114.215.222.125",
        "https://hybrid-analysis.com/sample/ab4672795b872e01bc7411fec294eab22d54e97b133769a3de306d9633fa24d6/653366aac5f632cbbf0f0000",
        "https://www.criminalip.io/domain/report?scan_id=8544746"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Unknown"
          ],
          "industries": [
            "Individuals"
          ],
          "unique_indicators": 729
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/i3d.net",
    "whois": "http://whois.domaintools.com/i3d.net",
    "domain": "i3d.net",
    "hostname": "www.i3d.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "65336ac2b48ca82aeb55aeed",
      "name": "Woodynet.net,Id3.net and me.",
      "description": "The saga continues - But without invoking the jinx I'll focus on the data: Woodynet.net and Id3.net have been my (notso)friendly unoptoutable-dns-resolvers i'm assuming since all of this kicked off now nearing over 1.5+ years ago. I was finally able to dump my iPhone12 in which I had had since this all started and with that really gain some leg and breathing room. But, I'm still being pumped malicious software in the form of ISO's, linux packages, Windows Updates, and so on. And these are the nexus right here. I was able to net a solid bounty from Hybrid-Analysis including 15+ trojans, about 10 different backdoors, and a slew of other collateral that honestly surprised me as Criminalip and OTX weren't wanting to speak the same language in terms of IOC translations from them to the pulse. I'm trying in vain to find the beacon(s) or whatever they're using to keep persistence.",
      "modified": "2024-02-14T21:43:43.324000",
      "created": "2023-10-21T06:08:02.798000",
      "tags": [
        "ip lookup",
        "port check",
        "vulnerability scanner",
        "attack surface",
        "cyber threat intelligence",
        "cti",
        "asm",
        "domain",
        "exploit",
        "phishing",
        "ip address",
        "united",
        "criminal",
        "historical",
        "information",
        "ai spera",
        "search engine",
        "ip search",
        "english english",
        "franais",
        "contact",
        "china",
        "ip location",
        "ip owner",
        "internet",
        "ip locator",
        "remember",
        "dp ip",
        "ip checker",
        "lookup",
        "strong",
        "summary",
        "ip information",
        "pricing login",
        "score",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "ansi",
        "data",
        "decrypted ssl",
        "windows nt",
        "threat level",
        "runtime data",
        "okserver",
        "date",
        "ffffff",
        "plugin",
        "path",
        "stop",
        "mask",
        "accept",
        "click",
        "prop",
        "error",
        "template",
        "class",
        "core",
        "span",
        "body",
        "suspicious",
        "back",
        "cluster",
        "null",
        "form",
        "zbot",
        "bounce",
        "this",
        "linear",
        "window",
        "ticker",
        "tick",
        "import",
        "orbit",
        "config",
        "main",
        "android",
        "cookie",
        "trident",
        "vidc",
        "hybrid",
        "close",
        "hosts",
        "general",
        "local",
        "mozilla",
        "strings",
        "podcast",
        "team",
        "june",
        "criminal ip",
        "engine",
        "resource",
        "dropped file",
        "pattern match",
        "script",
        "noscript",
        "connectivity",
        "bare metal",
        "iframe",
        "enterprise",
        "discord",
        "twitter",
        "facebook",
        "meta",
        "media",
        "story",
        "tools",
        "tokyo",
        "rocket",
        "fullscreen",
        "next",
        "small",
        "bare",
        "font",
        "helvetica",
        "arial",
        "tbody",
        "dnssec",
        "woodynet",
        "paris",
        "hong",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please"
      ],
      "references": [
        "https://www.criminalip.io/asset/report/69.166.14.38",
        "https://www.criminalip.io/asset/report/114.215.222.125",
        "https://dnschecker.org/ip-location.php?ip=31.204.146.148",
        "https://www.criminalip.io/domain/report?scan_id=8544746",
        "https://hybrid-analysis.com/sample/ab4672795b872e01bc7411fec294eab22d54e97b133769a3de306d9633fa24d6/5efec3f6b03bcb74f200310b",
        "https://www.criminalip.io/images/search/domain/category/icon_page_redirections.svg",
        "https://www.criminalip.io/domain/report?scan_id=8544687",
        "https://hybrid-analysis.com/sample/ab4672795b872e01bc7411fec294eab22d54e97b133769a3de306d9633fa24d6/653366aac5f632cbbf0f0000",
        "https://hybrid-analysis.com/sample/020fe56e2d49ead60b67a1e20b43ee0846c493c7edb3118b34c5c964fc131794/6533667318fa4c29320ec174",
        "https://hybrid-analysis.com/sample/2acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unknown",
          "display_name": "Unknown",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1016",
          "name": "System Network Configuration Discovery",
          "display_name": "T1016 - System Network Configuration Discovery"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        }
      ],
      "industries": [
        "individuals"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Merkd1904",
        "id": "196517",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 268,
        "hostname": 50,
        "domain": 61,
        "FileHash-MD5": 112,
        "FileHash-SHA1": 110,
        "FileHash-SHA256": 110,
        "email": 9
      },
      "indicator_count": 720,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 74,
      "modified_text": "837 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.i3d.net/gpu-server/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.i3d.net/gpu-server/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780315519.1907208
}