{ "type": "Domain", "indicator": "ifoplu.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/ifoplu.com", "alexa": "http://www.alexa.com/siteinfo/ifoplu.com", "indicator": "ifoplu.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3930070838, "indicator": "ifoplu.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "65fd23f8dc3d84e2bbff9821", "name": "sms scam campaign (2024)", "description": "scam based on sms. new pulse for 2024 data, because the old one was too big.", "modified": "2025-05-15T02:17:53.684000", "created": "2024-03-22T06:23:52.630000", "tags": [ "sms", "scam" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "36b4b9b5", "id": "188952", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 880, "domain": 11265 }, "indicator_count": 12145, "is_author": false, "is_subscribing": null, "subscriber_count": 75, "modified_text": "384 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6792ab832c589d42e11e0170", "name": "2024-01-23 | Cats Cradle", "description": "SMS spearphishing text message reported from LinkedIn by a fellow OSINTer. Domain points back to AS45102 under Alibaba. Websites have been registered since approximately Summer 2024 and spread throughout the year until the present day. DGA typically follows a 6-7 char alphanumeric schema.", "modified": "2025-02-22T20:00:10.135000", "created": "2025-01-23T20:50:11.283000", "tags": [ "AS45102", "NameCheap", "Alibaba", "Cats Cradle", "MalwareMorghulis", "SMS", "Spearphishing", "Spam" ], "references": [ "https://securitytrails.com/list/ip/47.253.171.249", "https://whois.domaintools.com/hnzxcox.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1454", "name": "Malicious SMS Message", "display_name": "T1454 - Malicious SMS Message" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MalwareMorghulis", "id": "202965", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202965/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 10637 }, "indicator_count": 10637, "is_author": false, "is_subscribing": null, "subscriber_count": 61, "modified_text": "465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "671bf9b30f4ff717e6a6cf77", "name": "2024-10-25 | SMS Phishing with DGA", "description": "Based on post about SMS phishing texts from LinkedIn by Kellen S., another OSINTer. Sample texts from US-based AT&T NY mobile number. SMS reads: \"YOU disabled AUTO-SCAN 4 days ago. Your device has been infected 4 secret files. Remove them immediately \". SMS spearphishing content has poor grammar, likely non-US actor. Attacker uses Domain Generation Algorithms (DGA) to register via NameCheap and host on Alibaba-US. Generated FQDNs are typically 7-characters randomized alphabet (no numbers seen in FQDNs yet) & 6- or 8-character variant seldomly seen. FQDNs are all .com TLDs with several exceptions. The majority of generated FQDNs were registered recently within the last 2-weeks. FQDNs carry a 8-character alphanumeric URI to identify targets. Odd *.net and *.info FQDN exceptions are potential orchestrations or initializers - these specific FQDN were registered early-to-mid July 2024. ASN: AS45102 - Alibaba-US Cloud. Domains are generated with privacy-protection.", "modified": "2024-11-24T18:05:05.777000", "created": "2024-10-25T20:04:03.930000", "tags": [ "SMS", "Phishing", "AT&T", "Alibaba", "Alibaba Cloud", "Virginia", "Mobile", "Phone", "NameCheap", "New York", "Spam", "China", "DGA", "Domain Generation Algorithm", "MalwareMorghulis", "Scam", "AS45102", "Cats Cradle" ], "references": [ "https://whois.domaintools.com/wncsbxn.com", "https://whois.domaintools.com/2z7rpv.info", "https://securitytrails.com/list/ip/47.253.171.249" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1194", "name": "Spearphishing via Service", "display_name": "T1194 - Spearphishing via Service" }, { "id": "T1598.003", "name": "Spearphishing Link", "display_name": "T1598.003 - Spearphishing Link" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1483", "name": "Domain Generation Algorithms", "display_name": "T1483 - Domain Generation Algorithms" }, { "id": "T1520", "name": "Domain Generation Algorithms", "display_name": "T1520 - Domain Generation Algorithms" } ], "industries": [ "Telecommunications" ], "TLP": "green", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MalwareMorghulis", "id": "202965", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202965/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9568, "URL": 9568 }, "indicator_count": 19136, "is_author": false, "is_subscribing": null, "subscriber_count": 59, "modified_text": "555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://whois.domaintools.com/2z7rpv.info", "https://securitytrails.com/list/ip/47.253.171.249", "https://whois.domaintools.com/wncsbxn.com", "https://whois.domaintools.com/hnzxcox.com" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [ "Telecommunications" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "65fd23f8dc3d84e2bbff9821", "name": "sms scam campaign (2024)", "description": "scam based on sms. new pulse for 2024 data, because the old one was too big.", "modified": "2025-05-15T02:17:53.684000", "created": "2024-03-22T06:23:52.630000", "tags": [ "sms", "scam" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "36b4b9b5", "id": "188952", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 880, "domain": 11265 }, "indicator_count": 12145, "is_author": false, "is_subscribing": null, "subscriber_count": 75, "modified_text": "384 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6792ab832c589d42e11e0170", "name": "2024-01-23 | Cats Cradle", "description": "SMS spearphishing text message reported from LinkedIn by a fellow OSINTer. Domain points back to AS45102 under Alibaba. Websites have been registered since approximately Summer 2024 and spread throughout the year until the present day. DGA typically follows a 6-7 char alphanumeric schema.", "modified": "2025-02-22T20:00:10.135000", "created": "2025-01-23T20:50:11.283000", "tags": [ "AS45102", "NameCheap", "Alibaba", "Cats Cradle", "MalwareMorghulis", "SMS", "Spearphishing", "Spam" ], "references": [ "https://securitytrails.com/list/ip/47.253.171.249", "https://whois.domaintools.com/hnzxcox.com" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1454", "name": "Malicious SMS Message", "display_name": "T1454 - Malicious SMS Message" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MalwareMorghulis", "id": "202965", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202965/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 10637 }, "indicator_count": 10637, "is_author": false, "is_subscribing": null, "subscriber_count": 61, "modified_text": "465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "671bf9b30f4ff717e6a6cf77", "name": "2024-10-25 | SMS Phishing with DGA", "description": "Based on post about SMS phishing texts from LinkedIn by Kellen S., another OSINTer. Sample texts from US-based AT&T NY mobile number. SMS reads: \"YOU disabled AUTO-SCAN 4 days ago. Your device has been infected 4 secret files. Remove them immediately \". SMS spearphishing content has poor grammar, likely non-US actor. Attacker uses Domain Generation Algorithms (DGA) to register via NameCheap and host on Alibaba-US. Generated FQDNs are typically 7-characters randomized alphabet (no numbers seen in FQDNs yet) & 6- or 8-character variant seldomly seen. FQDNs are all .com TLDs with several exceptions. The majority of generated FQDNs were registered recently within the last 2-weeks. FQDNs carry a 8-character alphanumeric URI to identify targets. Odd *.net and *.info FQDN exceptions are potential orchestrations or initializers - these specific FQDN were registered early-to-mid July 2024. ASN: AS45102 - Alibaba-US Cloud. Domains are generated with privacy-protection.", "modified": "2024-11-24T18:05:05.777000", "created": "2024-10-25T20:04:03.930000", "tags": [ "SMS", "Phishing", "AT&T", "Alibaba", "Alibaba Cloud", "Virginia", "Mobile", "Phone", "NameCheap", "New York", "Spam", "China", "DGA", "Domain Generation Algorithm", "MalwareMorghulis", "Scam", "AS45102", "Cats Cradle" ], "references": [ "https://whois.domaintools.com/wncsbxn.com", "https://whois.domaintools.com/2z7rpv.info", "https://securitytrails.com/list/ip/47.253.171.249" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1192", "name": "Spearphishing Link", "display_name": "T1192 - Spearphishing Link" }, { "id": "T1194", "name": "Spearphishing via Service", "display_name": "T1194 - Spearphishing via Service" }, { "id": "T1598.003", "name": "Spearphishing Link", "display_name": "T1598.003 - Spearphishing Link" }, { "id": "T1568.002", "name": "Domain Generation Algorithms", "display_name": "T1568.002 - Domain Generation Algorithms" }, { "id": "T1483", "name": "Domain Generation Algorithms", "display_name": "T1483 - Domain Generation Algorithms" }, { "id": "T1520", "name": "Domain Generation Algorithms", "display_name": "T1520 - Domain Generation Algorithms" } ], "industries": [ "Telecommunications" ], "TLP": "green", "cloned_from": null, "export_count": 32, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "MalwareMorghulis", "id": "202965", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202965/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 9568, "URL": 9568 }, "indicator_count": 19136, "is_author": false, "is_subscribing": null, "subscriber_count": 59, "modified_text": "555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "ifoplu.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "ifoplu.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780500966.084467 }