{
  "type": "Domain",
  "indicator": "infernolo.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/infernolo.com",
    "alexa": "http://www.alexa.com/siteinfo/infernolo.com",
    "indicator": "infernolo.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4150652462,
      "indicator": "infernolo.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "691b8869e00b107fa20d9482",
          "name": "ThreatFix",
          "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
          "modified": "2026-01-23T11:01:07.175000",
          "created": "2025-11-17T20:41:11.797000",
          "tags": [
            "",
            "ransomware",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "",
              "display_name": "",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "zlepos384",
            "id": "103244",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 8010,
            "FileHash-SHA1": 7922,
            "FileHash-SHA256": 8893,
            "URL": 57004,
            "domain": 36018,
            "hostname": 96473
          },
          "indicator_count": 214320,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 44,
          "modified_text": "128 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "692dae2bdfd7e18df0f1e5b0",
          "name": "qAWSDFGHJ",
          "description": "Web users are being urged to check their accounts before they use them, as well as taking part in a series of security checks. and a number of other security-related web-based sites.",
          "modified": "2025-12-31T15:01:28.564000",
          "created": "2025-12-01T15:03:07.147000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "SOC__critical43",
            "id": "361186",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 25,
            "hostname": 4
          },
          "indicator_count": 29,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 22,
          "modified_text": "151 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "692d7519544b62e86aa47157",
          "name": "EbeeNov2025 Pt5",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2025-12-31T10:00:16.038000",
          "created": "2025-12-01T10:59:37.970000",
          "tags": [
            "filehashsha256",
            "filehashmd5",
            "filehashsha1",
            "filepath",
            "cve20243721 cve",
            "cve20131599 cve",
            "cve20143206 cve",
            "cve20179841 cve",
            "cve20199082 cve",
            "cve20208958 cve"
          ],
          "references": [
            "Book1.csv"
          ],
          "public": 1,
          "adversary": "APT24, Autumn Dragon, Operation DreamJob, Water Gamayun, Shai-Hulud Campaign Infecting Macs via Face",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 54,
            "CVE": 35,
            "FileHash-MD5": 221,
            "FileHash-SHA1": 188,
            "FileHash-SHA256": 232,
            "domain": 150,
            "email": 1,
            "hostname": 40
          },
          "indicator_count": 921,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 41,
          "modified_text": "151 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "692d400f81164107d98922db",
          "name": "Injector.BO : DNS Reply Sinkhole via Phishing emails , texts , drives or malicious links",
          "description": "\"Phishing threat: This is a phishing website that impersonates a trusted website to trick you into revealing personal or financial information.\";var L_MalwareThreat_TEXT = \"Malicious software threat: This site contains links to viruses or other software programs that can reveal personal information stored or typed on your computer to malicious persons",
          "modified": "2025-12-31T06:01:00.551000",
          "created": "2025-12-01T07:13:19.659000",
          "tags": [
            "url http",
            "url https",
            "urls",
            "files",
            "address",
            "asn as400519",
            "united states",
            "info geo",
            "united",
            "as400519",
            "us note",
            "route",
            "ipv4",
            "live",
            "superdata",
            "viet nam",
            "cisco umbrella",
            "sectigo rsa",
            "secure",
            "google safe",
            "browsing",
            "current dns",
            "a record",
            "input",
            "closenotify",
            "phpsessid value",
            "source level",
            "url text",
            "general full",
            "protocol h2",
            "security tls",
            "ecdhersa",
            "asn45544",
            "reverse dns",
            "resource",
            "hash",
            "as45544",
            "vn note",
            "backdoor",
            "generic",
            "cnc activity",
            "passive dns",
            "ipv4 add",
            "company limited",
            "dnssec",
            "hostname add",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "t1480 execution",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ip address",
            "vietnam",
            "location viet",
            "nam flag",
            "urlhttp",
            "extracted files",
            "unicode text",
            "utf8 text",
            "lowfihstr",
            "trojan",
            "mtb trojan",
            "spawns",
            "found",
            "process details",
            "flag",
            "contacted",
            "xb6x04x00",
            "t1055",
            "search",
            "read c",
            "cnlolcat",
            "microsoft",
            "medium",
            "entries",
            "unknown",
            "virtool",
            "malware",
            "copy",
            "write",
            "win32",
            "next",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "china unknown",
            "creation date",
            "body",
            "please",
            "x msedge",
            "tracking"
          ],
          "references": [
            "anonsecbotnet.cameraddns.net",
            "https://api.playit.gg/agents/routing/get",
            "http://www.google.com-viruswall1-source-cloud-computing-services-distribution.cpdev.dyson.cn/",
            "https://www.endgamesystems.com/",
            "IDS Detections : DNS Rep Sinkhole - Microsoft - 199.2.137.0/24"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:MSIL/Ranos.A",
              "display_name": "Trojan:MSIL/Ranos.A",
              "target": "/malware/Trojan:MSIL/Ranos.A"
            },
            {
              "id": "Trojan:MSIL/ClipBanker.GC!MTB",
              "display_name": "Trojan:MSIL/ClipBanker.GC!MTB",
              "target": "/malware/Trojan:MSIL/ClipBanker.GC!MTB"
            },
            {
              "id": "Win.Packed.Msilperseus-9956592-0",
              "display_name": "Win.Packed.Msilperseus-9956592-0",
              "target": null
            },
            {
              "id": "ALF:Backdoor:MSIL/Noancooe.",
              "display_name": "ALF:Backdoor:MSIL/Noancooe.",
              "target": null
            },
            {
              "id": "Win.Trojan.Generic-6417450-0",
              "display_name": "Win.Trojan.Generic-6417450-0",
              "target": null
            },
            {
              "id": "Win.Packed.Bladabindi-6872770-0",
              "display_name": "Win.Packed.Bladabindi-6872770-0",
              "target": null
            },
            {
              "id": "#LowFiHSTR:MSIL/Confuser",
              "display_name": "#LowFiHSTR:MSIL/Confuser",
              "target": "/malware/#LowFiHSTR:MSIL/Confuser"
            },
            {
              "id": "Win.Dropper.njRAT-10015886-0",
              "display_name": "Win.Dropper.njRAT-10015886-0",
              "target": null
            },
            {
              "id": "Backdoor:MSIL/Bladabindi.AP",
              "display_name": "Backdoor:MSIL/Bladabindi.AP",
              "target": "/malware/Backdoor:MSIL/Bladabindi.AP"
            },
            {
              "id": "Win.Packed.Generic-9795615-0",
              "display_name": "Win.Packed.Generic-9795615-0",
              "target": null
            },
            {
              "id": "Win.Packed.Generic-9795615-0",
              "display_name": "Win.Packed.Generic-9795615-0",
              "target": null
            },
            {
              "id": "Win.Packed.Fecn-7077459-0",
              "display_name": "Win.Packed.Fecn-7077459-0",
              "target": null
            },
            {
              "id": "Win.Packed.Marsilia-10021147-0",
              "display_name": "Win.Packed.Marsilia-10021147-0",
              "target": null
            },
            {
              "id": "VirTool:Win32/Injector.BO",
              "display_name": "VirTool:Win32/Injector.BO",
              "target": "/malware/VirTool:Win32/Injector.BO"
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1578.001",
              "name": "Create Snapshot",
              "display_name": "T1578.001 - Create Snapshot"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1011",
              "name": "Exfiltration Over Other Network Medium",
              "display_name": "T1011 - Exfiltration Over Other Network Medium"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1610,
            "domain": 147,
            "hostname": 501,
            "FileHash-SHA256": 384,
            "CIDR": 3,
            "FileHash-MD5": 79,
            "FileHash-SHA1": 77,
            "email": 3,
            "SSLCertFingerprint": 1
          },
          "indicator_count": 2805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "151 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69269a713e9ed36acadcbd6f",
          "name": "IOC - Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix",
          "description": "Novel \"JackFix\" attack: Acronis TRU researchers discover an ongoing campaign that leverages a novel combination of screen hijacking techniques with ClickFix, displaying a realistic, full-screen Windows Update of \u201cCritical Windows Security Updates\u201d to trick victims into executing malicious commands.\nAdult content bait strategy: Campaign leverages fake adult websites (xHamster, PornHub clones) as its phishing mechanism, likely distributed via malvertising. The adult theme, and possible connection to shady websites, add to victim\u2019s psychological pressure, making victims more likely to comply with sudden \u201csecurity update\u201d installation instructions.",
          "modified": "2025-12-26T06:00:46.039000",
          "created": "2025-11-26T06:13:05.062000",
          "tags": [],
          "references": [
            "https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "celestre",
            "id": "295357",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 25,
            "hostname": 4
          },
          "indicator_count": 29,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "156 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "691b86538bc9d6168b54ed7e",
          "name": "ThreatFix",
          "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
          "modified": "2025-12-17T20:05:25.178000",
          "created": "2025-11-17T20:32:18.360000",
          "tags": [
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "zlepos384",
            "id": "103244",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 55,
            "FileHash-SHA1": 53,
            "FileHash-SHA256": 54,
            "URL": 1581,
            "domain": 374,
            "hostname": 1629
          },
          "indicator_count": 3746,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 35,
          "modified_text": "165 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "anonsecbotnet.cameraddns.net",
        "https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/",
        "https://api.playit.gg/agents/routing/get",
        "Book1.csv",
        "IDS Detections : DNS Rep Sinkhole - Microsoft - 199.2.137.0/24",
        "https://www.endgamesystems.com/",
        "http://www.google.com-viruswall1-source-cloud-computing-services-distribution.cpdev.dyson.cn/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "APT24, Autumn Dragon, Operation DreamJob, Water Gamayun, Shai-Hulud Campaign Infecting Macs via Face"
          ],
          "malware_families": [
            "",
            "Alf:backdoor:msil/noancooe.",
            "Win.packed.msilperseus-9956592-0",
            "Backdoor:msil/bladabindi.ap",
            "Win.packed.marsilia-10021147-0",
            "Trojan:msil/clipbanker.gc!mtb",
            "#lowfihstr:msil/confuser",
            "Win.packed.fecn-7077459-0",
            "Win.packed.generic-9795615-0",
            "Win.dropper.njrat-10015886-0",
            "Virtool:win32/injector.bo",
            "Win.packed.bladabindi-6872770-0",
            "Trojan:msil/ranos.a",
            "Win.trojan.generic-6417450-0"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "691b8869e00b107fa20d9482",
      "name": "ThreatFix",
      "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
      "modified": "2026-01-23T11:01:07.175000",
      "created": "2025-11-17T20:41:11.797000",
      "tags": [
        "",
        "ransomware",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "",
          "display_name": "",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "zlepos384",
        "id": "103244",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 8010,
        "FileHash-SHA1": 7922,
        "FileHash-SHA256": 8893,
        "URL": 57004,
        "domain": 36018,
        "hostname": 96473
      },
      "indicator_count": 214320,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 44,
      "modified_text": "128 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "692dae2bdfd7e18df0f1e5b0",
      "name": "qAWSDFGHJ",
      "description": "Web users are being urged to check their accounts before they use them, as well as taking part in a series of security checks. and a number of other security-related web-based sites.",
      "modified": "2025-12-31T15:01:28.564000",
      "created": "2025-12-01T15:03:07.147000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "SOC__critical43",
        "id": "361186",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 25,
        "hostname": 4
      },
      "indicator_count": 29,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 22,
      "modified_text": "151 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "692d7519544b62e86aa47157",
      "name": "EbeeNov2025 Pt5",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2025-12-31T10:00:16.038000",
      "created": "2025-12-01T10:59:37.970000",
      "tags": [
        "filehashsha256",
        "filehashmd5",
        "filehashsha1",
        "filepath",
        "cve20243721 cve",
        "cve20131599 cve",
        "cve20143206 cve",
        "cve20179841 cve",
        "cve20199082 cve",
        "cve20208958 cve"
      ],
      "references": [
        "Book1.csv"
      ],
      "public": 1,
      "adversary": "APT24, Autumn Dragon, Operation DreamJob, Water Gamayun, Shai-Hulud Campaign Infecting Macs via Face",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 54,
        "CVE": 35,
        "FileHash-MD5": 221,
        "FileHash-SHA1": 188,
        "FileHash-SHA256": 232,
        "domain": 150,
        "email": 1,
        "hostname": 40
      },
      "indicator_count": 921,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 41,
      "modified_text": "151 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "692d400f81164107d98922db",
      "name": "Injector.BO : DNS Reply Sinkhole via Phishing emails , texts , drives or malicious links",
      "description": "\"Phishing threat: This is a phishing website that impersonates a trusted website to trick you into revealing personal or financial information.\";var L_MalwareThreat_TEXT = \"Malicious software threat: This site contains links to viruses or other software programs that can reveal personal information stored or typed on your computer to malicious persons",
      "modified": "2025-12-31T06:01:00.551000",
      "created": "2025-12-01T07:13:19.659000",
      "tags": [
        "url http",
        "url https",
        "urls",
        "files",
        "address",
        "asn as400519",
        "united states",
        "info geo",
        "united",
        "as400519",
        "us note",
        "route",
        "ipv4",
        "live",
        "superdata",
        "viet nam",
        "cisco umbrella",
        "sectigo rsa",
        "secure",
        "google safe",
        "browsing",
        "current dns",
        "a record",
        "input",
        "closenotify",
        "phpsessid value",
        "source level",
        "url text",
        "general full",
        "protocol h2",
        "security tls",
        "ecdhersa",
        "asn45544",
        "reverse dns",
        "resource",
        "hash",
        "as45544",
        "vn note",
        "backdoor",
        "generic",
        "cnc activity",
        "passive dns",
        "ipv4 add",
        "company limited",
        "dnssec",
        "hostname add",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "t1480 execution",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ip address",
        "vietnam",
        "location viet",
        "nam flag",
        "urlhttp",
        "extracted files",
        "unicode text",
        "utf8 text",
        "lowfihstr",
        "trojan",
        "mtb trojan",
        "spawns",
        "found",
        "process details",
        "flag",
        "contacted",
        "xb6x04x00",
        "t1055",
        "search",
        "read c",
        "cnlolcat",
        "microsoft",
        "medium",
        "entries",
        "unknown",
        "virtool",
        "malware",
        "copy",
        "write",
        "win32",
        "next",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "china unknown",
        "creation date",
        "body",
        "please",
        "x msedge",
        "tracking"
      ],
      "references": [
        "anonsecbotnet.cameraddns.net",
        "https://api.playit.gg/agents/routing/get",
        "http://www.google.com-viruswall1-source-cloud-computing-services-distribution.cpdev.dyson.cn/",
        "https://www.endgamesystems.com/",
        "IDS Detections : DNS Rep Sinkhole - Microsoft - 199.2.137.0/24"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:MSIL/Ranos.A",
          "display_name": "Trojan:MSIL/Ranos.A",
          "target": "/malware/Trojan:MSIL/Ranos.A"
        },
        {
          "id": "Trojan:MSIL/ClipBanker.GC!MTB",
          "display_name": "Trojan:MSIL/ClipBanker.GC!MTB",
          "target": "/malware/Trojan:MSIL/ClipBanker.GC!MTB"
        },
        {
          "id": "Win.Packed.Msilperseus-9956592-0",
          "display_name": "Win.Packed.Msilperseus-9956592-0",
          "target": null
        },
        {
          "id": "ALF:Backdoor:MSIL/Noancooe.",
          "display_name": "ALF:Backdoor:MSIL/Noancooe.",
          "target": null
        },
        {
          "id": "Win.Trojan.Generic-6417450-0",
          "display_name": "Win.Trojan.Generic-6417450-0",
          "target": null
        },
        {
          "id": "Win.Packed.Bladabindi-6872770-0",
          "display_name": "Win.Packed.Bladabindi-6872770-0",
          "target": null
        },
        {
          "id": "#LowFiHSTR:MSIL/Confuser",
          "display_name": "#LowFiHSTR:MSIL/Confuser",
          "target": "/malware/#LowFiHSTR:MSIL/Confuser"
        },
        {
          "id": "Win.Dropper.njRAT-10015886-0",
          "display_name": "Win.Dropper.njRAT-10015886-0",
          "target": null
        },
        {
          "id": "Backdoor:MSIL/Bladabindi.AP",
          "display_name": "Backdoor:MSIL/Bladabindi.AP",
          "target": "/malware/Backdoor:MSIL/Bladabindi.AP"
        },
        {
          "id": "Win.Packed.Generic-9795615-0",
          "display_name": "Win.Packed.Generic-9795615-0",
          "target": null
        },
        {
          "id": "Win.Packed.Generic-9795615-0",
          "display_name": "Win.Packed.Generic-9795615-0",
          "target": null
        },
        {
          "id": "Win.Packed.Fecn-7077459-0",
          "display_name": "Win.Packed.Fecn-7077459-0",
          "target": null
        },
        {
          "id": "Win.Packed.Marsilia-10021147-0",
          "display_name": "Win.Packed.Marsilia-10021147-0",
          "target": null
        },
        {
          "id": "VirTool:Win32/Injector.BO",
          "display_name": "VirTool:Win32/Injector.BO",
          "target": "/malware/VirTool:Win32/Injector.BO"
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1578.001",
          "name": "Create Snapshot",
          "display_name": "T1578.001 - Create Snapshot"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1011",
          "name": "Exfiltration Over Other Network Medium",
          "display_name": "T1011 - Exfiltration Over Other Network Medium"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1610,
        "domain": 147,
        "hostname": 501,
        "FileHash-SHA256": 384,
        "CIDR": 3,
        "FileHash-MD5": 79,
        "FileHash-SHA1": 77,
        "email": 3,
        "SSLCertFingerprint": 1
      },
      "indicator_count": 2805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "151 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69269a713e9ed36acadcbd6f",
      "name": "IOC - Fake adult websites pop realistic Windows Update screen to deliver stealers via ClickFix",
      "description": "Novel \"JackFix\" attack: Acronis TRU researchers discover an ongoing campaign that leverages a novel combination of screen hijacking techniques with ClickFix, displaying a realistic, full-screen Windows Update of \u201cCritical Windows Security Updates\u201d to trick victims into executing malicious commands.\nAdult content bait strategy: Campaign leverages fake adult websites (xHamster, PornHub clones) as its phishing mechanism, likely distributed via malvertising. The adult theme, and possible connection to shady websites, add to victim\u2019s psychological pressure, making victims more likely to comply with sudden \u201csecurity update\u201d installation instructions.",
      "modified": "2025-12-26T06:00:46.039000",
      "created": "2025-11-26T06:13:05.062000",
      "tags": [],
      "references": [
        "https://www.acronis.com/en/tru/posts/fake-adult-websites-pop-realistic-windows-update-screen-to-deliver-stealers-via-clickfix/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "celestre",
        "id": "295357",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 25,
        "hostname": 4
      },
      "indicator_count": 29,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "156 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "691b86538bc9d6168b54ed7e",
      "name": "ThreatFix",
      "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
      "modified": "2025-12-17T20:05:25.178000",
      "created": "2025-11-17T20:32:18.360000",
      "tags": [
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "zlepos384",
        "id": "103244",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 55,
        "FileHash-SHA1": 53,
        "FileHash-SHA256": 54,
        "URL": 1581,
        "domain": 374,
        "hostname": 1629
      },
      "indicator_count": 3746,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 35,
      "modified_text": "165 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "infernolo.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "infernolo.com",
    "found": true,
    "verdict": "malicious",
    "url_count": 2,
    "online_count": 0,
    "blacklists": {
      "spamhaus_dbl": "malware_domain",
      "surbl": "not listed"
    },
    "urls": [
      {
        "url": "https://infernolo.com/xxx.html",
        "status": "offline",
        "threat": "malware_download",
        "date_added": "2025-11-14",
        "tags": []
      },
      {
        "url": "https://infernolo.com/xhamster.html",
        "status": "offline",
        "threat": "malware_download",
        "date_added": "2025-11-14",
        "tags": []
      }
    ],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780290048.6542838
}