{ "type": "Domain", "indicator": "kevtel.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/kevtel.com", "alexa": "http://www.alexa.com/siteinfo/kevtel.com", "indicator": "kevtel.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4368903226, "indicator": "kevtel.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 15, "pulses": [ { "id": "6a199f346e290a5bd9b58df7", "name": "Malware_Distribution | May 30, 2026", "description": "Malware_Distribution indicators. Date: May 30, 2026. Total: 466 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-29T14:14:11.973000", "created": "2026-05-29T14:14:11.973000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 258, "domain": 206 }, "indicator_count": 464, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1 day ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a184e6ede2664d44cd279b8", "name": "Malware_Distribution | May 29, 2026", "description": "Malware_Distribution indicators. Date: May 29, 2026. Total: 490 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-28T14:17:18.031000", "created": "2026-05-28T14:17:18.031000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 255, "domain": 232 }, "indicator_count": 487, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "2 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a17961b0d1a36514a95e8e3", "name": "URLHaus data - 27-05-2026 (Part 2)", "description": "", "modified": "2026-05-28T01:10:51.796000", "created": "2026-05-28T01:10:51.796000", "tags": [ "32-bit", "elf", "mips", "Mozi", "ClearFake", "arm", "mirai", "base64", "Encoded", "opendir", "rat", "vbs", "ua-wget", "x86", "m68k", "sparc", "SuperH", "PowerPC", "9d2ca3", "dropped-by-amadey", "dcrat", "Lumma", "ps1", "stealer", "exe", "WsgiDAV", "lnk", "ocx", "remcos", "c2-monitor-auto", "botnetdomain", "54e64e", "MaskGramStealer", "CoinMiner", "sh", "176-65-149-142", "95-182-98-126", "46-8-70-117", "45-156-24-108", "android", "btmob", "dropper", "trojan", "wraith", "ascii", "Prometei", "Win-x64", "script", "x86-32", "176-65-139-89", "176-65-139-119", "176-65-139-209", "213-21-233-188", "176-65-139-245", "176-65-139-68", "176-65-139-46", "176-65-139-196", "176-65-139-20", "PureHVNC", "powershell", "ua-ps", "gafgyt", "github", "BlankGrabber", "rustystealer", "Havoc", "arc", "d52f85" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 251, "IPv4": 85, "domain": 3, "hostname": 29 }, "indicator_count": 368, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a1757b0942b674cb03f4d6d", "name": "dghfghfgdrth", "description": "", "modified": "2026-05-27T20:44:32.373000", "created": "2026-05-27T20:44:32.373000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 100, "URL": 790, "FileHash-MD5": 92, "FileHash-SHA1": 22, "FileHash-SHA256": 24, "IPv4": 2681, "hostname": 316 }, "indicator_count": 4025, "is_author": false, "is_subscribing": null, "subscriber_count": 16, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a1755fb1fad21ac81272704", "name": "fdghjk", "description": "The world's largest body of human evolution has a new leader - and it's got a lot of work to do - to make sure it doesn't look like it is going to get any worse.", "modified": "2026-05-27T20:37:15.741000", "created": "2026-05-27T20:37:15.741000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 100, "URL": 788, "FileHash-MD5": 92, "FileHash-SHA1": 22, "FileHash-SHA256": 24, "IPv4": 2680, "hostname": 315 }, "indicator_count": 4021, "is_author": false, "is_subscribing": null, "subscriber_count": 16, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a16fc38f105e20d5e8b447a", "name": "Malware_Distribution | May 28, 2026", "description": "Malware_Distribution indicators. Date: May 28, 2026. Total: 510 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-27T14:14:16.478000", "created": "2026-05-27T14:14:16.478000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 269, "domain": 238 }, "indicator_count": 507, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a16314d0641a9d2b1e45ff5", "name": "sgdbvsd", "description": "", "modified": "2026-05-26T23:48:29.065000", "created": "2026-05-26T23:48:29.065000", "tags": [ "quofe", "eogbhwqxn" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 461, "FileHash-MD5": 98, "FileHash-SHA1": 18, "FileHash-SHA256": 22, "IPv4": 3870, "domain": 127, "hostname": 222 }, "indicator_count": 4818, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "4 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a1631486431902d25c25a31", "name": "sgdbvsd", "description": "", "modified": "2026-05-26T23:48:24.582000", "created": "2026-05-26T23:48:24.582000", "tags": [ "quofe", "eogbhwqxn" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 461, "FileHash-MD5": 98, "FileHash-SHA1": 18, "FileHash-SHA256": 22, "IPv4": 3870, "domain": 127, "hostname": 222 }, "indicator_count": 4818, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "4 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a15aafd7bffd47dcf939626", "name": "Malware_Distribution | May 27, 2026", "description": "Malware_Distribution indicators. Date: May 27, 2026. Total: 478 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-26T14:15:25.324000", "created": "2026-05-26T14:15:25.324000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 229, "domain": 247 }, "indicator_count": 476, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "4 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a14f27e28a4ce5bd6510da1", "name": "URLHaus data - 25-05-2026 (Part 2)", "description": "", "modified": "2026-05-26T01:08:14.269000", "created": "2026-05-26T01:08:14.269000", "tags": [ "exe", "opendir", "32-bit", "elf", "mips", "Mozi", "ClearFake", "vbs", "base64", "Encoded", "github", "gitlab", "rat", "bat", "trycloudflare", "zip", "js", "ua-wget", "WsgiDAV", "wsh", "mirai", "botnetdomain", "c2-monitor-auto", "dropped-by-amadey", "MaskGramStealer", "script", "arm", "sh", "gafgyt", "54e64e", "CoinMiner", "VoidStealer", "EchoStealer", "jar", "SilentNet", "VantaRAT", "rev-base64-loader", "jpg-base64-loader", "GOStealer", "stealer", "SalatStealer" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 244, "IPv4": 101, "hostname": 36, "domain": 5 }, "indicator_count": 386, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "5 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a14e0615dfac08de073086a", "name": "ergdg", "description": "", "modified": "2026-05-25T23:50:57.763000", "created": "2026-05-25T23:50:57.763000", "tags": [ "quofe", "eogbhwqxn" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 66, "URL": 344, "FileHash-MD5": 42, "FileHash-SHA1": 1, "FileHash-SHA256": 7, "IPv4": 2519, "hostname": 121 }, "indicator_count": 3100, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "5 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a106545443f8c3be2af60e4", "name": "Malware_Distribution | May 23, 2026", "description": "Malware_Distribution indicators. Date: May 23, 2026. Total: 513 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-22T14:16:37.024000", "created": "2026-05-22T14:16:37.024000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 189, "domain": 322 }, "indicator_count": 511, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "8 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0f13ac0ba8131b67d79bc0", "name": "Malware_Distribution | May 22, 2026", "description": "Malware_Distribution indicators. Date: May 22, 2026. Total: 515 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-21T14:16:12.118000", "created": "2026-05-21T14:16:12.118000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 184, "domain": 329 }, "indicator_count": 513, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0e5ac9323cbdcd9cff7cbe", "name": "URLHaus data - 20-05-2026 (Part 3)", "description": "", "modified": "2026-05-21T01:07:21.475000", "created": "2026-05-21T01:07:21.475000", "tags": [ "ClearFake", "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "54e64e", "dropped-by-amadey", "sh", "ua-wget", "xml", "104-236-37-21", "hajime", "backdoor", "sshdkit", "exe", "opendir", "meterpreter", "ocx", "WsgiDAV", "DDoSAgent", "botnetdomain", "gafgyt", "ua-mshta", "VantaRAT", "jar", "WeedHack", "SilentNet", "104-131-37-178", "ascii", "powershell", "ps1", "rustystealer", "194-58-47-204", "31-42-176-91", "connectwise", "PureHVNC", "PureRAT", "rat", "vbs", "c2-monitor-auto", "script", "ClickFix", "ua-powershell", "finger", "9d2ca3", "android" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 111, "URL": 251, "hostname": 15, "domain": 30 }, "indicator_count": 407, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0dc1dcc2aa4e37ea1005ba", "name": "Malware_Distribution | May 21, 2026", "description": "Malware_Distribution indicators. Date: May 21, 2026. Total: 534 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-20T14:14:52.366000", "created": "2026-05-20T14:14:52.366000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 166, "domain": 366 }, "indicator_count": 532, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "10 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/", "https://ltna.com.au/cyber" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 15, "pulses": [ { "id": "6a199f346e290a5bd9b58df7", "name": "Malware_Distribution | May 30, 2026", "description": "Malware_Distribution indicators. Date: May 30, 2026. Total: 466 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-29T14:14:11.973000", "created": "2026-05-29T14:14:11.973000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 258, "domain": 206 }, "indicator_count": 464, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "1 day ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a184e6ede2664d44cd279b8", "name": "Malware_Distribution | May 29, 2026", "description": "Malware_Distribution indicators. Date: May 29, 2026. Total: 490 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-28T14:17:18.031000", "created": "2026-05-28T14:17:18.031000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 255, "domain": 232 }, "indicator_count": 487, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "2 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a17961b0d1a36514a95e8e3", "name": "URLHaus data - 27-05-2026 (Part 2)", "description": "", "modified": "2026-05-28T01:10:51.796000", "created": "2026-05-28T01:10:51.796000", "tags": [ "32-bit", "elf", "mips", "Mozi", "ClearFake", "arm", "mirai", "base64", "Encoded", "opendir", "rat", "vbs", "ua-wget", "x86", "m68k", "sparc", "SuperH", "PowerPC", "9d2ca3", "dropped-by-amadey", "dcrat", "Lumma", "ps1", "stealer", "exe", "WsgiDAV", "lnk", "ocx", "remcos", "c2-monitor-auto", "botnetdomain", "54e64e", "MaskGramStealer", "CoinMiner", "sh", "176-65-149-142", "95-182-98-126", "46-8-70-117", "45-156-24-108", "android", "btmob", "dropper", "trojan", "wraith", "ascii", "Prometei", "Win-x64", "script", "x86-32", "176-65-139-89", "176-65-139-119", "176-65-139-209", "213-21-233-188", "176-65-139-245", "176-65-139-68", "176-65-139-46", "176-65-139-196", "176-65-139-20", "PureHVNC", "powershell", "ua-ps", "gafgyt", "github", "BlankGrabber", "rustystealer", "Havoc", "arc", "d52f85" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 251, "IPv4": 85, "domain": 3, "hostname": 29 }, "indicator_count": 368, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a1757b0942b674cb03f4d6d", "name": "dghfghfgdrth", "description": "", "modified": "2026-05-27T20:44:32.373000", "created": "2026-05-27T20:44:32.373000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 100, "URL": 790, "FileHash-MD5": 92, "FileHash-SHA1": 22, "FileHash-SHA256": 24, "IPv4": 2681, "hostname": 316 }, "indicator_count": 4025, "is_author": false, "is_subscribing": null, "subscriber_count": 16, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a1755fb1fad21ac81272704", "name": "fdghjk", "description": "The world's largest body of human evolution has a new leader - and it's got a lot of work to do - to make sure it doesn't look like it is going to get any worse.", "modified": "2026-05-27T20:37:15.741000", "created": "2026-05-27T20:37:15.741000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 100, "URL": 788, "FileHash-MD5": 92, "FileHash-SHA1": 22, "FileHash-SHA256": 24, "IPv4": 2680, "hostname": 315 }, "indicator_count": 4021, "is_author": false, "is_subscribing": null, "subscriber_count": 16, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a16fc38f105e20d5e8b447a", "name": "Malware_Distribution | May 28, 2026", "description": "Malware_Distribution indicators. Date: May 28, 2026. Total: 510 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-27T14:14:16.478000", "created": "2026-05-27T14:14:16.478000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 269, "domain": 238 }, "indicator_count": 507, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "3 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a16314d0641a9d2b1e45ff5", "name": "sgdbvsd", "description": "", "modified": "2026-05-26T23:48:29.065000", "created": "2026-05-26T23:48:29.065000", "tags": [ "quofe", "eogbhwqxn" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 461, "FileHash-MD5": 98, "FileHash-SHA1": 18, "FileHash-SHA256": 22, "IPv4": 3870, "domain": 127, "hostname": 222 }, "indicator_count": 4818, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "4 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a1631486431902d25c25a31", "name": "sgdbvsd", "description": "", "modified": "2026-05-26T23:48:24.582000", "created": "2026-05-26T23:48:24.582000", "tags": [ "quofe", "eogbhwqxn" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "harshandc123", "id": "378589", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 461, "FileHash-MD5": 98, "FileHash-SHA1": 18, "FileHash-SHA256": 22, "IPv4": 3870, "domain": 127, "hostname": 222 }, "indicator_count": 4818, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "4 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a15aafd7bffd47dcf939626", "name": "Malware_Distribution | May 27, 2026", "description": "Malware_Distribution indicators. Date: May 27, 2026. Total: 478 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-26T14:15:25.324000", "created": "2026-05-26T14:15:25.324000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 229, "domain": 247 }, "indicator_count": 476, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "4 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a14f27e28a4ce5bd6510da1", "name": "URLHaus data - 25-05-2026 (Part 2)", "description": "", "modified": "2026-05-26T01:08:14.269000", "created": "2026-05-26T01:08:14.269000", "tags": [ "exe", "opendir", "32-bit", "elf", "mips", "Mozi", "ClearFake", "vbs", "base64", "Encoded", "github", "gitlab", "rat", "bat", "trycloudflare", "zip", "js", "ua-wget", "WsgiDAV", "wsh", "mirai", "botnetdomain", "c2-monitor-auto", "dropped-by-amadey", "MaskGramStealer", "script", "arm", "sh", "gafgyt", "54e64e", "CoinMiner", "VoidStealer", "EchoStealer", "jar", "SilentNet", "VantaRAT", "rev-base64-loader", "jpg-base64-loader", "GOStealer", "stealer", "SalatStealer" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 244, "IPv4": 101, "hostname": 36, "domain": 5 }, "indicator_count": 386, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "5 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "kevtel.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "kevtel.com", "found": true, "verdict": "malicious", "url_count": 3, "online_count": 0, "blacklists": { "spamhaus_dbl": "abused_legit_malware", "surbl": "not listed" }, "urls": [ { "url": "https://kevtel.com/Client.exe", "status": "offline", "threat": "malware_download", "date_added": "2026-05-27", "tags": [ "exe", "PureHVNC", "rat" ] }, { "url": "https://kevtel.com/rawww.exe", "status": "offline", "threat": "malware_download", "date_added": "2026-05-25", "tags": [ "PureHVNC" ] }, { "url": "https://kevtel.com/56789023.exe", "status": "offline", "threat": "malware_download", "date_added": "2026-05-20", "tags": [ "PureHVNC" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780203597.6026714 }