{ "type": "Domain", "indicator": "lavacolla.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/lavacolla.com", "alexa": "http://www.alexa.com/siteinfo/lavacolla.com", "indicator": "lavacolla.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3639225859, "indicator": "lavacolla.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "69ff412952392b68b508c7cb", "name": "Malware_Distribution | May 10, 2026", "description": "Malware_Distribution indicators. Date: May 10, 2026. Total: 1158 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-09T14:14:01.707000", "created": "2026-05-09T14:14:01.707000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 934, "domain": 222 }, "indicator_count": 1156, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ca0d72dcc2895ba92a44ea", "name": "Malware_Distribution | Mar 30, 2026", "description": "Malware_Distribution indicators. Date: Mar 30, 2026. Total: 446 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-30T05:43:14.938000", "created": "2026-03-30T05:43:14.938000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 154, "domain": 290 }, "indicator_count": 444, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "63 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696c991debb12023a1357e3", "name": "DroidJack RAT IOCs - SEC-1275-1", "description": "", "modified": "2024-08-15T19:03:41.303000", "created": "2024-07-16T19:27:13.260000", "tags": [ "droidjack", "android", "toggle", "sqlite", "sandrorat", "compromise ipv4", "urls http", "sha1", "sha256", "gigabud rat" ], "references": [ "https://1275.ru/ioc/1635/droidjack-rat-iocs/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 692, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "domain": 150, "hostname": 70 }, "indicator_count": 918, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "654 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657098238d560b5a2c145238", "name": "Threat Intel Report - W10-2023", "description": "", "modified": "2023-12-06T15:49:55.714000", "created": "2023-12-06T15:49:55.714000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 115, "FileHash-MD5": 37, "FileHash-SHA1": 36, "domain": 111, "hostname": 45, "URL": 126, "CVE": 1 }, "indicator_count": 471, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64ea8dcc0996d9b18b488a0b", "name": "Malware Filter - Phishing List - 26-08-2023", "description": "", "modified": "2023-08-26T23:42:04.157000", "created": "2023-08-26T23:42:04.157000", "tags": [], "references": [ "https://malware-filter.gitlab.io/malware-filter/phishing-filter-domains.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 589, "domain": 192 }, "indicator_count": 781, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1009 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6405a6de497ebe979d72992c", "name": "Threat Intel Report - W10-2023", "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.", "modified": "2023-04-05T08:01:26.224000", "created": "2023-03-06T08:39:58.152000", "tags": [ "microsoft", "windows", "cvss", "cvss base", "python package", "aruba networks", "rce flaw", "february", "asiapacific", "north america", "gootloader", "plugx", "meterpreter", "parallax rat", "fakeupdates", "trojan", "exploit", "enterprise", "play ransomware", "hashes domains", "russia", "japan", "germany", "indonesia", "ip address", "blacklist host", "ip country", "latest spambot", "visit", "activity", "quakbot tr", "ita italy", "formbook", "stealc", "icedid", "donot", "socelars", "gozi ita", "astaroth bra", "guildma", "recordbreaker", "redlinestealer", "remcosrat", "coinminer", "sha1 file", "name submit" ], "references": [ "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time", "https://www.dnsbl.info/", "https://www.spamhaus.org/xbl/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 37, "FileHash-SHA1": 36, "FileHash-SHA256": 115, "domain": 111, "hostname": 45, "URL": 126, "CVE": 1 }, "indicator_count": 471, "is_author": false, "is_subscribing": null, "subscriber_count": 107, "modified_text": "1153 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.spamhaus.org/xbl/", "https://www.dnsbl.info/", "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time", "https://malware-filter.gitlab.io/malware-filter/phishing-filter-domains.txt", "https://1275.ru/ioc/1635/droidjack-rat-iocs/", "https://ltna.com.au/cyber" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "69ff412952392b68b508c7cb", "name": "Malware_Distribution | May 10, 2026", "description": "Malware_Distribution indicators. Date: May 10, 2026. Total: 1158 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-05-09T14:14:01.707000", "created": "2026-05-09T14:14:01.707000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 934, "domain": 222 }, "indicator_count": 1156, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "23 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ca0d72dcc2895ba92a44ea", "name": "Malware_Distribution | Mar 30, 2026", "description": "Malware_Distribution indicators. Date: Mar 30, 2026. Total: 446 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-30T05:43:14.938000", "created": "2026-03-30T05:43:14.938000", "tags": [ "malware_distribution" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 154, "domain": 290 }, "indicator_count": 444, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "63 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6696c991debb12023a1357e3", "name": "DroidJack RAT IOCs - SEC-1275-1", "description": "", "modified": "2024-08-15T19:03:41.303000", "created": "2024-07-16T19:27:13.260000", "tags": [ "droidjack", "android", "toggle", "sqlite", "sandrorat", "compromise ipv4", "urls http", "sha1", "sha256", "gigabud rat" ], "references": [ "https://1275.ru/ioc/1635/droidjack-rat-iocs/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "chiendn2k1@", "id": "286155", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 692, "FileHash-MD5": 2, "FileHash-SHA1": 2, "FileHash-SHA256": 2, "domain": 150, "hostname": 70 }, "indicator_count": 918, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "654 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "657098238d560b5a2c145238", "name": "Threat Intel Report - W10-2023", "description": "", "modified": "2023-12-06T15:49:55.714000", "created": "2023-12-06T15:49:55.714000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 115, "FileHash-MD5": 37, "FileHash-SHA1": 36, "domain": 111, "hostname": 45, "URL": 126, "CVE": 1 }, "indicator_count": 471, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64ea8dcc0996d9b18b488a0b", "name": "Malware Filter - Phishing List - 26-08-2023", "description": "", "modified": "2023-08-26T23:42:04.157000", "created": "2023-08-26T23:42:04.157000", "tags": [], "references": [ "https://malware-filter.gitlab.io/malware-filter/phishing-filter-domains.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 589, "domain": 192 }, "indicator_count": 781, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1009 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6405a6de497ebe979d72992c", "name": "Threat Intel Report - W10-2023", "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools.\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week.\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools.\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.", "modified": "2023-04-05T08:01:26.224000", "created": "2023-03-06T08:39:58.152000", "tags": [ "microsoft", "windows", "cvss", "cvss base", "python package", "aruba networks", "rce flaw", "february", "asiapacific", "north america", "gootloader", "plugx", "meterpreter", "parallax rat", "fakeupdates", "trojan", "exploit", "enterprise", "play ransomware", "hashes domains", "russia", "japan", "germany", "indonesia", "ip address", "blacklist host", "ip country", "latest spambot", "visit", "activity", "quakbot tr", "ita italy", "formbook", "stealc", "icedid", "donot", "socelars", "gozi ita", "astaroth bra", "guildma", "recordbreaker", "redlinestealer", "remcosrat", "coinminer", "sha1 file", "name submit" ], "references": [ "https://myip.ms/browse/blacklist/Blacklist_IP_Blacklist_IP_Addresses_Live_Database_Real-time", "https://www.dnsbl.info/", "https://www.spamhaus.org/xbl/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "aa00643640@techmahindra.com", "id": "156540", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 37, "FileHash-SHA1": 36, "FileHash-SHA256": 115, "domain": 111, "hostname": 45, "URL": 126, "CVE": 1 }, "indicator_count": 471, "is_author": false, "is_subscribing": null, "subscriber_count": 107, "modified_text": "1153 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "lavacolla.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "lavacolla.com", "found": true, "verdict": "malicious", "url_count": 7, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "http://lavacolla.com/centro/index.php", "status": "offline", "threat": "malware_download", "date_added": "2023-10-09", "tags": [ "geofenced", "Gozi", "ISFB", "ITA", "redir-302", "ursnif", "zip" ] }, { "url": "http://lavacolla.com/codice/Documenti.zip", "status": "offline", "threat": "malware_download", "date_added": "2023-10-09", "tags": [ "agenziaentrate", "geo", "Gozi", "ISFB", "ITA", "ursnif" ] }, { "url": "https://lavacolla.com/connect/", "status": "offline", "threat": "malware_download", "date_added": "2023-03-14", "tags": [ "250255", "7710", "geofenced", "Gozi", "ISFB", "ITA", "redir-302", "ursnif" ] }, { "url": "https://lavacolla.com/agenzia/", "status": "offline", "threat": "malware_download", "date_added": "2023-03-14", "tags": [ "250255", "7710", "geofenced", "Gozi", "ISFB", "ITA", "redir-302", "ursnif" ] }, { "url": "https://lavacolla.com/scarica/", "status": "offline", "threat": "malware_download", "date_added": "2023-03-14", "tags": [ "250255", "7710", "geofenced", "Gozi", "ISFB", "ITA", "redir-302", "ursnif" ] }, { "url": "http://lavacolla.com/impresa/Agenzia_Entrate.zip", "status": "offline", "threat": "malware_download", "date_added": "2023-03-02", "tags": [ "agenziaentrate", "BIG", "Gozi", "ITA", "malware", "stealer" ] }, { "url": "http://lavacolla.com/connect/index.php", "status": "offline", "threat": "malware_download", "date_added": "2023-03-02", "tags": [ "agenziaentrate", "geofenced", "Gozi", "ITA", "redir-302", "SMB", "ursnif" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780332528.3494852 }