{ "type": "Domain", "indicator": "leibk.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/leibk.com", "alexa": "http://www.alexa.com/siteinfo/leibk.com", "indicator": "leibk.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3869573951, "indicator": "leibk.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 6, "pulses": [ { "id": "677e1253ca235f76e783b272", "name": "another checks", "description": "", "modified": "2025-02-07T05:00:08.549000", "created": "2025-01-08T05:51:15.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1403, "domain": 752, "hostname": 546 }, "indicator_count": 2701, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "478 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c25d587348fd36d6bdbd62", "name": "AS29522 Cyber_Folks S.A. (6 months)", "description": "", "modified": "2024-09-17T20:00:10.131000", "created": "2024-08-18T20:45:12.764000", "tags": [ "vgt" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "domain": 2866, "hostname": 2941 }, "indicator_count": 5808, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "620 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66a039f950816e8095349bf1", "name": "AS29522 related (8 months)", "description": "", "modified": "2024-08-23T00:06:48.764000", "created": "2024-07-23T23:17:13.849000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "domain": 4683, "hostname": 4547 }, "indicator_count": 9231, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "646 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66a021b0e9e7da7544c35e60", "name": "AS29522 (6 months)", "description": "", "modified": "2024-08-22T21:04:26.415000", "created": "2024-07-23T21:33:36.187000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2916, "hostname": 2862, "URL": 1 }, "indicator_count": 5779, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "646 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6664bf3fd95299157d7172fe", "name": "cyberfolks.pl", "description": "", "modified": "2024-06-08T20:29:51.204000", "created": "2024-06-08T20:29:51.204000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2855, "hostname": 2271 }, "indicator_count": 5126, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "721 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66108534269b2949fb41cbbb", "name": "URLHaus data - 05-04-2024", "description": "", "modified": "2024-05-05T23:02:44.001000", "created": "2024-04-05T23:11:48.252000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "exe", "VoidRAT", "njRAT", "dropped-by-PrivateLoader", "encrypted", "arm", "SocGholish", "ua-wget", "gafgyt", "Rhadamanthys", "dcrat", "hajime", "base64-encoded-reversed-exe", "PureLogStealer", "AveMariaRAT", "RemcosRAT", "AsyncRAT", "QuasarRAT", "arrowrat", "Gozi", "ddos", "GuLoader", "dll", "RecordBreaker", "DanaBot", "dropped-by-SmokeLoader", "DBatLoader", "geo", "malspam", "poland", "Gh0stRAT", "32", "Socks5Systemz", "x86-32", "1335", "pw-1335", "64", "PrivateLoader", "bashlite", "PowerPC", "motorola", "renesas", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 67, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 777, "domain": 7, "hostname": 8 }, "indicator_count": 792, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "755 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 6, "pulses": [ { "id": "677e1253ca235f76e783b272", "name": "another checks", "description": "", "modified": "2025-02-07T05:00:08.549000", "created": "2025-01-08T05:51:15.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1403, "domain": 752, "hostname": 546 }, "indicator_count": 2701, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "478 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66c25d587348fd36d6bdbd62", "name": "AS29522 Cyber_Folks S.A. (6 months)", "description": "", "modified": "2024-09-17T20:00:10.131000", "created": "2024-08-18T20:45:12.764000", "tags": [ "vgt" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "domain": 2866, "hostname": 2941 }, "indicator_count": 5808, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "620 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66a039f950816e8095349bf1", "name": "AS29522 related (8 months)", "description": "", "modified": "2024-08-23T00:06:48.764000", "created": "2024-07-23T23:17:13.849000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "domain": 4683, "hostname": 4547 }, "indicator_count": 9231, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "646 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66a021b0e9e7da7544c35e60", "name": "AS29522 (6 months)", "description": "", "modified": "2024-08-22T21:04:26.415000", "created": "2024-07-23T21:33:36.187000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2916, "hostname": 2862, "URL": 1 }, "indicator_count": 5779, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "646 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6664bf3fd95299157d7172fe", "name": "cyberfolks.pl", "description": "", "modified": "2024-06-08T20:29:51.204000", "created": "2024-06-08T20:29:51.204000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "Poland" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 2855, "hostname": 2271 }, "indicator_count": 5126, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "721 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "66108534269b2949fb41cbbb", "name": "URLHaus data - 05-04-2024", "description": "", "modified": "2024-05-05T23:02:44.001000", "created": "2024-04-05T23:11:48.252000", "tags": [ "32-bit", "elf", "mips", "Mozi", "mirai", "exe", "VoidRAT", "njRAT", "dropped-by-PrivateLoader", "encrypted", "arm", "SocGholish", "ua-wget", "gafgyt", "Rhadamanthys", "dcrat", "hajime", "base64-encoded-reversed-exe", "PureLogStealer", "AveMariaRAT", "RemcosRAT", "AsyncRAT", "QuasarRAT", "arrowrat", "Gozi", "ddos", "GuLoader", "dll", "RecordBreaker", "DanaBot", "dropped-by-SmokeLoader", "DBatLoader", "geo", "malspam", "poland", "Gh0stRAT", "32", "Socks5Systemz", "x86-32", "1335", "pw-1335", "64", "PrivateLoader", "bashlite", "PowerPC", "motorola", "renesas", "64-bit", "x86-64" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 67, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 777, "domain": 7, "hostname": 8 }, "indicator_count": 792, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "755 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "leibk.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "leibk.com", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://leibk.com/pufpufooootools/150_Clwwfhzotee", "status": "offline", "threat": "malware_download", "date_added": "2024-04-05", "tags": [ "DBatLoader", "geo", "malspam", "poland" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780238053.4555907 }