{ "type": "Domain", "indicator": "microsecurityupdate.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/microsecurityupdate.com", "alexa": "http://www.alexa.com/siteinfo/microsecurityupdate.com", "indicator": "microsecurityupdate.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2727059324, "indicator": "microsecurityupdate.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "66d9eb082ba8ee6c0db1c9cf", "name": "urlhaus.abuse.ch", "description": "", "modified": "2024-10-05T17:03:18.260000", "created": "2024-09-05T17:31:52.439000", "tags": [ "nda0e", "mozi", "clearlynotb", "coinminer", "cobaltstrike", "bitsight", "guloader", "redlinestealer", "stealc", "lummastealer", "vidar", "ransomware", "remcosrat", "asyncrat", "gandcrab", "agenttesla", "amadey", "systembc", "recordbreaker", "quasarrat", "spynote", "formbook", "babadeda", "metasploit", "metastealer", "loki", "blackmoon", "loader", "raccoonstealer", "piratestealer", "dridex", "cobalt strike", "stormkitty", "darktortilla", "venomrat", "sliver", "avemariarat", "neshta", "triada", "fakechrome", "grayware", "danabot", "darkgate", "connectback", "troldesh", "rhadamanthys", "nukesped", "tofsee", "purplefox", "earthworm", "azorult", "redosdru", "getshell", "donut", "aurora stealer", "laplasclipper", "redline", "wingo", "flyagent", "darkside", "badpotato", "juicypotato", "dharma", "casbaneiro", "clearfake", "parallax", "parallaxrat", "phonk", "qakbot", "purecrypter", "revengerat" ], "references": [ "https://urlhaus.abuse.ch/downloads/json_online/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 95, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "JohnnyCS", "id": "293079", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 9, "FileHash-MD5": 3, "FileHash-SHA1": 8, "URL": 7927, "domain": 119, "hostname": 162 }, "indicator_count": 8228, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65109e4452cd4f44ab531a03", "name": "URLHaus Malicious URL Blocklist 2023-09-24", "description": "1.4% of the world's population now lives in the UK, but that doesn't mean that it is the only one that has made a significant impact on the way we all live.\nhttps://malware-filter.gitlab.io/malware-filter/urlhaus-filter-online.txt", "modified": "2023-10-24T20:02:37.137000", "created": "2023-09-24T20:38:28.173000", "tags": [ "urlhaus", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 76, "FileHash-MD5": 65, "FileHash-SHA1": 83, "FileHash-SHA256": 50, "URL": 75, "domain": 303 }, "indicator_count": 652, "is_author": false, "is_subscribing": null, "subscriber_count": 179, "modified_text": "908 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6510a2dd9c7acab85a26f978", "name": "Phishing sites 2023-09-24", "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains", "modified": "2023-10-24T20:02:37.137000", "created": "2023-09-24T20:58:05.025000", "tags": [ "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "France" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 10, "URL": 5, "domain": 37579, "hostname": 3238 }, "indicator_count": 40832, "is_author": false, "is_subscribing": null, "subscriber_count": 190, "modified_text": "908 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/downloads/json_online/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "66d9eb082ba8ee6c0db1c9cf", "name": "urlhaus.abuse.ch", "description": "", "modified": "2024-10-05T17:03:18.260000", "created": "2024-09-05T17:31:52.439000", "tags": [ "nda0e", "mozi", "clearlynotb", "coinminer", "cobaltstrike", "bitsight", "guloader", "redlinestealer", "stealc", "lummastealer", "vidar", "ransomware", "remcosrat", "asyncrat", "gandcrab", "agenttesla", "amadey", "systembc", "recordbreaker", "quasarrat", "spynote", "formbook", "babadeda", "metasploit", "metastealer", "loki", "blackmoon", "loader", "raccoonstealer", "piratestealer", "dridex", "cobalt strike", "stormkitty", "darktortilla", "venomrat", "sliver", "avemariarat", "neshta", "triada", "fakechrome", "grayware", "danabot", "darkgate", "connectback", "troldesh", "rhadamanthys", "nukesped", "tofsee", "purplefox", "earthworm", "azorult", "redosdru", "getshell", "donut", "aurora stealer", "laplasclipper", "redline", "wingo", "flyagent", "darkside", "badpotato", "juicypotato", "dharma", "casbaneiro", "clearfake", "parallax", "parallaxrat", "phonk", "qakbot", "purecrypter", "revengerat" ], "references": [ "https://urlhaus.abuse.ch/downloads/json_online/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 95, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "JohnnyCS", "id": "293079", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 9, "FileHash-MD5": 3, "FileHash-SHA1": 8, "URL": 7927, "domain": 119, "hostname": 162 }, "indicator_count": 8228, "is_author": false, "is_subscribing": null, "subscriber_count": 2, "modified_text": "561 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65109e4452cd4f44ab531a03", "name": "URLHaus Malicious URL Blocklist 2023-09-24", "description": "1.4% of the world's population now lives in the UK, but that doesn't mean that it is the only one that has made a significant impact on the way we all live.\nhttps://malware-filter.gitlab.io/malware-filter/urlhaus-filter-online.txt", "modified": "2023-10-24T20:02:37.137000", "created": "2023-09-24T20:38:28.173000", "tags": [ "urlhaus", "malware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 76, "FileHash-MD5": 65, "FileHash-SHA1": 83, "FileHash-SHA256": 50, "URL": 75, "domain": 303 }, "indicator_count": 652, "is_author": false, "is_subscribing": null, "subscriber_count": 179, "modified_text": "908 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6510a2dd9c7acab85a26f978", "name": "Phishing sites 2023-09-24", "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains", "modified": "2023-10-24T20:02:37.137000", "created": "2023-09-24T20:58:05.025000", "tags": [ "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "France" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 10, "URL": 5, "domain": 37579, "hostname": 3238 }, "indicator_count": 40832, "is_author": false, "is_subscribing": null, "subscriber_count": 190, "modified_text": "908 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "microsecurityupdate.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "microsecurityupdate.com", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://microsecurityupdate.com/KB824105-x86-ENU.exe", "status": "offline", "threat": "malware_download", "date_added": "2023-01-24", "tags": [ "32", "exe" ] } ], "error": null }, "from_cache": true, "_cached_at": 1776639687.3443286 }