{ "type": "Domain", "indicator": "microsofteams.top", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/microsofteams.top", "alexa": "http://www.alexa.com/siteinfo/microsofteams.top", "indicator": "microsofteams.top", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3607694947, "indicator": "microsofteams.top", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 33, "pulses": [ { "id": "69c081afa2bd54a9599b7c07", "name": "PhishDestroy \u2014 Active Phishing & Crypto Scam Domains", "description": "Real-time feed of phishing, crypto drainer, and scam domains detected by PhishDestroy (phishdestroy.io). Updated hourly. 108K+ domains tracked, 55K+ currently active. Source: github.com/phishdestroy/destroylist", "modified": "2026-04-19T20:00:03.066000", "created": "2026-03-22T23:56:29.438000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 81556, "hostname": 49547 }, "indicator_count": 131103, "is_author": false, "is_subscribing": null, "subscriber_count": 58, "modified_text": "1 hour ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c08867316c564ade394c69", "name": "PhishDestroy \u2014 Content Active Threats (Live)", "description": "Live feed of phishing and crypto scam domains with ACTIVE malicious content from PhishDestroy. These domains are verified to have live phishing/scam pages. Updated hourly. Source: github.com/phishdestroy/destroylist/dns/content_active.json", "modified": "2026-04-18T23:00:03.520000", "created": "2026-03-23T00:25:09.116000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy", "active", "content" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46945, "hostname": 23211 }, "indicator_count": 70156, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "22 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6746eae02e409b017dfc3446", "name": "test", "description": "", "modified": "2024-11-27T09:49:56.893000", "created": "2024-11-27T09:48:16.350000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6746e72e166ce385bcf6a190", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7079 }, "indicator_count": 12733, "is_author": false, "is_subscribing": null, "subscriber_count": 31, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746eada877212ce963923c4", "name": "test", "description": "", "modified": "2024-11-27T09:48:10.379000", "created": "2024-11-27T09:48:10.379000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6746e72e166ce385bcf6a190", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e72e166ce385bcf6a190", "name": "test", "description": "", "modified": "2024-11-27T09:32:30.359000", "created": "2024-11-27T09:32:30.359000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e72528402d5f2b560f94", "name": "test", "description": "", "modified": "2024-11-27T09:32:21.842000", "created": "2024-11-27T09:32:21.842000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f7e75b22b226428b54", "name": "test", "description": "", "modified": "2024-11-27T09:31:35.510000", "created": "2024-11-27T09:31:35.510000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f777858514fd47721b", "name": "test", "description": "", "modified": "2024-11-27T09:31:35.336000", "created": "2024-11-27T09:31:35.336000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f6008916b47ddecc1b", "name": "test", "description": "", "modified": "2024-11-27T09:31:34.682000", "created": "2024-11-27T09:31:34.682000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f69c42d60283e9aa0f", "name": "test", "description": "", "modified": "2024-11-27T09:31:34.344000", "created": "2024-11-27T09:31:34.344000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f4be000f79eef564e0", "name": "test", "description": "", "modified": "2024-11-27T09:31:32.861000", "created": "2024-11-27T09:31:32.861000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f4e35efa94cb40610d", "name": "test", "description": "", "modified": "2024-11-27T09:31:32.732000", "created": "2024-11-27T09:31:32.732000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f4050558d7149be4f8", "name": "test", "description": "", "modified": "2024-11-27T09:31:32.526000", "created": "2024-11-27T09:31:32.526000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f4dfcc3c6e3abf71e3", "name": "test", "description": "", "modified": "2024-11-27T09:31:32.026000", "created": "2024-11-27T09:31:32.026000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f1b272922f8975813f", "name": "test", "description": "", "modified": "2024-11-27T09:31:29.591000", "created": "2024-11-27T09:31:29.591000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6e2bc0c6a3bca869f4e", "name": "test", "description": "", "modified": "2024-11-27T09:31:14.131000", "created": "2024-11-27T09:31:14.131000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d7cdf7772c62155cc7", "name": "test", "description": "", "modified": "2024-11-27T09:31:03.357000", "created": "2024-11-27T09:31:03.357000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d634e8a45dcfcc52a1", "name": "test", "description": "", "modified": "2024-11-27T09:31:02.497000", "created": "2024-11-27T09:31:02.497000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d5d0add372df82b9ce", "name": "test", "description": "", "modified": "2024-11-27T09:31:01.001000", "created": "2024-11-27T09:31:01.001000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d4b38ef8a4f5dbd3fb", "name": "test", "description": "", "modified": "2024-11-27T09:31:00.510000", "created": "2024-11-27T09:31:00.510000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d311db88d04259103f", "name": "test", "description": "", "modified": "2024-11-27T09:30:59.961000", "created": "2024-11-27T09:30:59.961000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d386c7f4be942bd878", "name": "test", "description": "", "modified": "2024-11-27T09:30:59.831000", "created": "2024-11-27T09:30:59.831000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6d16bc55ef32a6d3ad1", "name": "test", "description": "", "modified": "2024-11-27T09:30:57.742000", "created": "2024-11-27T09:30:57.742000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6cffe9312f50b94ab69", "name": "test", "description": "", "modified": "2024-11-27T09:30:55.961000", "created": "2024-11-27T09:30:55.961000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6510a2dd9c7acab85a26f978", "name": "Phishing sites 2023-09-24", "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains", "modified": "2023-10-24T20:02:37.137000", "created": "2023-09-24T20:58:05.025000", "tags": [ "phishing" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "France" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 24, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 10, "URL": 5, "domain": 37579, "hostname": 3238 }, "indicator_count": 40832, "is_author": false, "is_subscribing": null, "subscriber_count": 190, "modified_text": "908 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6503e2757924cd9f6f7a9611", "name": "Network IOCs (Pulse Created by cnoscsoc@att.com)", "description": "", "modified": "2023-09-15T04:49:57.815000", "created": "2023-09-15T04:49:57.815000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "614e0dc583aa90bf2dd4ec91", "export_count": 7213, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "947 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6503e275ad0281f4ff3b1ebc", "name": "Network IOCs (Pulse Created by cnoscsoc@att.com)", "description": "", "modified": "2023-09-15T04:49:57.375000", "created": "2023-09-15T04:49:57.375000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "614e0dc583aa90bf2dd4ec91", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "947 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6503e27105d6c04fb6cc9004", "name": "Network IOCs (Pulse Created by cnoscsoc@att.com)", "description": "", "modified": "2023-09-15T04:49:53.888000", "created": "2023-09-15T04:49:53.888000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "614e0dc583aa90bf2dd4ec91", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "947 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6503e2566de3b106d6888d77", "name": "Network IOCs (Pulse Created by cnoscsoc@att.com)", "description": "", "modified": "2023-09-15T04:49:26.231000", "created": "2023-09-15T04:49:26.231000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "614e0dc583aa90bf2dd4ec91", "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "947 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "614e0dc583aa90bf2dd4ec91", "name": "Network IOCs", "description": "Network-based IOCs", "modified": "2023-05-11T00:01:00.294000", "created": "2021-09-24T17:41:25.461000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2663, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cnoscsoc@att.com", "id": "81627", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 371, "modified_text": "1074 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "63cf84205479d32e65f1bac3", "name": "Unwrapping Ursnifs Gifts - The DFIR Report", "description": "A detailed report from security firm Crowdstrike on an incident involving Ursnif malware and Cobalt Strike, which took place in late August 2022, reveals how the malware was deployed and how it spread.", "modified": "2023-02-23T07:03:21.482000", "created": "2023-01-24T07:09:20.959000", "tags": [ "vidar stealer", "icedid", "c2 server", "audacity", "blender", "msi file", "november", "batloader", "gimp", "advert", "vidar", "domain admin", "cobalt strike", "ursnif", "redacted", "et malware", "impacket", "lnk file", "ursnif malware", "ursnif variant", "cnc beacon", "et info", "bumblebee", "powershell", "august", "gozi", "isfb", "dreambot", "bits", "covenant", "metasploit", "empire", "poshc2", "mimikatz", "win64", "bypass" ], "references": [ "https://threatresearch.ext.hp.com/adverts-mimicking-popular-software-leads-to-malware/?web_view=true" ], "public": 1, "adversary": "Domain Admin", "targeted_countries": [], "malware_families": [ { "id": "Ursnif", "display_name": "Ursnif", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null } ], "attack_ids": [ { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1021", "name": "Remote Services", "display_name": "T1021 - Remote Services" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1033", "name": "System Owner/User Discovery", "display_name": "T1033 - System Owner/User Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1047", "name": "Windows Management Instrumentation", "display_name": "T1047 - Windows Management Instrumentation" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1087", "name": "Account Discovery", "display_name": "T1087 - Account Discovery" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1197", "name": "BITS Jobs", "display_name": "T1197 - BITS Jobs" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1482", "name": "Domain Trust Discovery", "display_name": "T1482 - Domain Trust Discovery" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1570", "name": "Lateral Tool Transfer", "display_name": "T1570 - Lateral Tool Transfer" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "text_account", "id": "221593", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 21, "FileHash-SHA1": 27, "FileHash-SHA256": 17, "SSLCertFingerprint": 1, "URL": 10, "domain": 107, "hostname": 4 }, "indicator_count": 187, "is_author": false, "is_subscribing": null, "subscriber_count": 51, "modified_text": "1151 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c7f066f5440704989d9283", "name": "IcedID and Infostealers distributed through Mimicking Popular Tools", "description": "", "modified": "2023-02-17T13:00:47.849000", "created": "2023-01-18T13:13:10.160000", "tags": [], "references": [ "January 18th, 2023 - CryptoGen Cyber Threat Intelligence -IcedID and Infostealers distributed through Mimicking Popular Tools.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8, "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 4, "domain": 95, "hostname": 3 }, "indicator_count": 115, "is_author": false, "is_subscribing": null, "subscriber_count": 485, "modified_text": "1157 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c7aff3df9e8e89abc47763", "name": "IcedID and Infostealers Spread Through Adverts Mimicking Popular Tools | HP Wolf Security", "description": "Malvertising is an increasingly popular method for distributing malware, according to research published in the journal Security Research. (US$2.4m) by the International Institute of Strategic Studies (IISS).", "modified": "2023-02-17T08:01:46.543000", "created": "2023-01-18T08:38:11.093000", "tags": [ "vidar stealer", "icedid", "c2 server", "audacity", "blender", "msi file", "november", "batloader", "gimp", "advert", "vidar" ], "references": [ "https://threatresearch.ext.hp.com/adverts-mimicking-popular-software-leads-to-malware/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4, "URL": 9, "FileHash-MD5": 4, "FileHash-SHA1": 1, "FileHash-SHA256": 3, "domain": 96 }, "indicator_count": 117, "is_author": false, "is_subscribing": null, "subscriber_count": 845, "modified_text": "1157 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "2021-09-21-Curriculo-IOCs.txt", "https://threatresearch.ext.hp.com/adverts-mimicking-popular-software-leads-to-malware/", "https://threatresearch.ext.hp.com/adverts-mimicking-popular-software-leads-to-malware/?web_view=true", "January 18th, 2023 - CryptoGen Cyber Threat Intelligence -IcedID and Infostealers distributed through Mimicking Popular Tools.pdf" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "Domain Admin" ], "malware_families": [ "Cobalt strike", "Ursnif" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 33, "pulses": [ { "id": "69c081afa2bd54a9599b7c07", "name": "PhishDestroy \u2014 Active Phishing & Crypto Scam Domains", "description": "Real-time feed of phishing, crypto drainer, and scam domains detected by PhishDestroy (phishdestroy.io). Updated hourly. 108K+ domains tracked, 55K+ currently active. Source: github.com/phishdestroy/destroylist", "modified": "2026-04-19T20:00:03.066000", "created": "2026-03-22T23:56:29.438000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 81556, "hostname": 49547 }, "indicator_count": 131103, "is_author": false, "is_subscribing": null, "subscriber_count": 58, "modified_text": "1 hour ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c08867316c564ade394c69", "name": "PhishDestroy \u2014 Content Active Threats (Live)", "description": "Live feed of phishing and crypto scam domains with ACTIVE malicious content from PhishDestroy. These domains are verified to have live phishing/scam pages. Updated hourly. Source: github.com/phishdestroy/destroylist/dns/content_active.json", "modified": "2026-04-18T23:00:03.520000", "created": "2026-03-23T00:25:09.116000", "tags": [ "phishing", "crypto", "scam", "drainer", "fraud", "blocklist", "phishdestroy", "active", "content" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phishdestroy", "id": "348394", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 46945, "hostname": 23211 }, "indicator_count": 70156, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "22 hours ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6746eae02e409b017dfc3446", "name": "test", "description": "", "modified": "2024-11-27T09:49:56.893000", "created": "2024-11-27T09:48:16.350000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6746e72e166ce385bcf6a190", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7079 }, "indicator_count": 12733, "is_author": false, "is_subscribing": null, "subscriber_count": 31, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746eada877212ce963923c4", "name": "test", "description": "", "modified": "2024-11-27T09:48:10.379000", "created": "2024-11-27T09:48:10.379000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6746e72e166ce385bcf6a190", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e72e166ce385bcf6a190", "name": "test", "description": "", "modified": "2024-11-27T09:32:30.359000", "created": "2024-11-27T09:32:30.359000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e72528402d5f2b560f94", "name": "test", "description": "", "modified": "2024-11-27T09:32:21.842000", "created": "2024-11-27T09:32:21.842000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 28, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f7e75b22b226428b54", "name": "test", "description": "", "modified": "2024-11-27T09:31:35.510000", "created": "2024-11-27T09:31:35.510000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f777858514fd47721b", "name": "test", "description": "", "modified": "2024-11-27T09:31:35.336000", "created": "2024-11-27T09:31:35.336000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f6008916b47ddecc1b", "name": "test", "description": "", "modified": "2024-11-27T09:31:34.682000", "created": "2024-11-27T09:31:34.682000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 }, { "id": "6746e6f69c42d60283e9aa0f", "name": "test", "description": "", "modified": "2024-11-27T09:31:34.344000", "created": "2024-11-27T09:31:34.344000", "tags": [ "msi file", "tuesday", "malspam email", "headers", "anna paula", "utf8", "currc3adculo", "from email", "associated", "zip archive" ], "references": [ "2021-09-21-Curriculo-IOCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "6503e2757924cd9f6f7a9611", "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "testivk1", "id": "218690", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 5654, "domain": 7078 }, "indicator_count": 12732, "is_author": false, "is_subscribing": null, "subscriber_count": 29, "modified_text": "508 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 0 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "microsofteams.top", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "microsofteams.top", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776634334.291052 }