{ "type": "Domain", "indicator": "nameintel.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/nameintel.com", "alexa": "http://www.alexa.com/siteinfo/nameintel.com", "indicator": "nameintel.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3007950782, "indicator": "nameintel.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "689fb86af7ae894997245158", "name": "Lumen Technologies attacks. Affects telecommunication between patient and Intermountain Health", "description": "Severely impacted a monitored target\u2019s communication with health provider , prohibited patient calls, borne answering calls at UC Health & Intermountain Healthcare. Targets devices routed and / or hijacked by or to other known carriers.\nImpacts Medicaid patient files. NOT CHINA. Colorado. Message #trulymissed intentionally routed to outbound decimated her health & provider relationships. \n\u201cYour administrator contact lumen at 877-453-8353 to resolve the issue. You may dial zero to be connected with an operator to complete your call. The charges may apply operator services will require a valid telephone number and a method of payment for charges to complete the call thank you for calling Luman error code CPN1\u201d\n\nWin32:Downloader-KEQ\\ [Trj]\t\t\n#Lowfi:Cutwail_Upatre_GameOver_Obfuscator\n#malware #Schoolboy\n#.Bulz\n#trojan #Redline\n#.Dorkbot\t#Azorult\n#HawkEye\n#Msilperseus\n#AgentTesla\nhacktool:MSIL/Boilod", "modified": "2025-09-14T21:02:42.856000", "created": "2025-08-15T22:44:58.153000", "tags": [ "united", "passive dns", "ipv4", "pulse submit", "url analysis", "urls", "files", "reverse dns", "location united", "america flag", "creation date", "communications", "expiration date", "domain", "files ip", "address", "asn as3356", "el dorado", "present jun", "present dec", "present sep", "present nov", "present may", "entries", "showing", "next associated", "urls show", "search", "read c", "show", "medium", "unicode", "rgba", "next", "memcommit", "delete", "dock", "write", "execution", "copy", "status", "value emails", "name level", "llc name", "org level", "llc address", "city broomfield", "date", "error nov", "next http", "scans record", "value", "body head", "document moved", "title head", "object moved", "href http", "denver", "hostname add", "ip address", "pulse pulses", "verdict", "present aug", "name servers", "hong kong", "china unknown", "domain add", "present jul", "china showing", "date checked", "url hostname", "mirai", "crlf line", "body", "please", "x msedge", "unknown ns", "unknown soa", "trojan", "virtool", "ipv4 add", "hostname", "set cookie", "accept", "dispatcher", "ref b", "wed may", "backdoor", "mtb aug", "mtb dec", "twitter", "smoke loader", "malware", "hacktool", "mtb feb", "aaaa", "cname" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 562, "hostname": 1988, "URL": 7800, "FileHash-SHA256": 657, "email": 5, "FileHash-MD5": 150, "FileHash-SHA1": 127 }, "indicator_count": 11289, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "259 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708da9e86ee4a0fbd6894a", "name": "testt", "description": "", "modified": "2023-12-06T15:05:13.737000", "created": "2023-12-06T15:05:13.737000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 138, "FileHash-MD5": 86, "FileHash-SHA1": 85, "domain": 263, "hostname": 230, "URL": 653 }, "indicator_count": 1455, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708d29dc9b2e91369b6c52", "name": "resteex_(scanner|not|sleep)_20220503_LVL0", "description": "", "modified": "2023-12-06T15:03:05.576000", "created": "2023-12-06T15:03:05.576000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 138, "domain": 263, "hostname": 186, "URL": 936 }, "indicator_count": 1523, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627b65390591d507db622d8d", "name": "testt", "description": "", "modified": "2022-06-10T00:04:38.296000", "created": "2022-05-11T07:26:49.466000", "tags": [ "ipv4", "filehashsha256", "censysarin01", "ipv6", "censysarin03", "censysarin02", "indicator", "description", "uuid", "ccau asnas36351" ], "references": [ "https://otx.alienvault.com/otxapi/pulses/627136c8b95024f5508312fb/export/?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6IkFMU0hPQkFLSSIsInZhbHVlIjpbIjYyNzEzNmM4Yjk1MDI0ZjU1MDgzMTJmYiIsImNzdiJdLCJleHAiOjE2NTIzNDAxMjB9.m6mMtZUX6APiYkOqo-hy0WS99veHvINvZqzUghByxOo&format=csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ALSHOBAKI", "id": "192458", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 86, "FileHash-SHA1": 85, "FileHash-SHA256": 138, "URL": 653, "domain": 263, "hostname": 230 }, "indicator_count": 1455, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "1452 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627136c8b95024f5508312fb", "name": "resteex_(scanner|not|sleep)_20220503_LVL0", "description": "", "modified": "2022-06-03T00:01:00.120000", "created": "2022-05-03T14:06:00.222000", "tags": [], "references": [ "test2.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "resteex0", "id": "175858", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 186, "URL": 936, "FileHash-SHA256": 138, "domain": 263 }, "indicator_count": 1523, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://otx.alienvault.com/otxapi/pulses/627136c8b95024f5508312fb/export/?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6IkFMU0hPQkFLSSIsInZhbHVlIjpbIjYyNzEzNmM4Yjk1MDI0ZjU1MDgzMTJmYiIsImNzdiJdLCJleHAiOjE2NTIzNDAxMjB9.m6mMtZUX6APiYkOqo-hy0WS99veHvINvZqzUghByxOo&format=csv", "test2.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "689fb86af7ae894997245158", "name": "Lumen Technologies attacks. Affects telecommunication between patient and Intermountain Health", "description": "Severely impacted a monitored target\u2019s communication with health provider , prohibited patient calls, borne answering calls at UC Health & Intermountain Healthcare. Targets devices routed and / or hijacked by or to other known carriers.\nImpacts Medicaid patient files. NOT CHINA. Colorado. Message #trulymissed intentionally routed to outbound decimated her health & provider relationships. \n\u201cYour administrator contact lumen at 877-453-8353 to resolve the issue. You may dial zero to be connected with an operator to complete your call. The charges may apply operator services will require a valid telephone number and a method of payment for charges to complete the call thank you for calling Luman error code CPN1\u201d\n\nWin32:Downloader-KEQ\\ [Trj]\t\t\n#Lowfi:Cutwail_Upatre_GameOver_Obfuscator\n#malware #Schoolboy\n#.Bulz\n#trojan #Redline\n#.Dorkbot\t#Azorult\n#HawkEye\n#Msilperseus\n#AgentTesla\nhacktool:MSIL/Boilod", "modified": "2025-09-14T21:02:42.856000", "created": "2025-08-15T22:44:58.153000", "tags": [ "united", "passive dns", "ipv4", "pulse submit", "url analysis", "urls", "files", "reverse dns", "location united", "america flag", "creation date", "communications", "expiration date", "domain", "files ip", "address", "asn as3356", "el dorado", "present jun", "present dec", "present sep", "present nov", "present may", "entries", "showing", "next associated", "urls show", "search", "read c", "show", "medium", "unicode", "rgba", "next", "memcommit", "delete", "dock", "write", "execution", "copy", "status", "value emails", "name level", "llc name", "org level", "llc address", "city broomfield", "date", "error nov", "next http", "scans record", "value", "body head", "document moved", "title head", "object moved", "href http", "denver", "hostname add", "ip address", "pulse pulses", "verdict", "present aug", "name servers", "hong kong", "china unknown", "domain add", "present jul", "china showing", "date checked", "url hostname", "mirai", "crlf line", "body", "please", "x msedge", "unknown ns", "unknown soa", "trojan", "virtool", "ipv4 add", "hostname", "set cookie", "accept", "dispatcher", "ref b", "wed may", "backdoor", "mtb aug", "mtb dec", "twitter", "smoke loader", "malware", "hacktool", "mtb feb", "aaaa", "cname" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 31, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 562, "hostname": 1988, "URL": 7800, "FileHash-SHA256": 657, "email": 5, "FileHash-MD5": 150, "FileHash-SHA1": 127 }, "indicator_count": 11289, "is_author": false, "is_subscribing": null, "subscriber_count": 143, "modified_text": "259 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708da9e86ee4a0fbd6894a", "name": "testt", "description": "", "modified": "2023-12-06T15:05:13.737000", "created": "2023-12-06T15:05:13.737000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 138, "FileHash-MD5": 86, "FileHash-SHA1": 85, "domain": 263, "hostname": 230, "URL": 653 }, "indicator_count": 1455, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708d29dc9b2e91369b6c52", "name": "resteex_(scanner|not|sleep)_20220503_LVL0", "description": "", "modified": "2023-12-06T15:03:05.576000", "created": "2023-12-06T15:03:05.576000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 138, "domain": 263, "hostname": 186, "URL": 936 }, "indicator_count": 1523, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627b65390591d507db622d8d", "name": "testt", "description": "", "modified": "2022-06-10T00:04:38.296000", "created": "2022-05-11T07:26:49.466000", "tags": [ "ipv4", "filehashsha256", "censysarin01", "ipv6", "censysarin03", "censysarin02", "indicator", "description", "uuid", "ccau asnas36351" ], "references": [ "https://otx.alienvault.com/otxapi/pulses/627136c8b95024f5508312fb/export/?token=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VybmFtZSI6IkFMU0hPQkFLSSIsInZhbHVlIjpbIjYyNzEzNmM4Yjk1MDI0ZjU1MDgzMTJmYiIsImNzdiJdLCJleHAiOjE2NTIzNDAxMjB9.m6mMtZUX6APiYkOqo-hy0WS99veHvINvZqzUghByxOo&format=csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ALSHOBAKI", "id": "192458", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 86, "FileHash-SHA1": 85, "FileHash-SHA256": 138, "URL": 653, "domain": 263, "hostname": 230 }, "indicator_count": 1455, "is_author": false, "is_subscribing": null, "subscriber_count": 36, "modified_text": "1452 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "627136c8b95024f5508312fb", "name": "resteex_(scanner|not|sleep)_20220503_LVL0", "description": "", "modified": "2022-06-03T00:01:00.120000", "created": "2022-05-03T14:06:00.222000", "tags": [], "references": [ "test2.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "resteex0", "id": "175858", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 186, "URL": 936, "FileHash-SHA256": 138, "domain": 263 }, "indicator_count": 1523, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1459 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "nameintel.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "nameintel.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780283496.44293 }