{ "type": "Domain", "indicator": "peppatees.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/peppatees.com", "alexa": "http://www.alexa.com/siteinfo/peppatees.com", "indicator": "peppatees.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3724329566, "indicator": "peppatees.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "65110520118ae2c348c954ad", "name": "IcedID (by CarlosCabal)", "description": "https://www.virustotal.com/gui/collection/552efd557a478fb46f232c902c4f21ad2b01f81919a9a76132bce311515c039d", "modified": "2023-10-25T03:00:51.071000", "created": "2023-09-25T03:57:20.778000", "tags": [ "IcedID" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "IcedID", "display_name": "IcedID", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 626, "FileHash-MD5": 206, "FileHash-SHA1": 210, "FileHash-SHA256": 974, "domain": 385, "hostname": 56 }, "indicator_count": 2457, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "950 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64c05ddfdc819d2e5da9007f", "name": "URLHaus data - 25-07-2023", "description": "", "modified": "2023-08-24T23:03:45.507000", "created": "2023-07-25T23:42:23.748000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "exe", "VoidRAT", "32", "PowerPC", "bashlite", "gafgyt", "intel", "shellscript", "Origin", "hajime", "RedLineStealer", "njRAT", "dcrat", "Formbook", "doc", "opendir", "Loki", "vbs", "ascii", "hta", "GuLoader", "xworm", "AgentTesla", "Encoded", "remcos", "NetSupport", "rat", "Password-protected", "rar", "Zen", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "RedLine", "SocGholish", "Lumma", "dropped-by-SmokeLoader", "SystemBC", "MarsStealer", "Stealc", "2023", "zip", "1466", "hackdeversion", "FakeGoogleA", "pw-888", "FakeGoogleAi", "IcedID", "pw-724", "64", "AsyncRAT", "geofenced", "ITA", "RTF", "#IcedID", "pw-999", "dll", "StealerElectrum", "wanwap1337", "1212", "script", "VectorStealer", "DarkCloud", "pw-4545" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 661, "domain": 20, "hostname": 7 }, "indicator_count": 688, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1011 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64c3a1297bbfb4b85cbde920", "name": "Threatview.io Domain Blocklist", "description": "Malicious Domains identified for phishing/ serving malware/ command and control", "modified": "2023-07-28T11:06:17.802000", "created": "2023-07-28T11:06:17.802000", "tags": [], "references": [ "https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "hitman", "id": "195", "avatar_url": "/otxapi/users/avatar_image/media/avatars/hitman/resized/80/MtDewBot.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 21 }, "indicator_count": 266, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "1039 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt", "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Icedid" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "65110520118ae2c348c954ad", "name": "IcedID (by CarlosCabal)", "description": "https://www.virustotal.com/gui/collection/552efd557a478fb46f232c902c4f21ad2b01f81919a9a76132bce311515c039d", "modified": "2023-10-25T03:00:51.071000", "created": "2023-09-25T03:57:20.778000", "tags": [ "IcedID" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "IcedID", "display_name": "IcedID", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 626, "FileHash-MD5": 206, "FileHash-SHA1": 210, "FileHash-SHA256": 974, "domain": 385, "hostname": 56 }, "indicator_count": 2457, "is_author": false, "is_subscribing": null, "subscriber_count": 184, "modified_text": "950 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64c05ddfdc819d2e5da9007f", "name": "URLHaus data - 25-07-2023", "description": "", "modified": "2023-08-24T23:03:45.507000", "created": "2023-07-25T23:42:23.748000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "exe", "VoidRAT", "32", "PowerPC", "bashlite", "gafgyt", "intel", "shellscript", "Origin", "hajime", "RedLineStealer", "njRAT", "dcrat", "Formbook", "doc", "opendir", "Loki", "vbs", "ascii", "hta", "GuLoader", "xworm", "AgentTesla", "Encoded", "remcos", "NetSupport", "rat", "Password-protected", "rar", "Zen", "1234", "7z", "dropped-by-PrivateLoader", "encrypted", "Vidar", "RedLine", "SocGholish", "Lumma", "dropped-by-SmokeLoader", "SystemBC", "MarsStealer", "Stealc", "2023", "zip", "1466", "hackdeversion", "FakeGoogleA", "pw-888", "FakeGoogleAi", "IcedID", "pw-724", "64", "AsyncRAT", "geofenced", "ITA", "RTF", "#IcedID", "pw-999", "dll", "StealerElectrum", "wanwap1337", "1212", "script", "VectorStealer", "DarkCloud", "pw-4545" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 661, "domain": 20, "hostname": 7 }, "indicator_count": 688, "is_author": false, "is_subscribing": null, "subscriber_count": 1623, "modified_text": "1011 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64c3a1297bbfb4b85cbde920", "name": "Threatview.io Domain Blocklist", "description": "Malicious Domains identified for phishing/ serving malware/ command and control", "modified": "2023-07-28T11:06:17.802000", "created": "2023-07-28T11:06:17.802000", "tags": [], "references": [ "https://threatview.io/Downloads/DOMAIN-High-Confidence-Feed.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "hitman", "id": "195", "avatar_url": "/otxapi/users/avatar_image/media/avatars/hitman/resized/80/MtDewBot.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 245, "hostname": 21 }, "indicator_count": 266, "is_author": false, "is_subscribing": null, "subscriber_count": 183, "modified_text": "1039 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "peppatees.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "peppatees.com", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "http://peppatees.com/buoyancy/", "status": "offline", "threat": "malware_download", "date_added": "2023-07-25", "tags": [ "IcedID", "pw-724" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780319837.4357142 }