{ "type": "Domain", "indicator": "r2.dev", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/r2.dev", "alexa": "http://www.alexa.com/siteinfo/r2.dev", "indicator": "r2.dev", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3686954005, "indicator": "r2.dev", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 10, "pulses": [ { "id": "69e2f898a2a56718e2c912e1", "name": "CAPE Sandbox", "description": "\"RTA-5042-1996-1400-1577-RTA\nMotherless.com is a moral free file host where anything legal is hosted forever.\" disgusting the 'place' who put me in this domain.", "modified": "2026-04-18T06:14:04.516000", "created": "2026-04-18T03:20:56.584000", "tags": [ "script", "meta", "location", "href", "doctype html", "ahead", "title", "motherless", "global", "googlebot", "elite", "tracker", "date", "performs dns", "https", "mitre attack", "network info", "processes extra", "t1055 process", "layer protocol", "overview", "overview zenbox", "verdict", "phishing", "next", "rta description", "googlebot index", "ip address", "z233", "drip:05d0af0f092f1b54641ee3d58af676f5 14e7d2e335765d99ad7ec6cd24" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/22e702fc31752b1ff0ca59efb58d943282dff34b9e8ce61867d8c831b0d8de35_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776480788&Signature=GKnoamXxZLyFfntMDXBWi2gnSzHRWJJRZPaofPOvzgQF6ygdQKEJpX4eJ2AASUeDQ3L4AO7Os%2FgNOl0CeG5%2FN9aVgljvd3WBiA8ZTwba5tFflRJKWcwOA5l4osDG6BDtNNiE8hqlOPhwMa4lIHfx8LNSu8B%2Fbm0n7Y28iDLdwSs9GCpFCVriebOwI1VNCU3BxzR0lKHa1DH6ijmLa6nxX4TOwNTZ47Os2KLel2k0E0K7sedhXKjWD1rz", "https://vtbehaviour.commondatastorage.googleapis.com/22e702fc31752b1ff0ca59efb58d943282dff34b9e8ce61867d8c831b0d8de35_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776480900&Signature=juTMRwWs%2FTJqrDMvBJfYmPzSfXx4a%2F31AjChMKGg%2FigOb2ayCytmhgn%2FfGStvobwbbyL9t1dHYxFX0QZz%2F4zM3vebhPQPBm0BElUabRpjfY6q01wMlTu3q5T5uw1sSchvwR7n0H4t%2FnoMPiFRXns84ZWvQeTTNJYKtg5P29B6CE%2BbXfGQ%2FTKhS9ZR8bI09EyLS2y3Ob3boKLMZ4MNvq6nLIHO2373XOpgfJhsBQej6xZ8%2BlIe0T4" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 773, "FileHash-MD5": 34, "FileHash-SHA1": 1, "FileHash-SHA256": 43, "URL": 147, "domain": 17, "hostname": 88, "CVE": 2, "IPv6": 4, "email": 2 }, "indicator_count": 1111, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6502e4720ffdf5b89b2ce20f", "name": "Phishing Campaign", "description": "The provided indicators are being utilized for a phishing campaign.", "modified": "2026-03-10T08:26:36.633000", "created": "2023-09-14T10:46:10.926000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ivolyubenov", "id": "199323", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_199323/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 149, "email": 19, "hostname": 68, "FileHash-SHA256": 7, "URL": 3 }, "indicator_count": 246, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "41 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68b11dfd1aa3f207e76ae32b", "name": "Phishing Kits Uncovered: Methods and Tactics Used to Evade SEGs, Sandboxes, and Analysts.", "description": "Threat actors have adopted increasingly sophisticated tactics to evade detection in email phishing campaigns, employing various methods to disguise malware and credential phishing links. A prevalent technique involves embedding customized content in emails, utilizing legitimate file-sharing platforms, abusing open redirects, and incorporating QR codes to lead victims to phishing pages without drawing attention.\n\nTo evade scrutiny, these actors often leverage legitimate web services to host links to their malicious content instead of hosting malware directly. They typically embed these links into recognized sites like DocuSign, Google Docs, and Canva, as such sites can bypass detection by security email gateways (SEGs) that focus on reputable domains. Additionally, they commonly use open redirects from well-known platforms like Google and YouTube, which do not scan the final redirect URLs, further obscuring their phishing attempts.", "modified": "2025-08-29T03:26:53.702000", "created": "2025-08-29T03:26:53.702000", "tags": [ "segs", "ttps", "cofense", "useragent", "captcha", "threat actors", "urls", "pdfs", "qr code", "clickfix", "mispadu" ], "references": [ "https://cofense.com/blog/phishing-kits-uncovered-methods-and-tactics-used-to-evade-segs%2C-sandboxes%2C-and-analysts" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mispadu", "display_name": "Mispadu", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "FileHash-MD5": 1, "hostname": 8 }, "indicator_count": 13, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "234 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f30d1e5f894bef93248ddd", "name": "InQuest - 06-04-2025", "description": "", "modified": "2025-05-06T23:04:02.399000", "created": "2025-04-06T23:24:14.704000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 100, "URL": 435, "domain": 113, "FileHash-SHA256": 614, "FileHash-SHA1": 26, "FileHash-MD5": 22 }, "indicator_count": 1310, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "348 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f1bbda9e928a3743d1c379", "name": "InQuest - 05-04-2025", "description": "", "modified": "2025-05-05T23:03:32.288000", "created": "2025-04-05T23:25:13.994000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 569, "FileHash-SHA256": 550, "domain": 150, "hostname": 107, "FileHash-SHA1": 39, "FileHash-MD5": 41 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "349 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f06bc5e8059cb562270235", "name": "InQuest - 04-04-2025", "description": "", "modified": "2025-05-04T23:03:41.880000", "created": "2025-04-04T23:31:17.659000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 659, "FileHash-SHA256": 572, "FileHash-SHA1": 30, "FileHash-MD5": 43, "hostname": 138, "domain": 135 }, "indicator_count": 1577, "is_author": false, "is_subscribing": null, "subscriber_count": 1602, "modified_text": "350 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67ef1968f9c1c05c07ef00c0", "name": "InQuest - 03-04-2025", "description": "", "modified": "2025-05-03T23:03:06.090000", "created": "2025-04-03T23:27:36.140000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 533, "FileHash-MD5": 38, "URL": 728, "hostname": 134, "domain": 157, "FileHash-SHA1": 47 }, "indicator_count": 1637, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "351 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67edc9471b28e16af7425847", "name": "InQuest - 02-04-2025", "description": "", "modified": "2025-05-02T23:03:33.268000", "created": "2025-04-02T23:33:27.853000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 723, "FileHash-SHA256": 455, "domain": 142, "FileHash-MD5": 37, "hostname": 136, "FileHash-SHA1": 52 }, "indicator_count": 1545, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "352 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "608727a168e2a208ed73934d", "name": "Phishing Domains - GRIS", "description": "", "modified": "2024-04-08T17:22:16.826000", "created": "2021-04-26T20:50:41.547000", "tags": [ "Alaska" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "corbeaucrypto", "id": "95126", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 30, "URL": 3, "IPv4": 1 }, "indicator_count": 34, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "741 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6472916de6ed16a9f9c76a42", "name": "Twitter Feed - m0zar7 - 27-05-2023", "description": "", "modified": "2023-05-27T23:25:33.719000", "created": "2023-05-27T23:25:33.719000", "tags": [ "phishing" ], "references": [ "https://twitter.com/m0zar7/status/1662267129427554304" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "domain": 1, "FileHash-MD5": 1, "hostname": 1 }, "indicator_count": 4, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "1058 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://cofense.com/blog/phishing-kits-uncovered-methods-and-tactics-used-to-evade-segs%2C-sandboxes%2C-and-analysts", "https://twitter.com/m0zar7/status/1662267129427554304", "https://labs.inquest.net/iocdb", "https://vtbehaviour.commondatastorage.googleapis.com/22e702fc31752b1ff0ca59efb58d943282dff34b9e8ce61867d8c831b0d8de35_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776480788&Signature=GKnoamXxZLyFfntMDXBWi2gnSzHRWJJRZPaofPOvzgQF6ygdQKEJpX4eJ2AASUeDQ3L4AO7Os%2FgNOl0CeG5%2FN9aVgljvd3WBiA8ZTwba5tFflRJKWcwOA5l4osDG6BDtNNiE8hqlOPhwMa4lIHfx8LNSu8B%2Fbm0n7Y28iDLdwSs9GCpFCVriebOwI1VNCU3BxzR0lKHa1DH6ijmLa6nxX4TOwNTZ47Os2KLel2k0E0K7sedhXKjWD1rz", "https://vtbehaviour.commondatastorage.googleapis.com/22e702fc31752b1ff0ca59efb58d943282dff34b9e8ce61867d8c831b0d8de35_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776480900&Signature=juTMRwWs%2FTJqrDMvBJfYmPzSfXx4a%2F31AjChMKGg%2FigOb2ayCytmhgn%2FfGStvobwbbyL9t1dHYxFX0QZz%2F4zM3vebhPQPBm0BElUabRpjfY6q01wMlTu3q5T5uw1sSchvwR7n0H4t%2FnoMPiFRXns84ZWvQeTTNJYKtg5P29B6CE%2BbXfGQ%2FTKhS9ZR8bI09EyLS2y3Ob3boKLMZ4MNvq6nLIHO2373XOpgfJhsBQej6xZ8%2BlIe0T4" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Mispadu" ], "industries": [ "" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 10, "pulses": [ { "id": "69e2f898a2a56718e2c912e1", "name": "CAPE Sandbox", "description": "\"RTA-5042-1996-1400-1577-RTA\nMotherless.com is a moral free file host where anything legal is hosted forever.\" disgusting the 'place' who put me in this domain.", "modified": "2026-04-18T06:14:04.516000", "created": "2026-04-18T03:20:56.584000", "tags": [ "script", "meta", "location", "href", "doctype html", "ahead", "title", "motherless", "global", "googlebot", "elite", "tracker", "date", "performs dns", "https", "mitre attack", "network info", "processes extra", "t1055 process", "layer protocol", "overview", "overview zenbox", "verdict", "phishing", "next", "rta description", "googlebot index", "ip address", "z233", "drip:05d0af0f092f1b54641ee3d58af676f5 14e7d2e335765d99ad7ec6cd24" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/22e702fc31752b1ff0ca59efb58d943282dff34b9e8ce61867d8c831b0d8de35_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776480788&Signature=GKnoamXxZLyFfntMDXBWi2gnSzHRWJJRZPaofPOvzgQF6ygdQKEJpX4eJ2AASUeDQ3L4AO7Os%2FgNOl0CeG5%2FN9aVgljvd3WBiA8ZTwba5tFflRJKWcwOA5l4osDG6BDtNNiE8hqlOPhwMa4lIHfx8LNSu8B%2Fbm0n7Y28iDLdwSs9GCpFCVriebOwI1VNCU3BxzR0lKHa1DH6ijmLa6nxX4TOwNTZ47Os2KLel2k0E0K7sedhXKjWD1rz", "https://vtbehaviour.commondatastorage.googleapis.com/22e702fc31752b1ff0ca59efb58d943282dff34b9e8ce61867d8c831b0d8de35_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1776480900&Signature=juTMRwWs%2FTJqrDMvBJfYmPzSfXx4a%2F31AjChMKGg%2FigOb2ayCytmhgn%2FfGStvobwbbyL9t1dHYxFX0QZz%2F4zM3vebhPQPBm0BElUabRpjfY6q01wMlTu3q5T5uw1sSchvwR7n0H4t%2FnoMPiFRXns84ZWvQeTTNJYKtg5P29B6CE%2BbXfGQ%2FTKhS9ZR8bI09EyLS2y3Ob3boKLMZ4MNvq6nLIHO2373XOpgfJhsBQej6xZ8%2BlIe0T4" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 773, "FileHash-MD5": 34, "FileHash-SHA1": 1, "FileHash-SHA256": 43, "URL": 147, "domain": 17, "hostname": 88, "CVE": 2, "IPv6": 4, "email": 2 }, "indicator_count": 1111, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6502e4720ffdf5b89b2ce20f", "name": "Phishing Campaign", "description": "The provided indicators are being utilized for a phishing campaign.", "modified": "2026-03-10T08:26:36.633000", "created": "2023-09-14T10:46:10.926000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 21, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ivolyubenov", "id": "199323", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_199323/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 149, "email": 19, "hostname": 68, "FileHash-SHA256": 7, "URL": 3 }, "indicator_count": 246, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "41 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68b11dfd1aa3f207e76ae32b", "name": "Phishing Kits Uncovered: Methods and Tactics Used to Evade SEGs, Sandboxes, and Analysts.", "description": "Threat actors have adopted increasingly sophisticated tactics to evade detection in email phishing campaigns, employing various methods to disguise malware and credential phishing links. A prevalent technique involves embedding customized content in emails, utilizing legitimate file-sharing platforms, abusing open redirects, and incorporating QR codes to lead victims to phishing pages without drawing attention.\n\nTo evade scrutiny, these actors often leverage legitimate web services to host links to their malicious content instead of hosting malware directly. They typically embed these links into recognized sites like DocuSign, Google Docs, and Canva, as such sites can bypass detection by security email gateways (SEGs) that focus on reputable domains. Additionally, they commonly use open redirects from well-known platforms like Google and YouTube, which do not scan the final redirect URLs, further obscuring their phishing attempts.", "modified": "2025-08-29T03:26:53.702000", "created": "2025-08-29T03:26:53.702000", "tags": [ "segs", "ttps", "cofense", "useragent", "captcha", "threat actors", "urls", "pdfs", "qr code", "clickfix", "mispadu" ], "references": [ "https://cofense.com/blog/phishing-kits-uncovered-methods-and-tactics-used-to-evade-segs%2C-sandboxes%2C-and-analysts" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Mispadu", "display_name": "Mispadu", "target": null } ], "attack_ids": [ { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 4, "FileHash-MD5": 1, "hostname": 8 }, "indicator_count": 13, "is_author": false, "is_subscribing": null, "subscriber_count": 171, "modified_text": "234 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f30d1e5f894bef93248ddd", "name": "InQuest - 06-04-2025", "description": "", "modified": "2025-05-06T23:04:02.399000", "created": "2025-04-06T23:24:14.704000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 100, "URL": 435, "domain": 113, "FileHash-SHA256": 614, "FileHash-SHA1": 26, "FileHash-MD5": 22 }, "indicator_count": 1310, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "348 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f1bbda9e928a3743d1c379", "name": "InQuest - 05-04-2025", "description": "", "modified": "2025-05-05T23:03:32.288000", "created": "2025-04-05T23:25:13.994000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 569, "FileHash-SHA256": 550, "domain": 150, "hostname": 107, "FileHash-SHA1": 39, "FileHash-MD5": 41 }, "indicator_count": 1456, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "349 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67f06bc5e8059cb562270235", "name": "InQuest - 04-04-2025", "description": "", "modified": "2025-05-04T23:03:41.880000", "created": "2025-04-04T23:31:17.659000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 659, "FileHash-SHA256": 572, "FileHash-SHA1": 30, "FileHash-MD5": 43, "hostname": 138, "domain": 135 }, "indicator_count": 1577, "is_author": false, "is_subscribing": null, "subscriber_count": 1602, "modified_text": "350 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67ef1968f9c1c05c07ef00c0", "name": "InQuest - 03-04-2025", "description": "", "modified": "2025-05-03T23:03:06.090000", "created": "2025-04-03T23:27:36.140000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 533, "FileHash-MD5": 38, "URL": 728, "hostname": 134, "domain": 157, "FileHash-SHA1": 47 }, "indicator_count": 1637, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "351 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "67edc9471b28e16af7425847", "name": "InQuest - 02-04-2025", "description": "", "modified": "2025-05-02T23:03:33.268000", "created": "2025-04-02T23:33:27.853000", "tags": [], "references": [ "https://labs.inquest.net/iocdb" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 723, "FileHash-SHA256": 455, "domain": 142, "FileHash-MD5": 37, "hostname": 136, "FileHash-SHA1": 52 }, "indicator_count": 1545, "is_author": false, "is_subscribing": null, "subscriber_count": 1600, "modified_text": "352 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "608727a168e2a208ed73934d", "name": "Phishing Domains - GRIS", "description": "", "modified": "2024-04-08T17:22:16.826000", "created": "2021-04-26T20:50:41.547000", "tags": [ "Alaska" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [ "" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "corbeaucrypto", "id": "95126", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 30, "URL": 3, "IPv4": 1 }, "indicator_count": 34, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "741 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6472916de6ed16a9f9c76a42", "name": "Twitter Feed - m0zar7 - 27-05-2023", "description": "", "modified": "2023-05-27T23:25:33.719000", "created": "2023-05-27T23:25:33.719000", "tags": [ "phishing" ], "references": [ "https://twitter.com/m0zar7/status/1662267129427554304" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1, "domain": 1, "FileHash-MD5": 1, "hostname": 1 }, "indicator_count": 4, "is_author": false, "is_subscribing": null, "subscriber_count": 1601, "modified_text": "1058 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "r2.dev", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "r2.dev", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1776675000.995187 }