{
  "type": "Domain",
  "indicator": "randomfruits.net",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/randomfruits.net",
    "alexa": "http://www.alexa.com/siteinfo/randomfruits.net",
    "indicator": "randomfruits.net",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 94572,
      "indicator": "randomfruits.net",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "5674426c4637f25637d044fc",
          "name": "PoS Malware and Operation Black Atlas",
          "description": "Operation Black Atlas has already spread to a multi-state healthcare provider, dental clinics, a machine manufacturer, a technology company focusing on insurance services, a gas station that has a multi-state presence, and a beauty supply shop. It continues to spread across small and medium-sized businesses across the globe, using the modular Gorynych/Diamond Fox botnet to exfiltrate stolen data.",
          "modified": "2018-04-10T17:09:23.143000",
          "created": "2015-12-18T17:29:16.039000",
          "tags": [
            "pos",
            "point of sales",
            "black atlas",
            "GORYNYCH",
            "blackpos",
            "kasidet",
            "centerpos",
            "neutrino",
            "rdp",
            "NewPOSThings",
            "PwnPOS",
            "alina",
            "Joker",
            "spygate",
            "PosHook",
            "fgdump",
            "Diamond Fox",
            "trendmicro"
          ],
          "references": [
            "http://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-part-2-tools-and-malware-used-and-how-to-detect-them/",
            "http://documents.trendmicro.com/assets/Operation%20Black%20Atlas_Indicators_of_Compromise.pdf",
            "http://documents.trendmicro.com/assets/Operation_Black%20Atlas_Technical_Brief.pdf"
          ],
          "public": 1,
          "adversary": null,
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 7.0,
          "downvotes_count": 1.0,
          "votes_count": 6.0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 18,
            "hostname": 2,
            "FileHash-SHA1": 70,
            "email": 4,
            "YARA": 24,
            "FileHash-MD5": 7
          },
          "indicator_count": 125,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386530,
          "modified_text": "2972 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "562e5e2f4637f2189130da69",
          "name": "NewPOSThings updated activity",
          "description": "New activity from NewPOSThings and the \"You Chung\" actor. It is assumed that actors using the malware are targeting small- to medium-sized businesses given the malware\u2019s focus on VNC applications. Small businesses are generally more likely to use remote administration software for their POS terminals so that 3rd parties can manage the terminals.",
          "modified": "2016-01-11T22:35:49.432000",
          "created": "2015-10-26T17:09:03.211000",
          "tags": [
            "NewPOSThings",
            "pos",
            "point of sales",
            "malware",
            "VNC"
          ],
          "references": [
            "http://www.cyintanalysis.com/a-quick-look-at-a-likely-newposthings-sample/"
          ],
          "public": 1,
          "adversary": null,
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 44,
          "upvotes_count": 1.0,
          "downvotes_count": 1.0,
          "votes_count": 0.0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 9,
            "FileHash-MD5": 2
          },
          "indicator_count": 11,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386524,
          "modified_text": "3792 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63456c2a30b92337ea1670e0",
          "name": "IOC Records Provided by @NextRayAI",
          "description": "This IOC report provided and daily updated by NextRay AI Detection & Response Inc.",
          "modified": "2026-05-31T01:02:14",
          "created": "2022-10-11T13:14:18.676000",
          "tags": [
            "Nextray",
            "cyber security",
            "ioc",
            "phishing",
            "malicious"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Turkey",
            "Ukraine",
            "Romania",
            "Czechia",
            "United Kingdom of Great Britain and Northern Ireland",
            "Norway",
            "Lithuania",
            "Estonia",
            "Latvia",
            "Poland",
            "Germany",
            "Canada",
            "France",
            "Denmark"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Defense",
            "Industrial",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1330,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "NextRay-AI",
            "id": "210822",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_210822/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 498917,
            "IPv4": 64343,
            "IPv6": 459,
            "hostname": 59385,
            "URL": 166783,
            "CIDR": 5266,
            "FileHash-MD5": 29699,
            "FileHash-SHA256": 50449,
            "CVE": 348,
            "email": 914,
            "Mutex": 49,
            "FileHash-SHA1": 3453,
            "FilePath": 34
          },
          "indicator_count": 880099,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 300,
          "modified_text": "9 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "657079cd19135bde236b4f95",
          "name": "PoS Malware and Operation Black Atlas",
          "description": "",
          "modified": "2023-12-06T13:40:29.299000",
          "created": "2023-12-06T13:40:29.299000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 18,
            "hostname": 2,
            "FileHash-SHA1": 70,
            "email": 4,
            "YARA": 24,
            "FileHash-MD5": 7
          },
          "indicator_count": 125,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "906 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.cyintanalysis.com/a-quick-look-at-a-likely-newposthings-sample/",
        "http://documents.trendmicro.com/assets/Operation%20Black%20Atlas_Indicators_of_Compromise.pdf",
        "http://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-part-2-tools-and-malware-used-and-how-to-detect-them/",
        "http://documents.trendmicro.com/assets/Operation_Black%20Atlas_Technical_Brief.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Defense",
            "Government",
            "Industrial"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "5674426c4637f25637d044fc",
      "name": "PoS Malware and Operation Black Atlas",
      "description": "Operation Black Atlas has already spread to a multi-state healthcare provider, dental clinics, a machine manufacturer, a technology company focusing on insurance services, a gas station that has a multi-state presence, and a beauty supply shop. It continues to spread across small and medium-sized businesses across the globe, using the modular Gorynych/Diamond Fox botnet to exfiltrate stolen data.",
      "modified": "2018-04-10T17:09:23.143000",
      "created": "2015-12-18T17:29:16.039000",
      "tags": [
        "pos",
        "point of sales",
        "black atlas",
        "GORYNYCH",
        "blackpos",
        "kasidet",
        "centerpos",
        "neutrino",
        "rdp",
        "NewPOSThings",
        "PwnPOS",
        "alina",
        "Joker",
        "spygate",
        "PosHook",
        "fgdump",
        "Diamond Fox",
        "trendmicro"
      ],
      "references": [
        "http://blog.trendmicro.com/trendlabs-security-intelligence/operation-black-atlas-part-2-tools-and-malware-used-and-how-to-detect-them/",
        "http://documents.trendmicro.com/assets/Operation%20Black%20Atlas_Indicators_of_Compromise.pdf",
        "http://documents.trendmicro.com/assets/Operation_Black%20Atlas_Technical_Brief.pdf"
      ],
      "public": 1,
      "adversary": null,
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 7.0,
      "downvotes_count": 1.0,
      "votes_count": 6.0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 18,
        "hostname": 2,
        "FileHash-SHA1": 70,
        "email": 4,
        "YARA": 24,
        "FileHash-MD5": 7
      },
      "indicator_count": 125,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386530,
      "modified_text": "2972 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "562e5e2f4637f2189130da69",
      "name": "NewPOSThings updated activity",
      "description": "New activity from NewPOSThings and the \"You Chung\" actor. It is assumed that actors using the malware are targeting small- to medium-sized businesses given the malware\u2019s focus on VNC applications. Small businesses are generally more likely to use remote administration software for their POS terminals so that 3rd parties can manage the terminals.",
      "modified": "2016-01-11T22:35:49.432000",
      "created": "2015-10-26T17:09:03.211000",
      "tags": [
        "NewPOSThings",
        "pos",
        "point of sales",
        "malware",
        "VNC"
      ],
      "references": [
        "http://www.cyintanalysis.com/a-quick-look-at-a-likely-newposthings-sample/"
      ],
      "public": 1,
      "adversary": null,
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 44,
      "upvotes_count": 1.0,
      "downvotes_count": 1.0,
      "votes_count": 0.0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 9,
        "FileHash-MD5": 2
      },
      "indicator_count": 11,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386524,
      "modified_text": "3792 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "63456c2a30b92337ea1670e0",
      "name": "IOC Records Provided by @NextRayAI",
      "description": "This IOC report provided and daily updated by NextRay AI Detection & Response Inc.",
      "modified": "2026-05-31T01:02:14",
      "created": "2022-10-11T13:14:18.676000",
      "tags": [
        "Nextray",
        "cyber security",
        "ioc",
        "phishing",
        "malicious"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Turkey",
        "Ukraine",
        "Romania",
        "Czechia",
        "United Kingdom of Great Britain and Northern Ireland",
        "Norway",
        "Lithuania",
        "Estonia",
        "Latvia",
        "Poland",
        "Germany",
        "Canada",
        "France",
        "Denmark"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Defense",
        "Industrial",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1330,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "NextRay-AI",
        "id": "210822",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_210822/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 498917,
        "IPv4": 64343,
        "IPv6": 459,
        "hostname": 59385,
        "URL": 166783,
        "CIDR": 5266,
        "FileHash-MD5": 29699,
        "FileHash-SHA256": 50449,
        "CVE": 348,
        "email": 914,
        "Mutex": 49,
        "FileHash-SHA1": 3453,
        "FilePath": 34
      },
      "indicator_count": 880099,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 300,
      "modified_text": "9 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "657079cd19135bde236b4f95",
      "name": "PoS Malware and Operation Black Atlas",
      "description": "",
      "modified": "2023-12-06T13:40:29.299000",
      "created": "2023-12-06T13:40:29.299000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 18,
        "hostname": 2,
        "FileHash-SHA1": 70,
        "email": 4,
        "YARA": 24,
        "FileHash-MD5": 7
      },
      "indicator_count": 125,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "906 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "randomfruits.net",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "randomfruits.net",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780222151.8004599
}