{
  "type": "Domain",
  "indicator": "readerduckreflected.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/readerduckreflected.com",
    "alexa": "http://www.alexa.com/siteinfo/readerduckreflected.com",
    "indicator": "readerduckreflected.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3764220614,
      "indicator": "readerduckreflected.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68c5dfd6efb85eee0d549104",
          "name": "Lavasoft Blacklist",
          "description": "",
          "modified": "2025-10-13T21:18:10.129000",
          "created": "2025-09-13T21:19:18.990000",
          "tags": [],
          "references": [
            "https://acscdn.lavasoft.com/urlblacklist.json"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "FileHash-SHA1": 3,
            "URL": 7,
            "domain": 10938,
            "hostname": 208
          },
          "indicator_count": 11162,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 180,
          "modified_text": "188 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7b4eb565273001e2e08",
          "name": "Ireland Netsky | Relay Router | Misc Attack on LTL Fright Outage",
          "description": "",
          "modified": "2023-12-06T16:56:20.491000",
          "created": "2023-12-06T16:56:20.491000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1353,
            "CVE": 8,
            "FileHash-SHA256": 3611,
            "domain": 795,
            "URL": 2831,
            "FileHash-MD5": 663,
            "FileHash-SHA1": 398
          },
          "indicator_count": 9659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "651cd4a6af63714f51c8d721",
          "name": "Ireland Netsky | Relay Router | Misc Attack on LTL Fright Outage",
          "description": "Cobalt Strike , FireHol anonymization,  IT Attack, Suricata Alert, MITRE. Appears to be a complete cyber attack against a well known LTL Fright lines IT system.",
          "modified": "2023-11-03T02:03:00.398000",
          "created": "2023-10-04T02:57:42.183000",
          "tags": [
            "united",
            "smtp service",
            "firehol",
            "pony",
            "s1us",
            "s1de",
            "spammer",
            "proxy",
            "ireland netsky",
            "anonymizer",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "alexa",
            "detection list",
            "blacklist",
            "malicious url",
            "blacklist http",
            "linkid252669",
            "noname057",
            "url summary",
            "summary",
            "sample",
            "samples",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc activity",
            "et policy",
            "tor ssl",
            "Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49",
            "cyber criminal",
            "FireHOL",
            "Suricata Alert",
            "HTML document, ASCII text",
            "mail spammer",
            "malware site",
            "heur",
            "malware",
            "adware",
            "malicious site",
            "phishing site",
            "artemis",
            "unsafe",
            "exploit",
            "iframe",
            "fakealert",
            "opencandy",
            "riskware",
            "genkryptik",
            "nircmd",
            "swrort",
            "downldr",
            "crack",
            "tiggre",
            "presenoker",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "coinminer",
            "dropper",
            "cobalt strike",
            "acint",
            "systweak",
            "behav",
            "agent",
            "phishing",
            "maltiverse",
            "trojanspy",
            "webtoolbar",
            "phishing",
            "exploit-source"
          ],
          "references": [
            "-Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49DD/",
            "https://www.hybrid-analysis.com/sample/fa1f15bd4c0cd287fe04f324d3363a8b5a295b57cb22d9ea0f3d6973eb442d17/651c94c00b17fb9324040f7c"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "Trojan:Win32/Tiggre",
              "display_name": "Trojan:Win32/Tiggre",
              "target": "/malware/Trojan:Win32/Tiggre"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "Ireland Netsky",
              "display_name": "Ireland Netsky",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [
            "Transportation",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 795,
            "FileHash-MD5": 663,
            "hostname": 1353,
            "URL": 2831,
            "FileHash-SHA1": 398,
            "FileHash-SHA256": 3611,
            "CVE": 8
          },
          "indicator_count": 9659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "899 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1a8f35a050560dcd3b00",
          "name": "Ireland Netsky | Relay Router | Misc Attack on LTL Fright Outage",
          "description": "",
          "modified": "2023-11-03T02:03:00.398000",
          "created": "2023-10-30T02:53:03.811000",
          "tags": [
            "united",
            "smtp service",
            "firehol",
            "pony",
            "s1us",
            "s1de",
            "spammer",
            "proxy",
            "ireland netsky",
            "anonymizer",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "alexa",
            "detection list",
            "blacklist",
            "malicious url",
            "blacklist http",
            "linkid252669",
            "noname057",
            "url summary",
            "summary",
            "sample",
            "samples",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc activity",
            "et policy",
            "tor ssl",
            "Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49",
            "cyber criminal",
            "FireHOL",
            "Suricata Alert",
            "HTML document, ASCII text",
            "mail spammer",
            "malware site",
            "heur",
            "malware",
            "adware",
            "malicious site",
            "phishing site",
            "artemis",
            "unsafe",
            "exploit",
            "iframe",
            "fakealert",
            "opencandy",
            "riskware",
            "genkryptik",
            "nircmd",
            "swrort",
            "downldr",
            "crack",
            "tiggre",
            "presenoker",
            "filetour",
            "cleaner",
            "conduit",
            "wacatac",
            "coinminer",
            "dropper",
            "cobalt strike",
            "acint",
            "systweak",
            "behav",
            "agent",
            "phishing",
            "maltiverse",
            "trojanspy",
            "webtoolbar",
            "phishing",
            "exploit-source"
          ],
          "references": [
            "-Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49DD/",
            "https://www.hybrid-analysis.com/sample/fa1f15bd4c0cd287fe04f324d3363a8b5a295b57cb22d9ea0f3d6973eb442d17/651c94c00b17fb9324040f7c"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "OpenCandy",
              "display_name": "OpenCandy",
              "target": null
            },
            {
              "id": "Trojan:Win32/Tiggre",
              "display_name": "Trojan:Win32/Tiggre",
              "target": "/malware/Trojan:Win32/Tiggre"
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "Ireland Netsky",
              "display_name": "Ireland Netsky",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [
            "Transportation",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": "651cd4a6af63714f51c8d721",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 795,
            "FileHash-MD5": 663,
            "hostname": 1353,
            "URL": 2831,
            "FileHash-SHA1": 398,
            "FileHash-SHA256": 3611,
            "CVE": 8
          },
          "indicator_count": 9659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "899 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "-Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49DD/",
        "https://www.hybrid-analysis.com/sample/fa1f15bd4c0cd287fe04f324d3363a8b5a295b57cb22d9ea0f3d6973eb442d17/651c94c00b17fb9324040f7c",
        "https://acscdn.lavasoft.com/urlblacklist.json"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Maltiverse",
            "Cobalt strike",
            "Artemis",
            "Opencandy",
            "Trojanspy",
            "Ireland netsky",
            "Trojan:win32/tiggre",
            "Webtoolbar"
          ],
          "industries": [
            "Technology",
            "Transportation"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68c5dfd6efb85eee0d549104",
      "name": "Lavasoft Blacklist",
      "description": "",
      "modified": "2025-10-13T21:18:10.129000",
      "created": "2025-09-13T21:19:18.990000",
      "tags": [],
      "references": [
        "https://acscdn.lavasoft.com/urlblacklist.json"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "FileHash-SHA1": 3,
        "URL": 7,
        "domain": 10938,
        "hostname": 208
      },
      "indicator_count": 11162,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 180,
      "modified_text": "188 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7b4eb565273001e2e08",
      "name": "Ireland Netsky | Relay Router | Misc Attack on LTL Fright Outage",
      "description": "",
      "modified": "2023-12-06T16:56:20.491000",
      "created": "2023-12-06T16:56:20.491000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1353,
        "CVE": 8,
        "FileHash-SHA256": 3611,
        "domain": 795,
        "URL": 2831,
        "FileHash-MD5": 663,
        "FileHash-SHA1": 398
      },
      "indicator_count": 9659,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "651cd4a6af63714f51c8d721",
      "name": "Ireland Netsky | Relay Router | Misc Attack on LTL Fright Outage",
      "description": "Cobalt Strike , FireHol anonymization,  IT Attack, Suricata Alert, MITRE. Appears to be a complete cyber attack against a well known LTL Fright lines IT system.",
      "modified": "2023-11-03T02:03:00.398000",
      "created": "2023-10-04T02:57:42.183000",
      "tags": [
        "united",
        "smtp service",
        "firehol",
        "pony",
        "s1us",
        "s1de",
        "spammer",
        "proxy",
        "ireland netsky",
        "anonymizer",
        "cisco umbrella",
        "site",
        "safe site",
        "million",
        "alexa top",
        "alexa",
        "detection list",
        "blacklist",
        "malicious url",
        "blacklist http",
        "linkid252669",
        "noname057",
        "url summary",
        "summary",
        "sample",
        "samples",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc activity",
        "et policy",
        "tor ssl",
        "Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49",
        "cyber criminal",
        "FireHOL",
        "Suricata Alert",
        "HTML document, ASCII text",
        "mail spammer",
        "malware site",
        "heur",
        "malware",
        "adware",
        "malicious site",
        "phishing site",
        "artemis",
        "unsafe",
        "exploit",
        "iframe",
        "fakealert",
        "opencandy",
        "riskware",
        "genkryptik",
        "nircmd",
        "swrort",
        "downldr",
        "crack",
        "tiggre",
        "presenoker",
        "filetour",
        "cleaner",
        "conduit",
        "wacatac",
        "coinminer",
        "dropper",
        "cobalt strike",
        "acint",
        "systweak",
        "behav",
        "agent",
        "phishing",
        "maltiverse",
        "trojanspy",
        "webtoolbar",
        "phishing",
        "exploit-source"
      ],
      "references": [
        "-Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49DD/",
        "https://www.hybrid-analysis.com/sample/fa1f15bd4c0cd287fe04f324d3363a8b5a295b57cb22d9ea0f3d6973eb442d17/651c94c00b17fb9324040f7c"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "Trojan:Win32/Tiggre",
          "display_name": "Trojan:Win32/Tiggre",
          "target": "/malware/Trojan:Win32/Tiggre"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "Ireland Netsky",
          "display_name": "Ireland Netsky",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [
        "Transportation",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 795,
        "FileHash-MD5": 663,
        "hostname": 1353,
        "URL": 2831,
        "FileHash-SHA1": 398,
        "FileHash-SHA256": 3611,
        "CVE": 8
      },
      "indicator_count": 9659,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "899 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f1a8f35a050560dcd3b00",
      "name": "Ireland Netsky | Relay Router | Misc Attack on LTL Fright Outage",
      "description": "",
      "modified": "2023-11-03T02:03:00.398000",
      "created": "2023-10-30T02:53:03.811000",
      "tags": [
        "united",
        "smtp service",
        "firehol",
        "pony",
        "s1us",
        "s1de",
        "spammer",
        "proxy",
        "ireland netsky",
        "anonymizer",
        "cisco umbrella",
        "site",
        "safe site",
        "million",
        "alexa top",
        "alexa",
        "detection list",
        "blacklist",
        "malicious url",
        "blacklist http",
        "linkid252669",
        "noname057",
        "url summary",
        "summary",
        "sample",
        "samples",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc activity",
        "et policy",
        "tor ssl",
        "Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49",
        "cyber criminal",
        "FireHOL",
        "Suricata Alert",
        "HTML document, ASCII text",
        "mail spammer",
        "malware site",
        "heur",
        "malware",
        "adware",
        "malicious site",
        "phishing site",
        "artemis",
        "unsafe",
        "exploit",
        "iframe",
        "fakealert",
        "opencandy",
        "riskware",
        "genkryptik",
        "nircmd",
        "swrort",
        "downldr",
        "crack",
        "tiggre",
        "presenoker",
        "filetour",
        "cleaner",
        "conduit",
        "wacatac",
        "coinminer",
        "dropper",
        "cobalt strike",
        "acint",
        "systweak",
        "behav",
        "agent",
        "phishing",
        "maltiverse",
        "trojanspy",
        "webtoolbar",
        "phishing",
        "exploit-source"
      ],
      "references": [
        "-Hostname: RecoveryStore-3.7.5.1.4.6.2.0-D917-11E7-B67B-080027A49DD/",
        "https://www.hybrid-analysis.com/sample/fa1f15bd4c0cd287fe04f324d3363a8b5a295b57cb22d9ea0f3d6973eb442d17/651c94c00b17fb9324040f7c"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "OpenCandy",
          "display_name": "OpenCandy",
          "target": null
        },
        {
          "id": "Trojan:Win32/Tiggre",
          "display_name": "Trojan:Win32/Tiggre",
          "target": "/malware/Trojan:Win32/Tiggre"
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "Ireland Netsky",
          "display_name": "Ireland Netsky",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [
        "Transportation",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": "651cd4a6af63714f51c8d721",
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 795,
        "FileHash-MD5": 663,
        "hostname": 1353,
        "URL": 2831,
        "FileHash-SHA1": 398,
        "FileHash-SHA256": 3611,
        "CVE": 8
      },
      "indicator_count": 9659,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "899 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "readerduckreflected.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "readerduckreflected.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776681423.3628757
}