{
  "type": "Domain",
  "indicator": "revcra.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/revcra.com",
    "alexa": "http://www.alexa.com/siteinfo/revcra.com",
    "indicator": "revcra.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2259406571,
      "indicator": "revcra.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "69b032248a2c31d6dcc647ff",
          "name": "Phishing | Mar 11, 2026 | Part 324/776",
          "description": "Phishing indicators. Date: Mar 11, 2026. Part 324/776. For more threat intelligence visit https://ltna.com.au/cyber",
          "modified": "2026-03-10T15:00:50.677000",
          "created": "2026-03-10T15:00:50.677000",
          "tags": [
            "phishing"
          ],
          "references": [
            "https://ltna.com.au/cyber"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "LTNA-Australia",
            "id": "380633",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1167,
            "domain": 833
          },
          "indicator_count": 2000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 93,
          "modified_text": "83 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6812e7ad9b8cafc0f7fec1ce",
          "name": "FHS - FBI Phishing Domains Associated with LabHost PhaaS Platform Users",
          "description": "The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate 42,000 phishing domains linked to the LabHost phishing-as-a-service (PhaaS) platform between November 2021 and April 2024. Prior to being disabled by law enforcement in April 2024, LabHost was one of the world\u2019s largest PhaaS providers, offering a range of illicit services for approximately 10,000 users. The platform enabled cyber criminals to impersonate more than 200 organizations, including major banks and government institutions, in an effort to collect personal information and banking credentials from unsuspecting victims worldwide. The FBI is releasing this information to maximize awareness and provide indicators of compromise that may be used by recipients for research and defense.",
          "modified": "2025-05-31T03:01:18.057000",
          "created": "2025-05-01T03:17:01.551000",
          "tags": [
            "Phishing Domains"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "FHS-Services",
            "id": "51336",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 67041,
            "URL": 60,
            "hostname": 17338
          },
          "indicator_count": 84439,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 62,
          "modified_text": "366 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68138d40723097f4c09d7724",
          "name": "FBI shares massive list of 42,000 LabHost phishing domains",
          "description": "",
          "modified": "2025-05-01T15:03:28.274000",
          "created": "2025-05-01T15:03:28.274000",
          "tags": [
            "LabHost",
            "Phishing"
          ],
          "references": [
            "https://www.ic3.gov/CSA/2025/LabHost_Domains.csv"
          ],
          "public": 1,
          "adversary": "LabHost",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Phishing",
              "display_name": "Phishing",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "VertekLabs",
            "id": "168455",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_168455/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 30,
            "domain": 33520,
            "hostname": 8669
          },
          "indicator_count": 42219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 562,
          "modified_text": "396 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68138d3cd48fd389972ce061",
          "name": "FBI shares massive list of 42,000 LabHost phishing domains",
          "description": "",
          "modified": "2025-05-01T15:03:24.415000",
          "created": "2025-05-01T15:03:24.415000",
          "tags": [
            "LabHost",
            "Phishing"
          ],
          "references": [
            "https://www.ic3.gov/CSA/2025/LabHost_Domains.csv"
          ],
          "public": 1,
          "adversary": "LabHost",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Phishing",
              "display_name": "Phishing",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "VertekLabs",
            "id": "168455",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_168455/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 30,
            "domain": 33520,
            "hostname": 8669
          },
          "indicator_count": 42219,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 561,
          "modified_text": "396 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6507e71385d966429fb82783",
          "name": "NEW Phishing Links Discovered 2023-09-18",
          "description": "",
          "modified": "2023-10-18T05:00:18.068000",
          "created": "2023-09-18T05:58:43.467000",
          "tags": [
            "sign",
            "search",
            "github",
            "strong",
            "code issues",
            "pull",
            "browse",
            "sast",
            "skip",
            "product actions",
            "star",
            "footer"
          ],
          "references": [
            "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/8862c986106a380915d200280a11f93030152568/phishing-domains-ACTIVE.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "akhanafeer",
            "id": "195327",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 33,
            "FileHash-SHA1": 1,
            "URL": 1,
            "domain": 50140,
            "hostname": 7669
          },
          "indicator_count": 57844,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 81,
          "modified_text": "957 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://ltna.com.au/cyber",
        "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/8862c986106a380915d200280a11f93030152568/phishing-domains-ACTIVE.txt",
        "https://www.ic3.gov/CSA/2025/LabHost_Domains.csv"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "LabHost"
          ],
          "malware_families": [
            "Phishing"
          ],
          "industries": [
            "Healthcare"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "69b032248a2c31d6dcc647ff",
      "name": "Phishing | Mar 11, 2026 | Part 324/776",
      "description": "Phishing indicators. Date: Mar 11, 2026. Part 324/776. For more threat intelligence visit https://ltna.com.au/cyber",
      "modified": "2026-03-10T15:00:50.677000",
      "created": "2026-03-10T15:00:50.677000",
      "tags": [
        "phishing"
      ],
      "references": [
        "https://ltna.com.au/cyber"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "LTNA-Australia",
        "id": "380633",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1167,
        "domain": 833
      },
      "indicator_count": 2000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 93,
      "modified_text": "83 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6812e7ad9b8cafc0f7fec1ce",
      "name": "FHS - FBI Phishing Domains Associated with LabHost PhaaS Platform Users",
      "description": "The Federal Bureau of Investigation (FBI) is releasing this FLASH to disseminate 42,000 phishing domains linked to the LabHost phishing-as-a-service (PhaaS) platform between November 2021 and April 2024. Prior to being disabled by law enforcement in April 2024, LabHost was one of the world\u2019s largest PhaaS providers, offering a range of illicit services for approximately 10,000 users. The platform enabled cyber criminals to impersonate more than 200 organizations, including major banks and government institutions, in an effort to collect personal information and banking credentials from unsuspecting victims worldwide. The FBI is releasing this information to maximize awareness and provide indicators of compromise that may be used by recipients for research and defense.",
      "modified": "2025-05-31T03:01:18.057000",
      "created": "2025-05-01T03:17:01.551000",
      "tags": [
        "Phishing Domains"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "FHS-Services",
        "id": "51336",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 67041,
        "URL": 60,
        "hostname": 17338
      },
      "indicator_count": 84439,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 62,
      "modified_text": "366 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68138d40723097f4c09d7724",
      "name": "FBI shares massive list of 42,000 LabHost phishing domains",
      "description": "",
      "modified": "2025-05-01T15:03:28.274000",
      "created": "2025-05-01T15:03:28.274000",
      "tags": [
        "LabHost",
        "Phishing"
      ],
      "references": [
        "https://www.ic3.gov/CSA/2025/LabHost_Domains.csv"
      ],
      "public": 1,
      "adversary": "LabHost",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Phishing",
          "display_name": "Phishing",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "VertekLabs",
        "id": "168455",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_168455/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 30,
        "domain": 33520,
        "hostname": 8669
      },
      "indicator_count": 42219,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 562,
      "modified_text": "396 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68138d3cd48fd389972ce061",
      "name": "FBI shares massive list of 42,000 LabHost phishing domains",
      "description": "",
      "modified": "2025-05-01T15:03:24.415000",
      "created": "2025-05-01T15:03:24.415000",
      "tags": [
        "LabHost",
        "Phishing"
      ],
      "references": [
        "https://www.ic3.gov/CSA/2025/LabHost_Domains.csv"
      ],
      "public": 1,
      "adversary": "LabHost",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Phishing",
          "display_name": "Phishing",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "VertekLabs",
        "id": "168455",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_168455/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 30,
        "domain": 33520,
        "hostname": 8669
      },
      "indicator_count": 42219,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 561,
      "modified_text": "396 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6507e71385d966429fb82783",
      "name": "NEW Phishing Links Discovered 2023-09-18",
      "description": "",
      "modified": "2023-10-18T05:00:18.068000",
      "created": "2023-09-18T05:58:43.467000",
      "tags": [
        "sign",
        "search",
        "github",
        "strong",
        "code issues",
        "pull",
        "browse",
        "sast",
        "skip",
        "product actions",
        "star",
        "footer"
      ],
      "references": [
        "https://raw.githubusercontent.com/mitchellkrogza/Phishing.Database/8862c986106a380915d200280a11f93030152568/phishing-domains-ACTIVE.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "akhanafeer",
        "id": "195327",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 33,
        "FileHash-SHA1": 1,
        "URL": 1,
        "domain": 50140,
        "hostname": 7669
      },
      "indicator_count": 57844,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 81,
      "modified_text": "957 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "revcra.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "revcra.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780363857.1159015
}