{
  "type": "Domain",
  "indicator": "searchmegood.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/searchmegood.com",
    "alexa": "http://www.alexa.com/siteinfo/searchmegood.com",
    "indicator": "searchmegood.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4008057892,
      "indicator": "searchmegood.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "67605e1014eb611bf6c3ea80",
          "name": "\u201cDeceptionAds\u201d \u2014 Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising",
          "description": "Guardio Labs reported on a large-scale fake captcha campaign distributing Lumma Stealer that circumvents general security measures like Safe Browsing. The campaign relies entirely on a single ad network for propagation (malvertising), Monetag, a subsidiary of ProepllerAds previously tracked by Infoblox under the name \u201cVane Viper.\u201d These ads, leveraging BeMob for tracking, receive over 1 million daily \u201cimpressions,\u201d potentially causing thousands of daily infections of Lumma Stealer\u00a0through a network of\u00a03,000+\u00a0sites using Monetag scripts. The research dissects this campaign and provides insights into the malvertising industry\u2019s infrastructure, tactics, and key players.",
          "modified": "2024-12-16T17:06:24.698000",
          "created": "2024-12-16T17:06:24.698000",
          "tags": [
            "Malvertising",
            "Lumma Stealer",
            "BeMob Ad Tracking"
          ],
          "references": [
            "https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "eric.ford",
            "id": "42510",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_42510/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 92,
            "URL": 94,
            "FileHash-MD5": 1,
            "hostname": 4
          },
          "indicator_count": 191,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 128,
          "modified_text": "484 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "676049d097dee16008d10a76",
          "name": "\u201cDeceptionAds\u201d \u2014 Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising",
          "description": "Research by Guardio Labs sheds light on the dark side of the internet advertising industry, revealing how malvertising on steroids is thriving and how web users are vulnerable to the threat of cyber-thieves.",
          "modified": "2024-12-16T15:40:00.031000",
          "created": "2024-12-16T15:40:00.031000",
          "tags": [
            "monetag",
            "bemob",
            "infoblox",
            "facebook",
            "guardio labs",
            "powershell",
            "system",
            "javascript",
            "js snippet",
            "service",
            "download",
            "example",
            "rest",
            "captcha lumma",
            "monetag tds"
          ],
          "references": [
            "https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Captcha Lumma",
              "display_name": "Captcha Lumma",
              "target": null
            },
            {
              "id": "Monetag TDS",
              "display_name": "Monetag TDS",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunter_NL",
            "id": "171283",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 92,
            "URL": 94,
            "FileHash-MD5": 1,
            "hostname": 4
          },
          "indicator_count": 191,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 843,
          "modified_text": "484 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6747ae5423483853dd03a506",
          "name": "ClickFix Baddys via RussianPanda's Workflow",
          "description": "https://malasada.tech/clickfix-baddys-via-russianpandas-workflow/",
          "modified": "2024-11-27T23:42:12.555000",
          "created": "2024-11-27T23:42:12.555000",
          "tags": [
            "ClickFix"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "malasada.tech",
            "id": "277538",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 147,
            "hostname": 8
          },
          "indicator_count": 155,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 28,
          "modified_text": "503 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Captcha lumma",
            "Lumma stealer",
            "Monetag tds"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "67605e1014eb611bf6c3ea80",
      "name": "\u201cDeceptionAds\u201d \u2014 Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising",
      "description": "Guardio Labs reported on a large-scale fake captcha campaign distributing Lumma Stealer that circumvents general security measures like Safe Browsing. The campaign relies entirely on a single ad network for propagation (malvertising), Monetag, a subsidiary of ProepllerAds previously tracked by Infoblox under the name \u201cVane Viper.\u201d These ads, leveraging BeMob for tracking, receive over 1 million daily \u201cimpressions,\u201d potentially causing thousands of daily infections of Lumma Stealer\u00a0through a network of\u00a03,000+\u00a0sites using Monetag scripts. The research dissects this campaign and provides insights into the malvertising industry\u2019s infrastructure, tactics, and key players.",
      "modified": "2024-12-16T17:06:24.698000",
      "created": "2024-12-16T17:06:24.698000",
      "tags": [
        "Malvertising",
        "Lumma Stealer",
        "BeMob Ad Tracking"
      ],
      "references": [
        "https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "eric.ford",
        "id": "42510",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_42510/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 92,
        "URL": 94,
        "FileHash-MD5": 1,
        "hostname": 4
      },
      "indicator_count": 191,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 128,
      "modified_text": "484 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "676049d097dee16008d10a76",
      "name": "\u201cDeceptionAds\u201d \u2014 Fake Captcha Driving Infostealer Infections and a Glimpse to the Dark Side of Internet Advertising",
      "description": "Research by Guardio Labs sheds light on the dark side of the internet advertising industry, revealing how malvertising on steroids is thriving and how web users are vulnerable to the threat of cyber-thieves.",
      "modified": "2024-12-16T15:40:00.031000",
      "created": "2024-12-16T15:40:00.031000",
      "tags": [
        "monetag",
        "bemob",
        "infoblox",
        "facebook",
        "guardio labs",
        "powershell",
        "system",
        "javascript",
        "js snippet",
        "service",
        "download",
        "example",
        "rest",
        "captcha lumma",
        "monetag tds"
      ],
      "references": [
        "https://labs.guard.io/deceptionads-fake-captcha-driving-infostealer-infections-and-a-glimpse-to-the-dark-side-of-0c516f4dc0b6"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Captcha Lumma",
          "display_name": "Captcha Lumma",
          "target": null
        },
        {
          "id": "Monetag TDS",
          "display_name": "Monetag TDS",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunter_NL",
        "id": "171283",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 92,
        "URL": 94,
        "FileHash-MD5": 1,
        "hostname": 4
      },
      "indicator_count": 191,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 843,
      "modified_text": "484 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6747ae5423483853dd03a506",
      "name": "ClickFix Baddys via RussianPanda's Workflow",
      "description": "https://malasada.tech/clickfix-baddys-via-russianpandas-workflow/",
      "modified": "2024-11-27T23:42:12.555000",
      "created": "2024-11-27T23:42:12.555000",
      "tags": [
        "ClickFix"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "malasada.tech",
        "id": "277538",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 147,
        "hostname": 8
      },
      "indicator_count": 155,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 28,
      "modified_text": "503 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "searchmegood.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "searchmegood.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776228705.7054236
}