{
  "type": "Domain",
  "indicator": "simple-updatereport.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/simple-updatereport.com",
    "alexa": "http://www.alexa.com/siteinfo/simple-updatereport.com",
    "indicator": "simple-updatereport.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4016033356,
      "indicator": "simple-updatereport.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6859c53ade762dc5dbb4004c",
          "name": "Amadey Loader Infrastructure Mapping: Hunting Rules and Multi-AS Campaign Analysis.",
          "description": "A comprehensive investigation into Amadey Loader infrastructure starting from two known C2 domains (krakenlpay.com, 212.193.31.8). The research develops effective hunting rules using resource hash pivots via urlscan.io, identifying 323 related results and uncovering consistent patterns in panel naming conventions and URL structures. Analysis reveals infrastructure concentration across specific autonomous systems (AS51381, AS57523, AS216319, AS57678, AS216309) primarily in Russia, China, Seychelles, and Hong Kong. The investigation identifies common server configurations (Nginx 1.18.0 on Ubuntu, Apache 2.4.58) and creates detection rules based on login page characteristics. Contains IOCs for 35 IP addresses and 32 domains, with notable SSH fingerprint clustering indicating shared threat actor provisioning. Includes discussion of potential evasion techniques targeting security research platforms and the growing use of Cloudflare for infrastructure protection.",
          "modified": "2025-07-23T21:02:57.552000",
          "created": "2025-06-23T21:20:58.014000",
          "tags": [
            "amadey login",
            "amadey loader",
            "censys",
            "lumma stealer",
            "redline",
            "mystic",
            "secret blizzard",
            "amadey",
            "hash pivotusing",
            "resource hash",
            "lumma"
          ],
          "references": [
            "https://open.substack.com/pub/intelinsights/p/mapping-amadey-loader-infrastructure?utm_source=share&utm_medium=android&r=5l6xoe"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Russian Federation",
            "China"
          ],
          "malware_families": [
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            },
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2,
            "domain": 33
          },
          "indicator_count": 35,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 539,
          "modified_text": "311 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "672f6ed2b564f00b7c5cb13f",
          "name": "Threatfox Recent Additions",
          "description": "",
          "modified": "2025-06-13T19:00:02.811000",
          "created": "2024-11-09T14:16:50.032000",
          "tags": [],
          "references": [
            "",
            "https://threatfox.abuse.ch/export/csv/recent/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 96,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ameermane",
            "id": "77501",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 47587,
            "URL": 18714,
            "FileHash-SHA256": 36311,
            "FileHash-MD5": 1630,
            "FileHash-SHA1": 418,
            "hostname": 18190
          },
          "indicator_count": 122850,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "351 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6774e8cbdfa56e26aa4b1c00",
          "name": "Threat Intel Report - W53-2024",
          "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools. \n\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week. \n\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools. \n\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.",
          "modified": "2025-01-31T07:03:15.087000",
          "created": "2025-01-01T07:03:39.539000",
          "tags": [
            "mozi",
            "brazil",
            "germany",
            "kazakstan",
            "singapore",
            "week",
            "russia",
            "iocs",
            "australia",
            "france",
            "ukraine",
            "indonesia",
            "stealc",
            "malware",
            "mexico",
            "cryptbot",
            "amadey",
            "date",
            "belarus",
            "uruguay",
            "apache",
            "lumma",
            "contagious interview",
            "mirai"
          ],
          "references": [
            "https://any.run/malware-trends/",
            "https://urlhaus.abuse.ch/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            },
            {
              "id": "Contagious Interview",
              "display_name": "Contagious Interview",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [
            "Cryptocurrency"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "aa00643640@techmahindra.com",
            "id": "156540",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 81,
            "URL": 230,
            "FileHash-MD5": 9,
            "FileHash-SHA1": 9,
            "FileHash-SHA256": 15,
            "CVE": 1,
            "domain": 105
          },
          "indicator_count": 450,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 107,
          "modified_text": "484 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://any.run/malware-trends/",
        "https://threatfox.abuse.ch/export/csv/recent/",
        "https://urlhaus.abuse.ch/",
        "https://open.substack.com/pub/intelinsights/p/mapping-amadey-loader-infrastructure?utm_source=share&utm_medium=android&r=5l6xoe"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Amadey",
            "Contagious interview",
            "Mirai",
            "Lumma"
          ],
          "industries": [
            "Cryptocurrency"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6859c53ade762dc5dbb4004c",
      "name": "Amadey Loader Infrastructure Mapping: Hunting Rules and Multi-AS Campaign Analysis.",
      "description": "A comprehensive investigation into Amadey Loader infrastructure starting from two known C2 domains (krakenlpay.com, 212.193.31.8). The research develops effective hunting rules using resource hash pivots via urlscan.io, identifying 323 related results and uncovering consistent patterns in panel naming conventions and URL structures. Analysis reveals infrastructure concentration across specific autonomous systems (AS51381, AS57523, AS216319, AS57678, AS216309) primarily in Russia, China, Seychelles, and Hong Kong. The investigation identifies common server configurations (Nginx 1.18.0 on Ubuntu, Apache 2.4.58) and creates detection rules based on login page characteristics. Contains IOCs for 35 IP addresses and 32 domains, with notable SSH fingerprint clustering indicating shared threat actor provisioning. Includes discussion of potential evasion techniques targeting security research platforms and the growing use of Cloudflare for infrastructure protection.",
      "modified": "2025-07-23T21:02:57.552000",
      "created": "2025-06-23T21:20:58.014000",
      "tags": [
        "amadey login",
        "amadey loader",
        "censys",
        "lumma stealer",
        "redline",
        "mystic",
        "secret blizzard",
        "amadey",
        "hash pivotusing",
        "resource hash",
        "lumma"
      ],
      "references": [
        "https://open.substack.com/pub/intelinsights/p/mapping-amadey-loader-infrastructure?utm_source=share&utm_medium=android&r=5l6xoe"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Russian Federation",
        "China"
      ],
      "malware_families": [
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        },
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2,
        "domain": 33
      },
      "indicator_count": 35,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 539,
      "modified_text": "311 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "672f6ed2b564f00b7c5cb13f",
      "name": "Threatfox Recent Additions",
      "description": "",
      "modified": "2025-06-13T19:00:02.811000",
      "created": "2024-11-09T14:16:50.032000",
      "tags": [],
      "references": [
        "",
        "https://threatfox.abuse.ch/export/csv/recent/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 96,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ameermane",
        "id": "77501",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 47587,
        "URL": 18714,
        "FileHash-SHA256": 36311,
        "FileHash-MD5": 1630,
        "FileHash-SHA1": 418,
        "hostname": 18190
      },
      "indicator_count": 122850,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "351 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6774e8cbdfa56e26aa4b1c00",
      "name": "Threat Intel Report - W53-2024",
      "description": "This is a cyber-advisory document, presenting the compiled cyber threat intelligence sourced from various channels and tools. \n\nThese are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in this week. \n\nSecurity is a continuous process, and it has to be reviewed and audited on a continuous manner through manual or automated tools. \n\nThese details may be used as an additional layer to verify the current security posture of an organization against latest cyber trends.",
      "modified": "2025-01-31T07:03:15.087000",
      "created": "2025-01-01T07:03:39.539000",
      "tags": [
        "mozi",
        "brazil",
        "germany",
        "kazakstan",
        "singapore",
        "week",
        "russia",
        "iocs",
        "australia",
        "france",
        "ukraine",
        "indonesia",
        "stealc",
        "malware",
        "mexico",
        "cryptbot",
        "amadey",
        "date",
        "belarus",
        "uruguay",
        "apache",
        "lumma",
        "contagious interview",
        "mirai"
      ],
      "references": [
        "https://any.run/malware-trends/",
        "https://urlhaus.abuse.ch/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        },
        {
          "id": "Contagious Interview",
          "display_name": "Contagious Interview",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [
        "Cryptocurrency"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "aa00643640@techmahindra.com",
        "id": "156540",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 81,
        "URL": 230,
        "FileHash-MD5": 9,
        "FileHash-SHA1": 9,
        "FileHash-SHA256": 15,
        "CVE": 1,
        "domain": 105
      },
      "indicator_count": 450,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 107,
      "modified_text": "484 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "simple-updatereport.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "simple-updatereport.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780200715.9865205
}