{
  "type": "Domain",
  "indicator": "socketconnection.tk",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/socketconnection.tk",
    "alexa": "http://www.alexa.com/siteinfo/socketconnection.tk",
    "indicator": "socketconnection.tk",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3824161113,
      "indicator": "socketconnection.tk",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "692f04e9fa3d782118e94aac",
          "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
          "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
          "modified": "2026-01-01T15:04:20.907000",
          "created": "2025-12-02T15:25:29.158000",
          "tags": [
            "levelblue",
            "open threat",
            "dynamicloader",
            "tlsv1",
            "high",
            "msie",
            "windows nt",
            "delete c",
            "fwlink",
            "stream",
            "powershell",
            "write",
            "malware",
            "local",
            "united",
            "flag",
            "date",
            "server",
            "crazy egg",
            "name server",
            "gmt flag",
            "domain address",
            "markmonitor",
            "enom",
            "sugges",
            "onv incude",
            "data upload",
            "find s",
            "extraction",
            "types",
            "type",
            "indicator",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "contacted hosts",
            "search",
            "entries",
            "read c",
            "medium",
            "memcommit",
            "tls handshake",
            "failure",
            "module load",
            "next",
            "execution",
            "dock",
            "capture",
            "persistence",
            "copy",
            "unknown",
            "suricata alert",
            "et info",
            "bad traffic",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "t1480 execution",
            "file defense",
            "write c",
            "x02x82",
            "xe6x15c6",
            "x16f",
            "xc0xc0xc0",
            "revengerat",
            "guard",
            "service",
            "encrypt",
            "entries yara",
            "delphi",
            "win32",
            "jordan",
            "delete app"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
            "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
            "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
            "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Vmprotect-9880726-0",
              "display_name": "Win.Malware.Vmprotect-9880726-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4624,
            "FileHash-SHA256": 2021,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 20,
            "SSLCertFingerprint": 10,
            "hostname": 1433,
            "domain": 728
          },
          "indicator_count": 8887,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "107 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d37e35f99d852d38beb769",
          "name": "Cryptex Port Key  \u2022 RedLine Stealer affects Threat Research Platform/s",
          "description": "#attack?  #honeypot?",
          "modified": "2025-10-24T04:02:54.218000",
          "created": "2025-09-24T05:14:28.101000",
          "tags": [
            "x00x00n",
            "memcommit",
            "regopenkeyexw",
            "regsz",
            "else",
            "ipnnoysrdi tr",
            "writeconsolew",
            "cryptexportkey",
            "invalid pointer",
            "x1ex00x00n",
            "redline stealer",
            "service",
            "powershell",
            "tools",
            "persistence",
            "execution",
            "dock",
            "write",
            "updater",
            "malware",
            "passive dns",
            "urls",
            "url add",
            "ip address",
            "related nids",
            "files location",
            "hong kong",
            "united",
            "present jul",
            "present dec",
            "search",
            "present may",
            "a domains",
            "name servers",
            "unknown aaaa",
            "trojan",
            "present jan",
            "present sep",
            "moved",
            "title",
            "span td",
            "td td",
            "tr tr",
            "a li",
            "ipv4 internet",
            "span",
            "meta",
            "gmt content",
            "ipv4 add",
            "reverse dns",
            "trojanx",
            "location hong kong",
            "software",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "development att",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck matrix",
            "sha1",
            "odigicert inc",
            "network traffic",
            "general",
            "local",
            "path",
            "encrypt",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "crlf line",
            "urlhttps",
            "extracted files",
            "acquires",
            "networking",
            "readiness"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1086",
              "name": "PowerShell",
              "display_name": "T1086 - PowerShell"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 150,
            "FileHash-SHA1": 148,
            "FileHash-SHA256": 3059,
            "domain": 1277,
            "URL": 4166,
            "hostname": 1251,
            "SSLCertFingerprint": 10,
            "email": 1
          },
          "indicator_count": 10062,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "177 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65aab954f5f03a1f2906b39c",
          "name": "Zerobot",
          "description": "",
          "modified": "2024-10-12T07:01:26.973000",
          "created": "2024-01-19T18:03:00.966000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65aa168aeddea4851fc47cc3",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 123,
            "FileHash-SHA1": 123,
            "FileHash-SHA256": 2498,
            "domain": 1600,
            "hostname": 2749,
            "URL": 6303,
            "CVE": 1
          },
          "indicator_count": 13397,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "554 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65aa168aeddea4851fc47cc3",
          "name": "Zerobot & Skynet",
          "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
          "modified": "2024-03-23T01:01:38.014000",
          "created": "2024-01-19T06:28:26.343000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 78,
            "FileHash-SHA1": 78,
            "FileHash-SHA256": 2290,
            "domain": 1491,
            "hostname": 2611,
            "URL": 5879,
            "CVE": 8
          },
          "indicator_count": 12435,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "757 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source",
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Skynet",
            "Zerobot",
            "Other malware",
            "Win.malware.vmprotect-9880726-0"
          ],
          "industries": [
            "Technology",
            "Legal"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "692f04e9fa3d782118e94aac",
      "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
      "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
      "modified": "2026-01-01T15:04:20.907000",
      "created": "2025-12-02T15:25:29.158000",
      "tags": [
        "levelblue",
        "open threat",
        "dynamicloader",
        "tlsv1",
        "high",
        "msie",
        "windows nt",
        "delete c",
        "fwlink",
        "stream",
        "powershell",
        "write",
        "malware",
        "local",
        "united",
        "flag",
        "date",
        "server",
        "crazy egg",
        "name server",
        "gmt flag",
        "domain address",
        "markmonitor",
        "enom",
        "sugges",
        "onv incude",
        "data upload",
        "find s",
        "extraction",
        "types",
        "type",
        "indicator",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "contacted hosts",
        "search",
        "entries",
        "read c",
        "medium",
        "memcommit",
        "tls handshake",
        "failure",
        "module load",
        "next",
        "execution",
        "dock",
        "capture",
        "persistence",
        "copy",
        "unknown",
        "suricata alert",
        "et info",
        "bad traffic",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "t1480 execution",
        "file defense",
        "write c",
        "x02x82",
        "xe6x15c6",
        "x16f",
        "xc0xc0xc0",
        "revengerat",
        "guard",
        "service",
        "encrypt",
        "entries yara",
        "delphi",
        "win32",
        "jordan",
        "delete app"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Vmprotect-9880726-0",
          "display_name": "Win.Malware.Vmprotect-9880726-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [
        "Technology",
        "Legal"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4624,
        "FileHash-SHA256": 2021,
        "FileHash-MD5": 51,
        "FileHash-SHA1": 20,
        "SSLCertFingerprint": 10,
        "hostname": 1433,
        "domain": 728
      },
      "indicator_count": 8887,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "107 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d37e35f99d852d38beb769",
      "name": "Cryptex Port Key  \u2022 RedLine Stealer affects Threat Research Platform/s",
      "description": "#attack?  #honeypot?",
      "modified": "2025-10-24T04:02:54.218000",
      "created": "2025-09-24T05:14:28.101000",
      "tags": [
        "x00x00n",
        "memcommit",
        "regopenkeyexw",
        "regsz",
        "else",
        "ipnnoysrdi tr",
        "writeconsolew",
        "cryptexportkey",
        "invalid pointer",
        "x1ex00x00n",
        "redline stealer",
        "service",
        "powershell",
        "tools",
        "persistence",
        "execution",
        "dock",
        "write",
        "updater",
        "malware",
        "passive dns",
        "urls",
        "url add",
        "ip address",
        "related nids",
        "files location",
        "hong kong",
        "united",
        "present jul",
        "present dec",
        "search",
        "present may",
        "a domains",
        "name servers",
        "unknown aaaa",
        "trojan",
        "present jan",
        "present sep",
        "moved",
        "title",
        "span td",
        "td td",
        "tr tr",
        "a li",
        "ipv4 internet",
        "span",
        "meta",
        "gmt content",
        "ipv4 add",
        "reverse dns",
        "trojanx",
        "location hong kong",
        "software",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "development att",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck matrix",
        "sha1",
        "odigicert inc",
        "network traffic",
        "general",
        "local",
        "path",
        "encrypt",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "crlf line",
        "urlhttps",
        "extracted files",
        "acquires",
        "networking",
        "readiness"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1086",
          "name": "PowerShell",
          "display_name": "T1086 - PowerShell"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 150,
        "FileHash-SHA1": 148,
        "FileHash-SHA256": 3059,
        "domain": 1277,
        "URL": 4166,
        "hostname": 1251,
        "SSLCertFingerprint": 10,
        "email": 1
      },
      "indicator_count": 10062,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "177 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65aab954f5f03a1f2906b39c",
      "name": "Zerobot",
      "description": "",
      "modified": "2024-10-12T07:01:26.973000",
      "created": "2024-01-19T18:03:00.966000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "whois whois",
        "communicating",
        "subdomains",
        "contacted",
        "c1on",
        "cmdwget http",
        "metro",
        "zerobot",
        "execution",
        "skynet",
        "june"
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ZeroBot",
          "display_name": "ZeroBot",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65aa168aeddea4851fc47cc3",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 123,
        "FileHash-SHA1": 123,
        "FileHash-SHA256": 2498,
        "domain": 1600,
        "hostname": 2749,
        "URL": 6303,
        "CVE": 1
      },
      "indicator_count": 13397,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "554 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65aa168aeddea4851fc47cc3",
      "name": "Zerobot & Skynet",
      "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
      "modified": "2024-03-23T01:01:38.014000",
      "created": "2024-01-19T06:28:26.343000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "whois whois",
        "communicating",
        "subdomains",
        "contacted",
        "c1on",
        "cmdwget http",
        "metro",
        "zerobot",
        "execution",
        "skynet",
        "june"
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ZeroBot",
          "display_name": "ZeroBot",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 78,
        "FileHash-SHA1": 78,
        "FileHash-SHA256": 2290,
        "domain": 1491,
        "hostname": 2611,
        "URL": 5879,
        "CVE": 8
      },
      "indicator_count": 12435,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "757 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "socketconnection.tk",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "socketconnection.tk",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776596809.331217
}