{
  "type": "Domain",
  "indicator": "soubtcevent.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/soubtcevent.com",
    "alexa": "http://www.alexa.com/siteinfo/soubtcevent.com",
    "indicator": "soubtcevent.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4054830073,
      "indicator": "soubtcevent.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "67ef854620c41c3fd65378db",
          "name": "Proactive ClickFix Threat Hunting with Hunt.io",
          "description": "ClickFix is a browser-based delivery technique that uses deceptive prompts and clipboard hijacking to trick users into executing malicious commands. Cybercriminals and advanced actors employ this method to deploy malware, primarily information stealers. The technique involves luring users with fake system alerts or CAPTCHA challenges, then silently staging payloads for execution. The article describes how Hunt.io's research team used custom queries to identify web infrastructure associated with ClickFix delivery, uncovering multiple live domains serving malicious content. Examples include a Bitcoin-themed domain posing as Cloudflare WAF to deliver Lumma and CryptBot malware, a page targeting Zoho Office Suite credentials, and a compromised website abusing PowerShell. The report emphasizes the growing traction of ClickFix as a low-friction method for malware delivery and credential harvesting.",
          "modified": "2025-05-04T07:02:31.627000",
          "created": "2025-04-04T07:07:50.749000",
          "tags": [
            "powershell",
            "threat hunting",
            "lumma stealer",
            "malware delivery",
            "clipboard hijacking",
            "information stealers",
            "credential theft",
            "clickfix",
            "captcha",
            "browser-based attacks",
            "cryptbot"
          ],
          "references": [
            "https://hunt.io/blog/clickfix-pages-proactive-threat-hunting"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "CryptBot",
              "display_name": "CryptBot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1059.001",
              "name": "PowerShell",
              "display_name": "T1059.001 - PowerShell"
            },
            {
              "id": "T1102.003",
              "name": "One-Way Communication",
              "display_name": "T1102.003 - One-Way Communication"
            },
            {
              "id": "T1547.001",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1078",
              "name": "Valid Accounts",
              "display_name": "T1078 - Valid Accounts"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1574.002",
              "name": "DLL Side-Loading",
              "display_name": "T1574.002 - DLL Side-Loading"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 44,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 8,
            "URL": 4,
            "domain": 15
          },
          "indicator_count": 31,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386988,
          "modified_text": "394 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "690849bd041ea4f9df398443",
          "name": "Threat Intel Report-W44-2025",
          "description": "These are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in the week.",
          "modified": "2025-12-03T06:04:08.165000",
          "created": "2025-11-03T06:20:45.583000",
          "tags": [
            "mozi",
            "clearfake",
            "urls http",
            "hashes",
            "domains",
            "sha values",
            "file name",
            "submit date",
            "dateadded",
            "malware url"
          ],
          "references": [
            "https://urlhaus.abuse.ch/",
            "https://any.run/malware-trends/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "aa00643640@techmahindra.com",
            "id": "156540",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 97,
            "URL": 242,
            "FileHash-MD5": 58,
            "FileHash-SHA1": 58,
            "FileHash-SHA256": 121,
            "domain": 68
          },
          "indicator_count": 644,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 108,
          "modified_text": "181 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "684fc47ed8d0355056b6ea50",
          "name": "Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi",
          "description": "A recent insider threat was identified when a vendor left a rogue Raspberry Pi device on a customer's Industrial Control Systems (ICS) network, highlighting supply chain vulnerabilities. Historical incidents, including the 2014 Havex attack and the 2018 semiconductor breach, exemplify the risks associated with compromised software within ICS environments. Darktrace's analysis pointed out unusual metadata linked to the device's encrypted connections, indicating potential risks despite lacking overt malicious signs. Additionally, advanced techniques like ClickFix baiting have been employed by threat actors such as APT28 and MuddyWater, utilizing social engineering to execute malicious commands and allowing for lateral movement within networks, thereby increasing the potential for sensitive data exfiltration.",
          "modified": "2025-07-16T07:03:03.939000",
          "created": "2025-06-16T07:15:10.722000",
          "tags": [],
          "references": [
            "https://www.darktrace.com/blog/proactive-ot-security-lessons-on-supply-chain-risk-management-from-a-rogue-raspberry-pi"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 8,
            "domain": 53,
            "hostname": 13,
            "URL": 33
          },
          "indicator_count": 108,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 546,
          "modified_text": "321 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://any.run/malware-trends/",
        "https://hunt.io/blog/clickfix-pages-proactive-threat-hunting",
        "https://www.darktrace.com/blog/proactive-ot-security-lessons-on-supply-chain-risk-management-from-a-rogue-raspberry-pi",
        "https://urlhaus.abuse.ch/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [
            "Cryptbot",
            "Lumma stealer"
          ],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "67ef854620c41c3fd65378db",
      "name": "Proactive ClickFix Threat Hunting with Hunt.io",
      "description": "ClickFix is a browser-based delivery technique that uses deceptive prompts and clipboard hijacking to trick users into executing malicious commands. Cybercriminals and advanced actors employ this method to deploy malware, primarily information stealers. The technique involves luring users with fake system alerts or CAPTCHA challenges, then silently staging payloads for execution. The article describes how Hunt.io's research team used custom queries to identify web infrastructure associated with ClickFix delivery, uncovering multiple live domains serving malicious content. Examples include a Bitcoin-themed domain posing as Cloudflare WAF to deliver Lumma and CryptBot malware, a page targeting Zoho Office Suite credentials, and a compromised website abusing PowerShell. The report emphasizes the growing traction of ClickFix as a low-friction method for malware delivery and credential harvesting.",
      "modified": "2025-05-04T07:02:31.627000",
      "created": "2025-04-04T07:07:50.749000",
      "tags": [
        "powershell",
        "threat hunting",
        "lumma stealer",
        "malware delivery",
        "clipboard hijacking",
        "information stealers",
        "credential theft",
        "clickfix",
        "captcha",
        "browser-based attacks",
        "cryptbot"
      ],
      "references": [
        "https://hunt.io/blog/clickfix-pages-proactive-threat-hunting"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "CryptBot",
          "display_name": "CryptBot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1059.001",
          "name": "PowerShell",
          "display_name": "T1059.001 - PowerShell"
        },
        {
          "id": "T1102.003",
          "name": "One-Way Communication",
          "display_name": "T1102.003 - One-Way Communication"
        },
        {
          "id": "T1547.001",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1547.001 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1001",
          "name": "Data Obfuscation",
          "display_name": "T1001 - Data Obfuscation"
        },
        {
          "id": "T1078",
          "name": "Valid Accounts",
          "display_name": "T1078 - Valid Accounts"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1574.002",
          "name": "DLL Side-Loading",
          "display_name": "T1574.002 - DLL Side-Loading"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 44,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 8,
        "URL": 4,
        "domain": 15
      },
      "indicator_count": 31,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386988,
      "modified_text": "394 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "690849bd041ea4f9df398443",
      "name": "Threat Intel Report-W44-2025",
      "description": "These are weekly base recommendations to all IT Administrators and CISOs to take corrective actions to upgrade their security infrastructure against newly identified threats and attacks in the week.",
      "modified": "2025-12-03T06:04:08.165000",
      "created": "2025-11-03T06:20:45.583000",
      "tags": [
        "mozi",
        "clearfake",
        "urls http",
        "hashes",
        "domains",
        "sha values",
        "file name",
        "submit date",
        "dateadded",
        "malware url"
      ],
      "references": [
        "https://urlhaus.abuse.ch/",
        "https://any.run/malware-trends/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "aa00643640@techmahindra.com",
        "id": "156540",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 97,
        "URL": 242,
        "FileHash-MD5": 58,
        "FileHash-SHA1": 58,
        "FileHash-SHA256": 121,
        "domain": 68
      },
      "indicator_count": 644,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 108,
      "modified_text": "181 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "684fc47ed8d0355056b6ea50",
      "name": "Proactive OT security: Lessons on supply chain risk management from a rogue Raspberry Pi",
      "description": "A recent insider threat was identified when a vendor left a rogue Raspberry Pi device on a customer's Industrial Control Systems (ICS) network, highlighting supply chain vulnerabilities. Historical incidents, including the 2014 Havex attack and the 2018 semiconductor breach, exemplify the risks associated with compromised software within ICS environments. Darktrace's analysis pointed out unusual metadata linked to the device's encrypted connections, indicating potential risks despite lacking overt malicious signs. Additionally, advanced techniques like ClickFix baiting have been employed by threat actors such as APT28 and MuddyWater, utilizing social engineering to execute malicious commands and allowing for lateral movement within networks, thereby increasing the potential for sensitive data exfiltration.",
      "modified": "2025-07-16T07:03:03.939000",
      "created": "2025-06-16T07:15:10.722000",
      "tags": [],
      "references": [
        "https://www.darktrace.com/blog/proactive-ot-security-lessons-on-supply-chain-risk-management-from-a-rogue-raspberry-pi"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 8,
        "domain": 53,
        "hostname": 13,
        "URL": 33
      },
      "indicator_count": 108,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 546,
      "modified_text": "321 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "soubtcevent.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "soubtcevent.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780454419.2469702
}