{ "type": "Domain", "indicator": "telegramzn.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/telegramzn.com", "alexa": "http://www.alexa.com/siteinfo/telegramzn.com", "indicator": "telegramzn.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3645879525, "indicator": "telegramzn.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 29, "pulses": [ { "id": "69b033361d3ddd1e04393321", "name": "Phishing | Mar 11, 2026 | Part 363/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 363/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:05:26.988000", "created": "2026-03-10T15:05:26.988000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1510, "hostname": 490 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedf6ffede60c3913836d5", "name": "Phishing | Mar 10, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:55:43.321000", "created": "2026-03-09T14:55:43.321000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 418, "domain": 1582 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8c33d5b787649230b8df", "name": "Phishing | Mar 9, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:48:19.823000", "created": "2026-03-08T14:48:19.823000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3b4d3a863cfa6e888bee", "name": "Phishing | Mar 8, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:50:53.176000", "created": "2026-03-07T14:50:53.176000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae97399167b0f35fa955f", "name": "Phishing | Mar 7, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:49:23.888000", "created": "2026-03-06T14:49:23.888000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99d5402751e7dda6d5579", "name": "Phishing | Mar 6, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:12:20.218000", "created": "2026-03-05T15:12:20.218000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a84697d2da129f391f8c9b", "name": "Phishing | Mar 5, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:49:59.139000", "created": "2026-03-04T14:49:59.139000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f3daeb2a2a159f8494ad", "name": "Phishing | Mar 4, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:44:42.982000", "created": "2026-03-03T14:44:42.982000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b9b3e0c640651e38f57e", "name": "Phishing | Mar 3, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:24:19.532000", "created": "2026-03-02T16:24:19.532000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a517f54d9330347eb9c260", "name": "Phishing | Mar 2, 2026 | Part 316/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 316/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:54:13.516000", "created": "2026-03-02T04:54:13.516000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a444935aad2ac2d109834f", "name": "Phishing | Mar 2, 2026 | Part 319/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 319/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:52:19.319000", "created": "2026-03-01T13:52:19.319000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1439, "hostname": 561 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a40a37802fea066072e394", "name": "Phishing | Mar 1, 2026 | Part 319/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 319/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:43:19.538000", "created": "2026-03-01T09:43:19.538000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1439, "hostname": 561 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "93 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a388c406cd376266cc3e23", "name": "Phishing | Mar 1, 2026 | Part 320/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 320/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:31:00.742000", "created": "2026-03-01T00:31:00.742000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 510, "domain": 1490 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "93 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997ff64fc36298931c777cb", "name": "Phishing | Feb 20, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:29:56.204000", "created": "2026-02-20T06:29:56.204000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69976d47b015f53ce2330139", "name": "Phishing | Feb 20, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T20:06:31.277000", "created": "2026-02-19T20:06:31.277000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69972e30b59557899c6cd88c", "name": "Phishing | Feb 20, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:37:20.639000", "created": "2026-02-19T15:37:20.639000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69970ee43ee6fb2b8ec900c1", "name": "Phishing | Feb 19, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T13:23:48.291000", "created": "2026-02-19T13:23:48.291000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699638b362fdce2f5eea51f2", "name": "Phishing | Feb 19, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T22:09:55.262000", "created": "2026-02-18T22:09:55.262000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69957958f740ff796d1174e8", "name": "Phishing | Feb 18, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:33:28.008000", "created": "2026-02-18T08:33:28.008000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69949de5c9a13c7aba24129b", "name": "Phishing | Feb 18, 2026 | Part 322/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 322/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T16:57:09.008000", "created": "2026-02-17T16:57:09.008000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1471, "hostname": 529 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69929bf0bb6b229d4be57f32", "name": "Phishing | Feb 16, 2026 | Part 327/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 327/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:24:16.584000", "created": "2026-02-16T04:24:16.584000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1580, "hostname": 420 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "106 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69915cc6860d3093ebc99507", "name": "Phishing | Feb 15, 2026 | Part 334/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 334/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:42:30.888000", "created": "2026-02-15T05:42:30.888000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1634, "hostname": 366 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "107 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908e42c5f8aa65d84aa7c7", "name": "Phishing | Feb 15, 2026 | Part 337/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 337/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T15:01:22.775000", "created": "2026-02-14T15:01:22.775000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1362, "hostname": 638 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "107 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c60d1999e4be660d7b204", "name": "Phishing | Feb 11, 2026 | Part 364/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 364/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T10:58:25.102000", "created": "2026-02-11T10:58:25.102000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 355, "domain": 1645 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "111 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981ab410e8472046210a114", "name": "Phishing | 2026-01-31 | Part 88/163", "description": "Phishing indicators. Date: 2026-01-31. Part 88/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T08:01:05.213000", "created": "2026-02-03T08:01:05.213000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4162, "domain": 5838 }, "indicator_count": 10000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "119 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "641873cbce4d591fcb93341c", "name": "Not so private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets | WeLiveSecurity", "description": "ESET Research has found the first instance of malware built into Android and Windows versions of WhatsApp and Telegram instant messaging apps, which are targeting victims\u2019 cryptocurrency wallet addresses and other online accounts, the company has announced.", "modified": "2023-04-19T14:04:39.791000", "created": "2023-03-20T14:55:07.019000", "tags": [ "android", "gh0st", "cuo gh0st", "windows", "bur gh0st", "dbp", "fzhx", "aewm", "blh gh0st", "telegram", "whatsapp", "cluster", "c server", "figure", "windows cluster", "rats", "telegram app", "clipper", "gh0st rat", "alliance", "bitcoin", "bank", "tron", "execution", "capture", "love" ], "references": [ "https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/" ], "public": 1, "adversary": "", "targeted_countries": [ "China" ], "malware_families": [ { "id": "BLH Gh0st", "display_name": "BLH Gh0st", "target": null }, { "id": "AEWM", "display_name": "AEWM", "target": null }, { "id": "FZHX", "display_name": "FZHX", "target": null }, { "id": "DBP", "display_name": "DBP", "target": null }, { "id": "BUR Gh0st", "display_name": "BUR Gh0st", "target": null }, { "id": "Windows", "display_name": "Windows", "target": null }, { "id": "CUO Gh0st", "display_name": "CUO Gh0st", "target": null }, { "id": "Gh0st", "display_name": "Gh0st", "target": null }, { "id": "Android", "display_name": "Android", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1418", "name": "Application Discovery", "display_name": "T1418 - Application Discovery" }, { "id": "T1437", "name": "Standard Application Layer Protocol", "display_name": "T1437 - Standard Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1565", "name": "Data Manipulation", "display_name": "T1565 - Data Manipulation" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunter_NL", "id": "171283", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 10, "FileHash-MD5": 3, "FileHash-SHA1": 37, "FileHash-SHA256": 3, "domain": 16, "hostname": 6 }, "indicator_count": 75, "is_author": false, "is_subscribing": null, "subscriber_count": 862, "modified_text": "1139 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64168303fa6a71cc48993031", "name": "Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets", "description": "The Clipper malware was discovered with copycat websites for instant messaging apps. Telegram and WhatsApp are being targeted to distribute trojanized versions and mainly infect Android and Windows users by monitor and intercepting the victim's messaging communications for certain keywords related to cryptocurrencies in either Android or Windows OS.", "modified": "2023-04-18T03:05:04.324000", "created": "2023-03-19T03:35:31.234000", "tags": [ "android", "gh0st", "cuo gh0st", "windows", "bur gh0st", "dbp", "blh gh0st", "telegram", "whatsapp", "cluster", "c server", "windows cluster", "rats", "telegram app", "clipper", "gh0st rat", "alliance", "bitcoin", "tron", "execution", "capture" ], "references": [ "https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "BUR Gh0st", "display_name": "BUR Gh0st", "target": null }, { "id": "Windows", "display_name": "Windows", "target": null }, { "id": "CUO Gh0st", "display_name": "CUO Gh0st", "target": null }, { "id": "Gh0st", "display_name": "Gh0st", "target": null }, { "id": "Android", "display_name": "Android", "target": null }, { "id": "Clipper", "display_name": "Clipper", "target": null } ], "attack_ids": [ { "id": "T1496", "name": "Resource Hijacking", "display_name": "T1496 - Resource Hijacking" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1115", "name": "Clipboard Data", "display_name": "T1115 - Clipboard Data" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1409", "name": "Access Stored Application Data", "display_name": "T1409 - Access Stored Application Data" }, { "id": "T1418", "name": "Application Discovery", "display_name": "T1418 - Application Discovery" }, { "id": "T1437", "name": "Standard Application Layer Protocol", "display_name": "T1437 - Standard Application Layer Protocol" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1529", "name": "System Shutdown/Reboot", "display_name": "T1529 - System Shutdown/Reboot" }, { "id": "T1531", "name": "Account Access Removal", "display_name": "T1531 - Account Access Removal" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1565", "name": "Data Manipulation", "display_name": "T1565 - Data Manipulation" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Superpro", "id": "61676", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "BitcoinAddress": 10, "FileHash-MD5": 3, "FileHash-SHA1": 37, "FileHash-SHA256": 3, "domain": 16, "hostname": 6 }, "indicator_count": 75, "is_author": false, "is_subscribing": null, "subscriber_count": 213, "modified_text": "1141 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64154c99e771c36bc943e4c0", "name": "Fake Telegram and WhatsApp Websites Distributing Cryptocurrency Clipper Malware", "description": "", "modified": "2023-04-17T05:01:26.060000", "created": "2023-03-18T05:31:05.245000", "tags": [], "references": [ "March 18th, 2023 - CryptoGen Cyber Threat Intelligence - Fake Telegram and WhatsApp Websites Distributing Cryptocurrency Clipper Malware.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 37, "FileHash-SHA256": 3, "domain": 16, "hostname": 7 }, "indicator_count": 66, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "1142 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6414cb3be29758714b707730", "name": "Not\u2011so\u2011private messaging: Trojanized WhatsApp and Telegram apps go after cryptocurrency wallets", "description": "https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/?web_view=true", "modified": "2023-04-16T20:00:45.062000", "created": "2023-03-17T20:19:07.249000", "tags": [ "gh0st", "gld", "fzhx", "aewm", "windows cluster", "telegram", "cluster", "c server", "android", "whatsapp", "rat variant", "distribution", "c website", "archive", "first" ], "references": [ "IoCs.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "AEWM", "display_name": "AEWM", "target": null }, { "id": "FZHX", "display_name": "FZHX", "target": null }, { "id": "GLD", "display_name": "GLD", "target": null }, { "id": "Gh0st", "display_name": "Gh0st", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Cyber74Team", "id": "202637", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_202637/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 3, "FileHash-SHA1": 37, "FileHash-SHA256": 3, "domain": 16, "hostname": 7 }, "indicator_count": 66, "is_author": false, "is_subscribing": null, "subscriber_count": 165, "modified_text": "1142 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "March 18th, 2023 - CryptoGen Cyber Threat Intelligence - Fake Telegram and WhatsApp Websites Distributing Cryptocurrency Clipper Malware.pdf", "https://www.welivesecurity.com/2023/03/16/not-so-private-messaging-trojanized-whatsapp-telegram-cryptocurrency-wallets/", "https://ltna.com.au/cyber", "IoCs.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Clipper", "Dbp", "Fzhx", "Windows", "Bur gh0st", "Android", "Gld", "Gh0st", "Aewm", "Cuo gh0st", "Blh gh0st" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 29, "pulses": [ { "id": "69b033361d3ddd1e04393321", "name": "Phishing | Mar 11, 2026 | Part 363/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 363/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:05:26.988000", "created": "2026-03-10T15:05:26.988000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1510, "hostname": 490 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedf6ffede60c3913836d5", "name": "Phishing | Mar 10, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:55:43.321000", "created": "2026-03-09T14:55:43.321000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 418, "domain": 1582 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8c33d5b787649230b8df", "name": "Phishing | Mar 9, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:48:19.823000", "created": "2026-03-08T14:48:19.823000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3b4d3a863cfa6e888bee", "name": "Phishing | Mar 8, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:50:53.176000", "created": "2026-03-07T14:50:53.176000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae97399167b0f35fa955f", "name": "Phishing | Mar 7, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:49:23.888000", "created": "2026-03-06T14:49:23.888000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99d5402751e7dda6d5579", "name": "Phishing | Mar 6, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:12:20.218000", "created": "2026-03-05T15:12:20.218000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 96, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a84697d2da129f391f8c9b", "name": "Phishing | Mar 5, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:49:59.139000", "created": "2026-03-04T14:49:59.139000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f3daeb2a2a159f8494ad", "name": "Phishing | Mar 4, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:44:42.982000", "created": "2026-03-03T14:44:42.982000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b9b3e0c640651e38f57e", "name": "Phishing | Mar 3, 2026 | Part 314/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 314/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:24:19.532000", "created": "2026-03-02T16:24:19.532000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a517f54d9330347eb9c260", "name": "Phishing | Mar 2, 2026 | Part 316/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 316/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:54:13.516000", "created": "2026-03-02T04:54:13.516000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1410, "hostname": 590 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 97, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "telegramzn.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "telegramzn.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780398496.827276 }