{ "type": "Domain", "indicator": "this.ch", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/this.ch", "alexa": "http://www.alexa.com/siteinfo/this.ch", "indicator": "this.ch", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3135679227, "indicator": "this.ch", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "661afd962ed1f89b54a92de9", "name": "Injection #1", "description": "Injection #1", "modified": "2024-04-13T21:48:06.480000", "created": "2024-04-13T21:48:06.480000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phoenix-choi1", "id": "278628", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11, "domain": 63, "hostname": 109 }, "indicator_count": 183, "is_author": false, "is_subscribing": null, "subscriber_count": 24, "modified_text": "777 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709632333f37e8de4185e9", "name": "whitelisted angular.js", "description": "", "modified": "2023-12-06T15:41:38.498000", "created": "2023-12-06T15:41:38.498000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 245, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 424, "hostname": 466, "URL": 1805 }, "indicator_count": 3193, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708eedef45abdffcb1a9ae", "name": "tracking more than space junk", "description": "", "modified": "2023-12-06T15:10:37.631000", "created": "2023-12-06T15:10:37.631000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 371, "domain": 139, "URL": 1034, "FileHash-SHA256": 113, "FileHash-MD5": 1 }, "indicator_count": 1658, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708cca842536f1582636be", "name": "apeiron.global", "description": "", "modified": "2023-12-06T15:01:30.558000", "created": "2023-12-06T15:01:30.558000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "hostname": 388, "domain": 242, "CVE": 1, "URL": 1203, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708beba2ba8bcfb1d10237", "name": "hostkey - Industroyer&ReduceRight", "description": "", "modified": "2023-12-06T14:57:47.430000", "created": "2023-12-06T14:57:47.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 304, "hostname": 563, "domain": 407, "URL": 1776, "FileHash-SHA1": 2 }, "indicator_count": 3052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04d8e7541291b89f4a1", "name": "whitelisted angular.js", "description": "", "modified": "2023-02-18T15:00:23.103000", "created": "2023-01-19T06:16:45.770000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1843, "hostname": 471, "domain": 246, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 444, "CVE": 1 }, "indicator_count": 3257, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1198 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04f8962fa3ac0c7eb77", "name": "whitelisted angular.js", "description": "", "modified": "2023-01-19T06:16:47.672000", "created": "2023-01-19T06:16:47.672000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 408, "hostname": 48, "domain": 59, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 518, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1228 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6269a10ba1925979929dc566", "name": "apeiron.global", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-27T00:00:15.468000", "created": "2022-04-27T20:01:15.714000", "tags": [ "click", "getclicktarget", "date", "contexttrack", "view", "installtrigger", "processlink", "typeof blog", "msie", "image", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "typeerror", "symbol", "error", "generator", "typeof e", "addtoany", "span", "facebook", "button", "helvetica neue", "subscribe", "email", "share", "arial", "helvetica", "light", "path", "discord", "find", "twitter", "push", "buttons", "typetext", "typeof intl", "intl", "event", "uefunction", "typeof define", "typeof module", "html tags", "ox20trnf", "dom element", "gc", "regexp", "typeof t", "class", "attr", "pseudo", "child", "function", "select", "string", "strong", "uint8array", "number", "edge", "null", "this", "iframe", "verify", "trident", "void", "next", "android", "stop", "enterprise", "form" ], "references": [ "xfe-IP-103.136.42.186-stix2-2.1-export.json", "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js", "https://static.addtoany.com/menu/page.js", "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js", "https://stats.wp.com/e-202217.js", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd", "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=", "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "domain": 242, "URL": 1203, "hostname": 388, "CVE": 1, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628e4ddc014aff9f1d08aa71", "name": "tracking more than space junk", "description": "var Cc,Dc andEc, all of whom have the same name, can now be identified by their own code, if they want to use it, as a symbol or symbol.", "modified": "2022-05-25T15:40:12.368000", "created": "2022-05-25T15:40:12.368000", "tags": [ "padre medium", "your angel", "discover", "angel", "get your", "c0c0ff", "gray", "e0e0e0", "f0f0f0", "verdana", "cccccc", "white", "ffffcc", "cc55ff", "ffffc0", "date", "error", "function", "typeof t", "array", "regexp", "twitter", "copyright", "msie", "1011", "false", "experiment", "blank", "this", "dispatcher", "button", "string", "twitter follow", "twitter tweet", "dnull", "msies", "number", "twopi", "typeof b", "pseudo", "child", "sufeffxa0", "class", "attr", "null", "void", "typeerror", "symbol", "array int8array", "argument", "rafunction", "iframe", "edge", "sxa0", "qafunction", "trident", "android" ], "references": [ "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://apis.google.com/js/plusone.js", "https://code.jquery.com/jquery-1.12.0.min.js", "https://www.heavens-above.com/scripts/standard.min.js", "https://impl.onscroll.com/vet-takeover/2017/02/1487848477922.js", "https://impl.onscroll.com/engaged-refresh/2016/12/1481103489249.js", "https://platform.twitter.com/js/button.e878ad6ba18f0bdda53d6861059b0edd.js", "https://platform.twitter.com/widgets.js", "https://tags.onscroll.com/608ff96c-526d-43c0-92d3-5faa546bc80e/tag.min.js", "https://www.heavens-above.com/css/ha.css", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5668297076217155&output=html&h=90&twa=1&slotname=5479771053&adk=1840069807&adf=1414646361&pi=t.ma~as.5479771053&w=396&fwrn=4&fwrnh=100&lmt=1653492727&format=396x90&url=https%3A%2F%2Fwww.heavens-above.com%2F&fwr=0&rh=90&rw=396&wgl=1&dt=1653492727387&bpp=10&bdt=19&idt=116&shv=r20220523&mjsv=m202205230101&ptt=5&saldr=sa&abxe=1&cookie=ID%3D3d7fd49730f9716e-226e20b4a7d200c9%3AT%3D1653492408%3ART%3D1653492408%3AS%3DALNI_MY5x7-J93w8BBEbj3tqtpARwaFfjA&gpi", "https://www.google.com/recaptcha/api2/aframe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1034, "hostname": 371, "FileHash-SHA256": 113, "domain": 139, "FileHash-MD5": 1 }, "indicator_count": 1658, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1467 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "625f05c71e903844d907b1ae", "name": "Russian Malware Strain", "description": "The full text of the new Dictionary of Human Rights, compiled by the Office of National Statistics (ONS), has been published on the internet, with the help of a few words: \"Glasgow\".", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T18:56:07.131000", "tags": [ "bapunycode", "s700", "array", "topmailru", "error", "tmrtmr", "rbclickid", "tmrdebug1", "tadaeaxbyb", "bbdaea", "cbdaea", "uadaea", "ver1", "typemini", "verb0", "youtube", "content", "smartbanner", "null", "text", "smart banner", "copyright", "android", "windows store", "title", "price", "click", "date", "twitter", "string", "regexp", "number", "typeerror", "symbol", "array int8array", "argument", "rafunction", "iframe", "please", "image", "v[1]-1:k+=", "dpjquery", "document", "function", "this", "left", "bottom", "html", "nulle", "next", "february", "april", "june", "august", "atom", "cookie", "back", "bounce", "attr", "class", "invalid json", "domparser", "edge", "sxa0", "qafunction", "trident", "ondomready", "make sure", "gc", "65535", "boolean", "counter", "segoe ui", "lucida", "ecommerce", "ext link", "comic", "form", "impact", "light", "bad idp", "cvtx", "bad event", "typeof b", "closure library", "f1518500249", "f1859775393", "body" ], "references": [ "xfe-IP-185.44.14.140-stix2-2.1-export 2.json", "xfe-URL-Xelent.ru-stix2-2.1-export.json", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_1?le=scs", "http://mc.yandex.ru/metrika/watch.js", "http://metrika.installtraffic.com/js/watch.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "http://loviotvet.ru/lib/jquery/jquery-1.7.2.min.js", "http://loviotvet.ru/lib/jquery-ui/jquery-ui-1.10.1.custom.min.js", "http://loviotvet.ru/lib/project/common.js", "http://loviotvet.ru/lib/fancybox/jquery.fancybox.pack.js", "https://apis.google.com/js/plusone.js", "http://loviotvet.ru/lib/smartbanner/jquery.smartbanner.js", "http://www.youtube.com/embed/MoDJIS6UH5U?rel=0", "https://top-fwz1.mail.ru/js/code.js", "https://bitrix.info/ba.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "V[1]-1:k+=", "display_name": "V[1]-1:k+=", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1987, "hostname": 733, "FileHash-SHA256": 294, "domain": 354 }, "indicator_count": 3368, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "625eecb6fbc4353a109fe71c", "name": "hostkey - Industroyer&ReduceRight", "description": "Fbevents-PostalCodeType:f.exports, f.1, is a new addition to the list of \"signals\" that can be added to phone numbers.", "modified": "2022-04-19T17:09:10.196000", "created": "2022-04-19T17:09:10.196000", "tags": [ "livechat", "sign up", "free", "grow", "policy", "sign", "strong", "sorry", "identify", "increase", "lzutf8", "typeerror", "uint8array", "array", "error", "typeof r", "class", "invalid", "post", "uint32array", "date", "null", "papvisitorid", "string", "regexp", "value", "property", "valuenumber", "activexobject", "postaffparams", "object", "number", "boolean", "typeof e", "math", "first", "raid", "window", "service", "ukraine", "epsilon", "arrow", "target", "keepalive", "void", "shell", "econnaborted", "hkwfunction", "typeof symbol", "function", "promise", "request", "network error", "livechatwidget", "ticket form", "prechat survey", "postchat survey", "typeof n", "chat", "blank", "win32", "iframe", "reduceright", "copyright", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "x3e div", "trackevent", "landingpagegpu", "x3e table", "gpudraw", "path", "code", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "symbol", "iterator", "extractor", "pixel", "facebook", "meta", "65535", "counter", "segoe ui", "lucida", "ecommerce", "ext link", "comic", "form", "impact", "light" ], "references": [ "https://mc.yandex.ru/metrika/watch.js", "https://connect.facebook.net/signals/config/785878845108827", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H", "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1", "https://cdn.livechatinc.com/tracking.js", "https://rec.smartlook.com/main-20220331074633.js", "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js", "https://hostkey.com/hk/widgets/ext/src/hostkey.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8", "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=", "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light", "https://secure.livechatinc.com/" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null }, { "id": "Industroyer - S0604", "display_name": "Industroyer - S0604", "target": null } ], "attack_ids": [ { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1125", "name": "Video Capture", "display_name": "T1125 - Video Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1778, "hostname": 563, "FileHash-SHA256": 304, "domain": 407, "FileHash-SHA1": 2 }, "indicator_count": 3054, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1502 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js", "http://metrika.installtraffic.com/js/watch.js", "xfe-IP-103.136.42.186-stix2-2.1-export.json", "https://rec.smartlook.com/main-20220331074633.js", "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1", "https://code.jquery.com/jquery-1.12.0.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js", "https://impl.onscroll.com/vet-takeover/2017/02/1487848477922.js", "https://mc.yandex.ru/metrika/watch.js", "http://loviotvet.ru/lib/project/common.js", "https://bitrix.info/ba.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json", "http://mc.yandex.ru/metrika/watch.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8", "http://www.youtube.com/embed/MoDJIS6UH5U?rel=0", "xfe-URL-Xelent.ru-stix2-2.1-export.json", "https://secure.livechatinc.com/", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_1?le=scs", "https://hostkey.com/hk/widgets/ext/src/hostkey.js", "http://loviotvet.ru/lib/fancybox/jquery.fancybox.pack.js", "https://static.addtoany.com/menu/page.js", "http://loviotvet.ru/lib/jquery-ui/jquery-ui-1.10.1.custom.min.js", "http://loviotvet.ru/lib/smartbanner/jquery.smartbanner.js", "https://impl.onscroll.com/engaged-refresh/2016/12/1481103489249.js", "http://loviotvet.ru/lib/jquery/jquery-1.7.2.min.js", "https://www.heavens-above.com/css/ha.css", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd", "https://platform.twitter.com/js/button.e878ad6ba18f0bdda53d6861059b0edd.js", "https://connect.facebook.net/signals/config/785878845108827", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js", "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js", "bienvenidosnewyork.com/app.php", "https://cdn.livechatinc.com/tracking.js", "https://www.google.com/recaptcha/api2/aframe", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5668297076217155&output=html&h=90&twa=1&slotname=5479771053&adk=1840069807&adf=1414646361&pi=t.ma~as.5479771053&w=396&fwrn=4&fwrnh=100&lmt=1653492727&format=396x90&url=https%3A%2F%2Fwww.heavens-above.com%2F&fwr=0&rh=90&rw=396&wgl=1&dt=1653492727387&bpp=10&bdt=19&idt=116&shv=r20220523&mjsv=m202205230101&ptt=5&saldr=sa&abxe=1&cookie=ID%3D3d7fd49730f9716e-226e20b4a7d200c9%3AT%3D1653492408%3ART%3D1653492408%3AS%3DALNI_MY5x7-J93w8BBEbj3tqtpARwaFfjA&gpi", "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light", "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js", "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H", "https://stats.wp.com/e-202217.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js", "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "https://platform.twitter.com/widgets.js", "xfe-IP-185.44.14.140-stix2-2.1-export 2.json", "https://top-fwz1.mail.ru/js/code.js", "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=", "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=", "https://www.heavens-above.com/scripts/standard.min.js", "https://apis.google.com/js/plusone.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://tags.onscroll.com/608ff96c-526d-43c0-92d3-5faa546bc80e/tag.min.js" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Industroyer - s0604", "Reduceright", "V[1]-1:k+=", "Gc" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "661afd962ed1f89b54a92de9", "name": "Injection #1", "description": "Injection #1", "modified": "2024-04-13T21:48:06.480000", "created": "2024-04-13T21:48:06.480000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phoenix-choi1", "id": "278628", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11, "domain": 63, "hostname": 109 }, "indicator_count": 183, "is_author": false, "is_subscribing": null, "subscriber_count": 24, "modified_text": "777 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709632333f37e8de4185e9", "name": "whitelisted angular.js", "description": "", "modified": "2023-12-06T15:41:38.498000", "created": "2023-12-06T15:41:38.498000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 245, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 424, "hostname": 466, "URL": 1805 }, "indicator_count": 3193, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708eedef45abdffcb1a9ae", "name": "tracking more than space junk", "description": "", "modified": "2023-12-06T15:10:37.631000", "created": "2023-12-06T15:10:37.631000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 371, "domain": 139, "URL": 1034, "FileHash-SHA256": 113, "FileHash-MD5": 1 }, "indicator_count": 1658, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708cca842536f1582636be", "name": "apeiron.global", "description": "", "modified": "2023-12-06T15:01:30.558000", "created": "2023-12-06T15:01:30.558000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "hostname": 388, "domain": 242, "CVE": 1, "URL": 1203, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708beba2ba8bcfb1d10237", "name": "hostkey - Industroyer&ReduceRight", "description": "", "modified": "2023-12-06T14:57:47.430000", "created": "2023-12-06T14:57:47.430000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 304, "hostname": 563, "domain": 407, "URL": 1776, "FileHash-SHA1": 2 }, "indicator_count": 3052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04d8e7541291b89f4a1", "name": "whitelisted angular.js", "description": "", "modified": "2023-02-18T15:00:23.103000", "created": "2023-01-19T06:16:45.770000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1843, "hostname": 471, "domain": 246, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 444, "CVE": 1 }, "indicator_count": 3257, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1198 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04f8962fa3ac0c7eb77", "name": "whitelisted angular.js", "description": "", "modified": "2023-01-19T06:16:47.672000", "created": "2023-01-19T06:16:47.672000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 408, "hostname": 48, "domain": 59, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 518, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1228 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6269a10ba1925979929dc566", "name": "apeiron.global", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-27T00:00:15.468000", "created": "2022-04-27T20:01:15.714000", "tags": [ "click", "getclicktarget", "date", "contexttrack", "view", "installtrigger", "processlink", "typeof blog", "msie", "image", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "typeerror", "symbol", "error", "generator", "typeof e", "addtoany", "span", "facebook", "button", "helvetica neue", "subscribe", "email", "share", "arial", "helvetica", "light", "path", "discord", "find", "twitter", "push", "buttons", "typetext", "typeof intl", "intl", "event", "uefunction", "typeof define", "typeof module", "html tags", "ox20trnf", "dom element", "gc", "regexp", "typeof t", "class", "attr", "pseudo", "child", "function", "select", "string", "strong", "uint8array", "number", "edge", "null", "this", "iframe", "verify", "trident", "void", "next", "android", "stop", "enterprise", "form" ], "references": [ "xfe-IP-103.136.42.186-stix2-2.1-export.json", "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js", "https://static.addtoany.com/menu/page.js", "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js", "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js", "https://stats.wp.com/e-202217.js", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd", "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=", "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "GC", "display_name": "GC", "target": null } ], "attack_ids": [ { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 498, "domain": 242, "URL": 1203, "hostname": 388, "CVE": 1, "FileHash-MD5": 1 }, "indicator_count": 2333, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1465 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628e4ddc014aff9f1d08aa71", "name": "tracking more than space junk", "description": "var Cc,Dc andEc, all of whom have the same name, can now be identified by their own code, if they want to use it, as a symbol or symbol.", "modified": "2022-05-25T15:40:12.368000", "created": "2022-05-25T15:40:12.368000", "tags": [ "padre medium", "your angel", "discover", "angel", "get your", "c0c0ff", "gray", "e0e0e0", "f0f0f0", "verdana", "cccccc", "white", "ffffcc", "cc55ff", "ffffc0", "date", "error", "function", "typeof t", "array", "regexp", "twitter", "copyright", "msie", "1011", "false", "experiment", "blank", "this", "dispatcher", "button", "string", "twitter follow", "twitter tweet", "dnull", "msies", "number", "twopi", "typeof b", "pseudo", "child", "sufeffxa0", "class", "attr", "null", "void", "typeerror", "symbol", "array int8array", "argument", "rafunction", "iframe", "edge", "sxa0", "qafunction", "trident", "android" ], "references": [ "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "https://apis.google.com/js/plusone.js", "https://code.jquery.com/jquery-1.12.0.min.js", "https://www.heavens-above.com/scripts/standard.min.js", "https://impl.onscroll.com/vet-takeover/2017/02/1487848477922.js", "https://impl.onscroll.com/engaged-refresh/2016/12/1481103489249.js", "https://platform.twitter.com/js/button.e878ad6ba18f0bdda53d6861059b0edd.js", "https://platform.twitter.com/widgets.js", "https://tags.onscroll.com/608ff96c-526d-43c0-92d3-5faa546bc80e/tag.min.js", "https://www.heavens-above.com/css/ha.css", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-5668297076217155&output=html&h=90&twa=1&slotname=5479771053&adk=1840069807&adf=1414646361&pi=t.ma~as.5479771053&w=396&fwrn=4&fwrnh=100&lmt=1653492727&format=396x90&url=https%3A%2F%2Fwww.heavens-above.com%2F&fwr=0&rh=90&rw=396&wgl=1&dt=1653492727387&bpp=10&bdt=19&idt=116&shv=r20220523&mjsv=m202205230101&ptt=5&saldr=sa&abxe=1&cookie=ID%3D3d7fd49730f9716e-226e20b4a7d200c9%3AT%3D1653492408%3ART%3D1653492408%3AS%3DALNI_MY5x7-J93w8BBEbj3tqtpARwaFfjA&gpi", "https://www.google.com/recaptcha/api2/aframe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1034, "hostname": 371, "FileHash-SHA256": 113, "domain": 139, "FileHash-MD5": 1 }, "indicator_count": 1658, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1467 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "625f05c71e903844d907b1ae", "name": "Russian Malware Strain", "description": "The full text of the new Dictionary of Human Rights, compiled by the Office of National Statistics (ONS), has been published on the internet, with the help of a few words: \"Glasgow\".", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T18:56:07.131000", "tags": [ "bapunycode", "s700", "array", "topmailru", "error", "tmrtmr", "rbclickid", "tmrdebug1", "tadaeaxbyb", "bbdaea", "cbdaea", "uadaea", "ver1", "typemini", "verb0", "youtube", "content", "smartbanner", "null", "text", "smart banner", "copyright", "android", "windows store", "title", "price", "click", "date", "twitter", "string", "regexp", "number", "typeerror", "symbol", "array int8array", "argument", "rafunction", "iframe", "please", "image", "v[1]-1:k+=", "dpjquery", "document", "function", "this", "left", "bottom", "html", "nulle", "next", "february", "april", "june", "august", "atom", "cookie", "back", "bounce", "attr", "class", "invalid json", "domparser", "edge", "sxa0", "qafunction", "trident", "ondomready", "make sure", "gc", "65535", "boolean", "counter", "segoe ui", "lucida", "ecommerce", "ext link", "comic", "form", "impact", "light", "bad idp", "cvtx", "bad event", "typeof b", "closure library", "f1518500249", "f1859775393", "body" ], "references": [ "xfe-IP-185.44.14.140-stix2-2.1-export 2.json", "xfe-URL-Xelent.ru-stix2-2.1-export.json", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_1?le=scs", "http://mc.yandex.ru/metrika/watch.js", "http://metrika.installtraffic.com/js/watch.js", "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=plusone/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs", "http://loviotvet.ru/lib/jquery/jquery-1.7.2.min.js", "http://loviotvet.ru/lib/jquery-ui/jquery-ui-1.10.1.custom.min.js", "http://loviotvet.ru/lib/project/common.js", "http://loviotvet.ru/lib/fancybox/jquery.fancybox.pack.js", "https://apis.google.com/js/plusone.js", "http://loviotvet.ru/lib/smartbanner/jquery.smartbanner.js", "http://www.youtube.com/embed/MoDJIS6UH5U?rel=0", "https://top-fwz1.mail.ru/js/code.js", "https://bitrix.info/ba.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "V[1]-1:k+=", "display_name": "V[1]-1:k+=", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1987, "hostname": 733, "FileHash-SHA256": 294, "domain": 354 }, "indicator_count": 3368, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "this.ch", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "this.ch", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780247284.8392882 }