{ "type": "Domain", "indicator": "this.jp", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/this.jp", "alexa": "http://www.alexa.com/siteinfo/this.jp", "indicator": "this.jp", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2921415521, "indicator": "this.jp", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "661afd962ed1f89b54a92de9", "name": "Injection #1", "description": "Injection #1", "modified": "2024-04-13T21:48:06.480000", "created": "2024-04-13T21:48:06.480000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phoenix-choi1", "id": "278628", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11, "domain": 63, "hostname": 109 }, "indicator_count": 183, "is_author": false, "is_subscribing": null, "subscriber_count": 24, "modified_text": "780 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708ed8f7d4b5483117bb66", "name": "abuse.ch", "description": "", "modified": "2023-12-06T15:10:16.397000", "created": "2023-12-06T15:10:16.397000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 223, "domain": 383, "URL": 1639, "hostname": 560, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707fe17dfdfe16066d16de", "name": "Bexar.org", "description": "", "modified": "2023-12-06T14:06:25.800000", "created": "2023-12-06T14:06:25.800000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1735, "hostname": 1833, "domain": 1025, "URL": 4668, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9409, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "630aa58da975d104891c6565", "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams", "description": "", "modified": "2022-08-27T23:15:25.718000", "created": "2022-08-27T23:15:25.718000", "tags": [ "hammer", "gc", "vob", "tvb", "service", "date", "check favorite", "dare", "continuecta", "vote", "goprivate", "buycredits", "ff8d00", "favorite", "error", "null", "nonce", "enterprise", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "eenterprise", "object", "customevent", "ethis", "layouttest", "faceliftlayout", "stubbutton", "similarmodels", "purchasepagev3", "langtag", "newbannerchat", "image", "typeof atrkopts", "dailagill", "strong", "streams", "your", "source of", "pleasure", "live sex", "normal", "cosplay", "fingering", "chat", "deepthroat", "close", "live", "free cams", "sex chat", "live porn", "sex cam", "livesex", "webcamsex", "adult cams", "free live sex chat", "webcam sex", "chat online", "free adults hd", "mins", "xxx cams", "xxx porn", "free live cam", "adult sex", "material", "majority", "here looking", "for child", "pornography", "move on", "on this", "website", "we will", "turn over", "free porn webcams", "live webcam", "online sex cam", "xxx girls", "live sex chat", "teen sexchat", "amateur video", "web cam", "sexcams", "shows", "porn chat", "bongacams", "function", "i2c1", "xeir", "cef4", "m4sr", "e4c4", "math", "ttmt", "y4giwe", "h5gg", "window", "css1062", "segoe ui", "emoji", "href", "roboto", "helvetica neue", "arial", "apple color", "symbol", "typecheckbox", "twitter", "web design", "iran", "author url", "github", "regexp", "pseudo", "child", "typeof n", "typeof t", "class", "attr", "typeof module", "this" ], "references": [ "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json", "https://payvtylhwjxnr.xyz/Content/script?v=2", "https://payvtylhwjxnr.xyz/Content/css/banks.css", "https://payvtylhwjxnr.xyz/Content/style?v=1", "xfe-IP-104.21.72.150-stix2-2.1-export.json", "xfe-IP-172.67.151.101-stix2-2.1-export.json", "https://static.selfpuc.com/mnpw3.js", "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full", "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on", "https://bongacams.com/GianaWatson", "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools", "https://d31qbv1cthcecs.cloudfront.net/atrk.js", "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js", "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB", "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js" ], "public": 1, "adversary": "", "targeted_countries": [ "New Caledonia", "New Zealand" ], "malware_families": [ { "id": "Hammer", "display_name": "Hammer", "target": null }, { "id": "Tvb", "display_name": "Tvb", "target": null }, { "id": "Vob", "display_name": "Vob", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "62509a05316b00bcca30c693", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Hardtogiveafuck", "id": "205637", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 425, "domain": 459, "URL": 1412, "FileHash-SHA256": 125 }, "indicator_count": 2421, "is_author": false, "is_subscribing": null, "subscriber_count": 7, "modified_text": "1375 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628d21a4558f3ccf49c07931", "name": "abuse.ch", "description": "Looking for wizard spider. Some domains have .ru and .su (Soviet Union)", "modified": "2022-05-24T18:19:16.027000", "created": "2022-05-24T18:19:16.027000", "tags": [ "twitter follow", "button follow", "reduceright", "number", "string", "regexp", "error", "f420", "gmzsj4f05dr", "copyright", "deviceandgeo", "googlesignals", "json", "date", "void", "sxa0", "typeerror", "cbfunction", "deferred", "closure library", "b1342177279", "this", "infinity", "iframe", "trident", "show", "typeof e", "version", "hidden", "bootstrap", "click", "javascript", "clickdataapi", "collapse", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "button", "tridentmsieedge", "linux", "twttr", "area", "false", "twitter", "blank", "gvjsj", "gvjsyt", "license", "small batch", "apache license", "unless", "as is", "basis", "without", "warranties or", "null", "node", "dan vanderkam", "dygraph", "gc", "gvjs8s", "mmm dd", "infinity0", "gvjs6s", "mmm d", "axis", "cell", "column", "arial", "drawingframe", "select", "textarea", "line", "inside", "gvjsih", "rnrn", "roboto", "body", "template", "outside", "rial", "gvjsob", "azaz09", "array", "april", "june", "august", "february", "span", "android", "christ", "bbfunction", "twitter tweet", "font awesome", "free", "cc by", "sil ofl", "code", "mit license", "brands", "segoe ui", "emoji", "helvetica neue", "noto", "apple color", "symbol", "noto color", "typebutton", "sprymedia ltd", "datatables", "typeof f", "without any", "warranty", "merchantability", "fitness", "a particular", "adata", "first", "next", "typeof", "typeof n", "hide", "focusin", "focusout", "shown", "js foundation", "g5gqv3cj17n" ], "references": [ "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://bazaar.abuse.ch/js/datatables.min.js", "https://bazaar.abuse.ch/css/bootstrap.min.css", "https://bazaar.abuse.ch/css/all.min.css", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://www.gstatic.com/charts/50/loader.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://abuse.ch/js/twitter_widget.js", "https://abuse.ch/js/jquery-3.6.0.min.js", "https://abuse.ch/js/bootstrap.min.js", "https://abuse.ch/js/google-charts.js", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 560, "URL": 1639, "FileHash-SHA256": 223, "domain": 383, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1470 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62616627ee302d24b23523c3", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T14:11:51.629000", "tags": [ "tbody", "span", "thead", "tfoot", "multiple", "type", "href", "input", "halflings", "gradienttype1", "twitter", "false", "fontface", "fatface", "woff2", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "typesubmit", "function", "typeof c", "formdata", "this", "typeof define", "null", "typeof f", "object", "boolean", "typeof module", "error", "reflect", "math", "regexp", "number", "array", "typeerror", "string", "symbol", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "account", "open", "navitem", "text", "mainnav", "click", "blank", "copyright", "u0027", "value", "body", "firefox", "enum", "html", "msie", "applewebkit", "traceconsole", "form", "iframe", "legend", "nonmsdombrowser", "callbackindex", "callbackframeid", "eventtarget", "eventargument", "validation", "explorer", "target", "plugin", "bootstrap", "https", "conflict", "focus", "next", "trigger", "checkbox", "delta", "scroll", "sourceid", "date", "sessiontoken", "sessionexpires", "void", "rangeerror", "utf16", "illegal input", "global", "chrome", "opredge", "opera", "safari", "version", "sxa0", "browser", "typeof require", "dom node", "typeof d", "component", "typeof h", "bubble", "reduceright", "script", "typeof n", "jhnew ia", "gtm5sn6brv", "path", "host", "trackpageview", "gw8yd4p2eny", "select", "strong", "uint8array", "android", "verify", "stop", "enterprise", "widget", "window", "generator", "reload", "r300", "caca", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "please", "typeemail", "email", "jarallaxinner", "webkit", "property", "transform", "trident", "edge", "ipodi", "ipadi", "androidi", "blackberryi", "windows phonei", "xfunction", "pfunction", "wfunction", "show navigation", "mjquery", "typeof", "defaulttype", "hidden", "show", "shown", "startr", "endr", "federico zivolo", "distributed", "mit license", "statict", "flip" ], "references": [ "xfe-IP-78.142.35.163-stix2-2.1-export.json", "xfe-URL-Enom.com-stix2-2.1-export.json", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "https://4vendeta.com/assets/js/popper.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/js/global-functions.js", "https://cp.enom.com/js/punycode.min.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/js/cart.minicart.min.js", "https://cp.enom.com/js/openWin.min.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://cp.enom.com/scripts/Session.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://cdn.optimizely.com/js/26241557.js", "https://cp.enom.com/verisign-seal.htm", "https://cp.enom.com/global/TopMenu.ascx.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2989, "hostname": 1208, "domain": 634, "FileHash-SHA256": 302 }, "indicator_count": 5133, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6261fd6a8d527fa569351e63", "name": "Malware hosting - unrealservers.net & heymman.com", "description": "function S.name, a.com, has been added to the end of a page to make sure it does not end up in an unauthorised place. and it will not get any more.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-22T00:57:14.125000", "tags": [ "e2f0fc", "fd7a07", "f0482b", "gradienttype0", "a5bcce", "helvetica", "negative", "arial", "bcd3e4", "style sheet", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "onload", "select", "error", "strong", "uint8array", "string", "null", "number", "function", "input", "array", "iframe", "date", "android", "verify", "stop", "this", "span", "enterprise", "click", "widget", "window", "form", "generator", "reload", "void", "dd2d2f", "e8e8e8", "d8d8d8", "fcfcfc", "e5e5e5", "lucida", "unicode", "lucida grande", "f9f9f9", "footer", "unavailable", "ngsanitize", "order now", "invalid", "snippet", "month", "hours", "fullyear", "regexp", "eeee", "mmmm d", "mena", "christ" ], "references": [ "xfe-URL-heymman.com-stix2-2.1-export.json", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.2/angular-sanitize.js", "https://www.heymman.com/script.js", "https://www.heymman.com/style/main.css", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.google.com/recaptcha/api.js", "https://unrealservers.net/master.css", "xfe-URL-Ndevix.com-stix2-2.1-export.json", "xfe-URL-Misk.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 427, "URL": 1183, "FileHash-SHA256": 162, "domain": 441, "email": 4 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "626078c9aeb1f4837a1bfc7e", "name": "Malware hosting - allwest.com", "description": "\u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m \u00c3\u20ac\u00a6, is the source of a new version of the JavaScript code, which is being developed by the Apache web browser.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-20T21:19:05.670000", "tags": [ "guji", "regexp", "cfunction", "event", "afunction", "efunction", "function", "xfunction", "jnull", "yefunction", "customevent", "typeof n", "typeof wpcf7", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "filter", "typenumber", "totalvalue", "linear", "secs", "index", "nameregion", "typevalue", "rangeto", "customuserspeed", "code", "typeof define", "date", "click", "smoothscroll", "number", "property", "fancybox", "null", "false", "scroll", "stop", "speed", "body", "error", "this", "typeerror", "symbol", "generator", "typeof e", "copyright", "closure library", "reduceright", "string", "aw981889198", "uint8array", "quota", "aafunction", "void", "hj", "object", "hotjar", "email", "typeof symbol", "telefon", "array", "survey", "meta", "cookie", "keypress", "trident", "live", "fullscreen", "generic", "window", "widget", "ciudad", "adore", "experiment", "mutation", "qe", "fnumber", "xhfunction", "yhfunction", "awconversionid", "g0cbkgbkb3j", "xdfunction", "adfunction", "cdfunction", "ddfunction", "typeof hj", "surveyv2", "surveyisolated", "heatmapviewer", "notification", "sentry", "ua411335272", "gfvhxsm5zyl", "xmlhttprequest", "domparser", "typeof module", "html tags", "ox20trnf", "dom element", "typeof t", "class", "attr", "pseudo", "child", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "source", "image", "ud83dudc6cud83c", "bsnull", "gtmmwm9r93", "typeof", "facebook pixel", "pixel code", "iterator", "constantvalue", "globalvariable", "facebook", "service", "phonenumber", "boolean", "select", "strong", "input", "iframe", "android", "verify", "span", "enterprise", "form", "reload", "adwords", "linkedin", "hs pixel", "loader", "addcookiedomain", "hubspot", "vui", "anda", "tente", "outubro", "trackingclient", "srpanj", "rabu", "vasaris", "helvetica neue", "helvetica", "arial", "accept", "n nn", "policy", "done", "800px", "40px", "i18n", "blockedemail", "typeof i18n", "captcha", "please", "april", "august", "close", "february", "june", "klik", "download", "next", "blank", "este", "rserver", "mais", "r300", "typeof d", "path", "caca", "pfunction", "contenttype", "zfunction", "bfunction", "mvoid", "ofunction", "array int8array", "caregexp", "legacy" ], "references": [ "xfe-URL-allwest.com-stix2-2.1-export.json", "https://www.googleadservices.com/pagead/conversion_async.js", "https://www.google-analytics.com/analytics.js", "https://www.googletagmanager.com/gtag/js?id=G-FVHXSM5ZYL&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=G-0CBKGBKB3J&l=dataLayer&cx=c", "https://js.hsleadflows.net/leadflows.js", "https://js.hs-banner.com/9251231.js", "https://js.hs-analytics.net/analytics/1650488100000/9251231.js", "https://js.hsadspixel.net/fb.js", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://connect.facebook.net/signals/config/661596171311072?v=2.9.57&r=stable", "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.57", "https://connect.facebook.net/en_US/fbevents.js", "https://www.googleoptimize.com/optimize.js?id=GTM-MWM9R93", "https://www.allwest.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3", "https://www.allwest.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "https://www.allwest.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://www.allwest.com/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.0", "https://www.googletagmanager.com/gtag/js?id=UA-41133527-3", "https://static.hotjar.com/c/hotjar-2836981.js?sv=5", "https://www.googletagmanager.com/gtag/js?id=UA-41133527-2", "https://www.googletagmanager.com/gtag/js?id=AW-CONVERSION_ID", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/981889198/?random=1650488340057&cv=9&fst=1650488340057&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4i1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.allwest.com%2F&tiba=All%20West%20Communications%20-%20telecommunication%20company&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://www.googletagmanager.com/gtag/js?id=AW-981889198", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/981889198/?random=1650488340630&cv=9&fst=1650488340630&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4i1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.allwest.com%2F&tiba=All%20West%20Communications%20-%20telecommunication%20company&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://www.allwest.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.allwest.com/wp-content/uploads/hummingbird-assets/c4be4d65e707f6328e3a72e79cfdfcb7.js", "https://www.allwest.com/wp-content/themes/allwestcommunications/js/jquery.main.js?ver=5.9.3", "https://www.allwest.com/wp-content/themes/allwestcommunications/js/custom.js?ver=5.9.3", "https://www.google.com/recaptcha/api.js?render=6Ld8S6EUAAAAAExG_6DO_Jj4DLY35ybebbA8R_eA&ver=3.0", "https://www.allwest.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.5.6", "https://www.allwest.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.9.5", "https://js.hs-scripts.com/9251231.js" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "Qe", "display_name": "Qe", "target": null }, { "id": "Vui", "display_name": "Vui", "target": null }, { "id": "Outubro", "display_name": "Outubro", "target": null }, { "id": "Tente", "display_name": "Tente", "target": null }, { "id": "Anda", "display_name": "Anda", "target": null }, { "id": "Vasaris", "display_name": "Vasaris", "target": null }, { "id": "Rabu", "display_name": "Rabu", "target": null }, { "id": "Srpanj", "display_name": "Srpanj", "target": null }, { "id": "TrackingClient", "display_name": "TrackingClient", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 821, "URL": 1568, "domain": 251, "FileHash-SHA256": 70, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2715, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1475 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62509a05316b00bcca30c693", "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams", "description": "Here is the full text of the code for the new animation, which will take place at 20:00 GMT on Friday, 1:30 BST.. (19:45 GMT)..", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T20:24:37.141000", "tags": [ "hammer", "gc", "vob", "tvb", "service", "date", "check favorite", "dare", "continuecta", "vote", "goprivate", "buycredits", "ff8d00", "favorite", "error", "null", "nonce", "enterprise", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "eenterprise", "object", "customevent", "ethis", "layouttest", "faceliftlayout", "stubbutton", "similarmodels", "purchasepagev3", "langtag", "newbannerchat", "image", "typeof atrkopts", "dailagill", "strong", "streams", "your", "source of", "pleasure", "live sex", "normal", "cosplay", "fingering", "chat", "deepthroat", "close", "live", "free cams", "sex chat", "live porn", "sex cam", "livesex", "webcamsex", "adult cams", "free live sex chat", "webcam sex", "chat online", "free adults hd", "mins", "xxx cams", "xxx porn", "free live cam", "adult sex", "material", "majority", "here looking", "for child", "pornography", "move on", "on this", "website", "we will", "turn over", "free porn webcams", "live webcam", "online sex cam", "xxx girls", "live sex chat", "teen sexchat", "amateur video", "web cam", "sexcams", "shows", "porn chat", "bongacams", "function", "i2c1", "xeir", "cef4", "m4sr", "e4c4", "math", "ttmt", "y4giwe", "h5gg", "window", "css1062", "segoe ui", "emoji", "href", "roboto", "helvetica neue", "arial", "apple color", "symbol", "typecheckbox", "twitter", "web design", "iran", "author url", "github", "regexp", "pseudo", "child", "typeof n", "typeof t", "class", "attr", "typeof module", "this" ], "references": [ "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json", "https://payvtylhwjxnr.xyz/Content/script?v=2", "https://payvtylhwjxnr.xyz/Content/css/banks.css", "https://payvtylhwjxnr.xyz/Content/style?v=1", "xfe-IP-104.21.72.150-stix2-2.1-export.json", "xfe-IP-172.67.151.101-stix2-2.1-export.json", "https://static.selfpuc.com/mnpw3.js", "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full", "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on", "https://bongacams.com/GianaWatson", "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools", "https://d31qbv1cthcecs.cloudfront.net/atrk.js", "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js", "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB", "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js" ], "public": 1, "adversary": "", "targeted_countries": [ "New Caledonia", "New Zealand" ], "malware_families": [ { "id": "Hammer", "display_name": "Hammer", "target": null }, { "id": "Tvb", "display_name": "Tvb", "target": null }, { "id": "Vob", "display_name": "Vob", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 425, "domain": 459, "URL": 1412, "FileHash-SHA256": 125 }, "indicator_count": 2421, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1487 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621fff12d2c54f70fea90576", "name": "Bexar.org", "description": "", "modified": "2022-04-01T00:01:54.852000", "created": "2022-03-02T23:34:42.531000", "tags": [], "references": [ "www.bexar.org - urlscan.io.pdf", "bexar api 4.pdf", "bexar api 8.pdf", "bexar 6.pdf", "bexar api 2.pdf", "bexar api 7.pdf", "bexar api 3.pdf", "bexar api 9.pdf", "bexar api 12.pdf", "bexar api 17.pdf", "bexar api 15.pdf", "bexar api 18.pdf", "bexar api 10.pdf", "bexar api 19.pdf", "bexar api 20.pdf", "bexar api 13.pdf", "bexar api 21.pdf", "bexar api 14.pdf", "bexar api 22.pdf", "bexar1.pdf", "bexar api5.pdf", "bexar2.pdf", "bexar3.pdf", "bexar.org 3.2.22.pdf", "bexar6.pdf", "bexar5.pdf", "bexar api_1.pdf", "bexar10.pdf", "bexar api.pdf", "bexar_v1df.pdf", "bexarv4df.pdf", "bexarv2df.pdf", "bexarv6df.pdf", "bexasv3df.pdf", "bexarv7df.pdf", "bear_v apidf.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1833, "URL": 4669, "domain": 1025, "FileHash-SHA256": 1735, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9410, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.allwest.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://abuse.ch/js/twitter_widget.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "https://www.allwest.com/wp-content/uploads/hummingbird-assets/c4be4d65e707f6328e3a72e79cfdfcb7.js", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js", "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on", "https://unrealservers.net/master.css", "bexar api.pdf", "https://js.hsadspixel.net/fb.js", "https://www.allwest.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.9.5", "bexar api 22.pdf", "https://payvtylhwjxnr.xyz/Content/script?v=2", "bexar api 8.pdf", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://static.selfpuc.com/mnpw3.js", "https://www.heymman.com/style/main.css", "https://cp.enom.com/js/jquery.cookie.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-41133527-2", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "bexar api 10.pdf", "https://www.allwest.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "https://cp.enom.com/verisign-seal.htm", "https://www.googletagmanager.com/gtag/js?id=AW-CONVERSION_ID", "bexarv2df.pdf", "bexar.org 3.2.22.pdf", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://www.heymman.com/script.js", "bexar_v1df.pdf", "https://4vendeta.com/assets/js/popper.min.js", "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json", "https://cp.enom.com/js/global-functions.js", "bexarv4df.pdf", "https://js.hsleadflows.net/leadflows.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/981889198/?random=1650488340057&cv=9&fst=1650488340057&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4i1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.allwest.com%2F&tiba=All%20West%20Communications%20-%20telecommunication%20company&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "xfe-URL-Ndevix.com-stix2-2.1-export.json", "https://js.hs-banner.com/9251231.js", "https://www.allwest.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "bexar6.pdf", "bexar3.pdf", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.googletagmanager.com/gtag/js?id=AW-981889198", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "bexar api 14.pdf", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "https://js.hs-scripts.com/9251231.js", "bexar api 4.pdf", "https://payvtylhwjxnr.xyz/Content/style?v=1", "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full", "https://www.allwest.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://d31qbv1cthcecs.cloudfront.net/atrk.js", "https://cp.enom.com/scripts/Session.min.js", "https://abuse.ch/js/google-charts.js", "bexar 6.pdf", "bexar2.pdf", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://payvtylhwjxnr.xyz/Content/css/banks.css", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://js.hs-analytics.net/analytics/1650488100000/9251231.js", "https://www.googletagmanager.com/gtag/js?id=G-0CBKGBKB3J&l=dataLayer&cx=c", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.2/angular-sanitize.js", "bexar api 15.pdf", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/981889198/?random=1650488340630&cv=9&fst=1650488340630&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4i1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.allwest.com%2F&tiba=All%20West%20Communications%20-%20telecommunication%20company&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://cp.enom.com/js/openWin.min.js", "www.bexar.org - urlscan.io.pdf", "bexar api 2.pdf", "https://www.gstatic.com/charts/50/loader.js", "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "xfe-IP-104.21.72.150-stix2-2.1-export.json", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://cdn.optimizely.com/js/26241557.js", "https://www.google.com/recaptcha/api.js", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://www.googletagmanager.com/gtag/js?id=G-FVHXSM5ZYL&l=dataLayer&cx=c", "bexasv3df.pdf", "bear_v apidf.pdf", "https://abuse.ch/js/jquery-3.6.0.min.js", "bexar10.pdf", "https://bongacams.com/GianaWatson", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://connect.facebook.net/signals/config/661596171311072?v=2.9.57&r=stable", "bexar api 21.pdf", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://www.googleadservices.com/pagead/conversion_async.js", "https://4vendeta.com/assets/js/parallax.min.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js", "bexar api 18.pdf", "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js", "https://www.googleoptimize.com/optimize.js?id=GTM-MWM9R93", "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB", "bexar api 12.pdf", "https://cp.enom.com/js/jquery.jgrowl.min.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "bexar api5.pdf", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "bexar5.pdf", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "xfe-URL-Misk.com-stix2-2.1-export.json", "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools", "xfe-URL-Enom.com-stix2-2.1-export.json", "bexar api 3.pdf", "https://cp.enom.com/responsive/_js/init.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://bazaar.abuse.ch/js/datatables.min.js", "https://www.allwest.com/wp-content/themes/allwestcommunications/js/custom.js?ver=5.9.3", "xfe-URL-heymman.com-stix2-2.1-export.json", "bexar api 20.pdf", "https://static.hotjar.com/c/hotjar-2836981.js?sv=5", "https://cp.enom.com/global/TopMenu.ascx.js", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://www.google-analytics.com/analytics.js", "bexarv7df.pdf", "bexar api 13.pdf", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://www.allwest.com/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.0", "https://cp.enom.com/js/cart.minicart.min.js", "xfe-IP-172.67.151.101-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=UA-41133527-3", "https://www.allwest.com/wp-content/themes/allwestcommunications/js/jquery.main.js?ver=5.9.3", "https://www.allwest.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.5.6", "bexar1.pdf", "https://abuse.ch/js/bootstrap.min.js", "bexar api 9.pdf", "bexar api 17.pdf", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://cp.enom.com/js/punycode.min.js", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "bexar api 19.pdf", "bexar api 7.pdf", "https://connect.facebook.net/en_US/fbevents.js", "xfe-URL-allwest.com-stix2-2.1-export.json", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742", "https://bazaar.abuse.ch/css/bootstrap.min.css", "xfe-IP-78.142.35.163-stix2-2.1-export.json", "bexar api_1.pdf", "https://www.google.com/recaptcha/api.js?render=6Ld8S6EUAAAAAExG_6DO_Jj4DLY35ybebbA8R_eA&ver=3.0", "bexarv6df.pdf", "https://bazaar.abuse.ch/css/all.min.css", "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.57" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Hj", "Tente", "Rabu", "Vui", "Hammer", "Reduceright", "Anda", "Outubro", "Vasaris", "Vob", "Qe", "Srpanj", "Gc", "Tvb", "Trackingclient" ], "industries": [ "Government" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "661afd962ed1f89b54a92de9", "name": "Injection #1", "description": "Injection #1", "modified": "2024-04-13T21:48:06.480000", "created": "2024-04-13T21:48:06.480000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 17, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "phoenix-choi1", "id": "278628", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 11, "domain": 63, "hostname": 109 }, "indicator_count": 183, "is_author": false, "is_subscribing": null, "subscriber_count": 24, "modified_text": "780 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708ed8f7d4b5483117bb66", "name": "abuse.ch", "description": "", "modified": "2023-12-06T15:10:16.397000", "created": "2023-12-06T15:10:16.397000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 223, "domain": 383, "URL": 1639, "hostname": 560, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 114, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708c534aadf7adf4f27d77", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "", "modified": "2023-12-06T14:59:31.122000", "created": "2023-12-06T14:59:31.122000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 302, "domain": 634, "URL": 2988, "hostname": 1208 }, "indicator_count": 5132, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707fe17dfdfe16066d16de", "name": "Bexar.org", "description": "", "modified": "2023-12-06T14:06:25.800000", "created": "2023-12-06T14:06:25.800000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1735, "hostname": 1833, "domain": 1025, "URL": 4668, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9409, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "630aa58da975d104891c6565", "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams", "description": "", "modified": "2022-08-27T23:15:25.718000", "created": "2022-08-27T23:15:25.718000", "tags": [ "hammer", "gc", "vob", "tvb", "service", "date", "check favorite", "dare", "continuecta", "vote", "goprivate", "buycredits", "ff8d00", "favorite", "error", "null", "nonce", "enterprise", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "eenterprise", "object", "customevent", "ethis", "layouttest", "faceliftlayout", "stubbutton", "similarmodels", "purchasepagev3", "langtag", "newbannerchat", "image", "typeof atrkopts", "dailagill", "strong", "streams", "your", "source of", "pleasure", "live sex", "normal", "cosplay", "fingering", "chat", "deepthroat", "close", "live", "free cams", "sex chat", "live porn", "sex cam", "livesex", "webcamsex", "adult cams", "free live sex chat", "webcam sex", "chat online", "free adults hd", "mins", "xxx cams", "xxx porn", "free live cam", "adult sex", "material", "majority", "here looking", "for child", "pornography", "move on", "on this", "website", "we will", "turn over", "free porn webcams", "live webcam", "online sex cam", "xxx girls", "live sex chat", "teen sexchat", "amateur video", "web cam", "sexcams", "shows", "porn chat", "bongacams", "function", "i2c1", "xeir", "cef4", "m4sr", "e4c4", "math", "ttmt", "y4giwe", "h5gg", "window", "css1062", "segoe ui", "emoji", "href", "roboto", "helvetica neue", "arial", "apple color", "symbol", "typecheckbox", "twitter", "web design", "iran", "author url", "github", "regexp", "pseudo", "child", "typeof n", "typeof t", "class", "attr", "typeof module", "this" ], "references": [ "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json", "https://payvtylhwjxnr.xyz/Content/script?v=2", "https://payvtylhwjxnr.xyz/Content/css/banks.css", "https://payvtylhwjxnr.xyz/Content/style?v=1", "xfe-IP-104.21.72.150-stix2-2.1-export.json", "xfe-IP-172.67.151.101-stix2-2.1-export.json", "https://static.selfpuc.com/mnpw3.js", "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full", "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on", "https://bongacams.com/GianaWatson", "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools", "https://d31qbv1cthcecs.cloudfront.net/atrk.js", "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js", "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB", "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js" ], "public": 1, "adversary": "", "targeted_countries": [ "New Caledonia", "New Zealand" ], "malware_families": [ { "id": "Hammer", "display_name": "Hammer", "target": null }, { "id": "Tvb", "display_name": "Tvb", "target": null }, { "id": "Vob", "display_name": "Vob", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": "62509a05316b00bcca30c693", "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Hardtogiveafuck", "id": "205637", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 425, "domain": 459, "URL": 1412, "FileHash-SHA256": 125 }, "indicator_count": 2421, "is_author": false, "is_subscribing": null, "subscriber_count": 7, "modified_text": "1375 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628d21a4558f3ccf49c07931", "name": "abuse.ch", "description": "Looking for wizard spider. Some domains have .ru and .su (Soviet Union)", "modified": "2022-05-24T18:19:16.027000", "created": "2022-05-24T18:19:16.027000", "tags": [ "twitter follow", "button follow", "reduceright", "number", "string", "regexp", "error", "f420", "gmzsj4f05dr", "copyright", "deviceandgeo", "googlesignals", "json", "date", "void", "sxa0", "typeerror", "cbfunction", "deferred", "closure library", "b1342177279", "this", "infinity", "iframe", "trident", "show", "typeof e", "version", "hidden", "bootstrap", "click", "javascript", "clickdataapi", "collapse", "typeof t", "class", "attr", "pseudo", "child", "function", "typeof module", "button", "tridentmsieedge", "linux", "twttr", "area", "false", "twitter", "blank", "gvjsj", "gvjsyt", "license", "small batch", "apache license", "unless", "as is", "basis", "without", "warranties or", "null", "node", "dan vanderkam", "dygraph", "gc", "gvjs8s", "mmm dd", "infinity0", "gvjs6s", "mmm d", "axis", "cell", "column", "arial", "drawingframe", "select", "textarea", "line", "inside", "gvjsih", "rnrn", "roboto", "body", "template", "outside", "rial", "gvjsob", "azaz09", "array", "april", "june", "august", "february", "span", "android", "christ", "bbfunction", "twitter tweet", "font awesome", "free", "cc by", "sil ofl", "code", "mit license", "brands", "segoe ui", "emoji", "helvetica neue", "noto", "apple color", "symbol", "noto color", "typebutton", "sprymedia ltd", "datatables", "typeof f", "without any", "warranty", "merchantability", "fitness", "a particular", "adata", "first", "next", "typeof", "typeof n", "hide", "focusin", "focusout", "shown", "js foundation", "g5gqv3cj17n" ], "references": [ "https://www.googletagmanager.com/gtag/js?id=G-5GQV3CJ17N", "https://bazaar.abuse.ch/js/jquery-3.5.1.min.js", "https://bazaar.abuse.ch/js/bootstrap.min.js", "https://bazaar.abuse.ch/js/datatables.min.js", "https://bazaar.abuse.ch/css/bootstrap.min.css", "https://bazaar.abuse.ch/css/all.min.css", "https://platform.twitter.com/js/button.3ccb64e61d4c01fae12cd2b0ed9b2bab.js", "https://www.gstatic.com/charts/50/loader.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_default_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_ui_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_graphics_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_corechart_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_fw_module.js", "https://www.gstatic.com/charts/50/third_party/dygraphs/dygraph-tickers-combined.js", "https://www.gstatic.com/charts/50/third_party/webfontloader/webfont.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_line_module.js", "https://www.gstatic.com/charts/50/js/jsapi_compiled_bar_module.js", "https://abuse.ch/js/twitter_widget.js", "https://abuse.ch/js/jquery-3.6.0.min.js", "https://abuse.ch/js/bootstrap.min.js", "https://abuse.ch/js/google-charts.js", "https://www.googletagmanager.com/gtag/js?id=G-MZSJ4F05DR", "https://platform.twitter.com/widgets/follow_button.f8c8d971a6ac545cf416e3c1ad4bbc65.en.html#dnt=false&id=twitter-widget-0&lang=en&screen_name=abuse_ch&show_count=false&show_screen_name=true&size=l&time=1653415551742" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 560, "URL": 1639, "FileHash-SHA256": 223, "domain": 383, "email": 1, "FileHash-MD5": 2 }, "indicator_count": 2808, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1470 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62616627ee302d24b23523c3", "name": "enom.com & 4vendeta.com - ReduceRight malware hosting/creation", "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T14:11:51.629000", "tags": [ "tbody", "span", "thead", "tfoot", "multiple", "type", "href", "input", "halflings", "gradienttype1", "twitter", "false", "fontface", "fatface", "woff2", "u0259", "u1e001eff", "u2020", "u20a020ab", "u20ad20cf", "u2113", "u2c602c7f", "typesubmit", "function", "typeof c", "formdata", "this", "typeof define", "null", "typeof f", "object", "boolean", "typeof module", "error", "reflect", "math", "regexp", "number", "array", "typeerror", "string", "symbol", "typeof e", "typeof t", "class", "attr", "pseudo", "child", "js foundation", "account", "open", "navitem", "text", "mainnav", "click", "blank", "copyright", "u0027", "value", "body", "firefox", "enum", "html", "msie", "applewebkit", "traceconsole", "form", "iframe", "legend", "nonmsdombrowser", "callbackindex", "callbackframeid", "eventtarget", "eventargument", "validation", "explorer", "target", "plugin", "bootstrap", "https", "conflict", "focus", "next", "trigger", "checkbox", "delta", "scroll", "sourceid", "date", "sessiontoken", "sessionexpires", "void", "rangeerror", "utf16", "illegal input", "global", "chrome", "opredge", "opera", "safari", "version", "sxa0", "browser", "typeof require", "dom node", "typeof d", "component", "typeof h", "bubble", "reduceright", "script", "typeof n", "jhnew ia", "gtm5sn6brv", "path", "host", "trackpageview", "gw8yd4p2eny", "select", "strong", "uint8array", "android", "verify", "stop", "enterprise", "widget", "window", "generator", "reload", "r300", "caca", "closure library", "xdfunction", "adfunction", "cdfunction", "ddfunction", "bded", "please", "typeemail", "email", "jarallaxinner", "webkit", "property", "transform", "trident", "edge", "ipodi", "ipadi", "androidi", "blackberryi", "windows phonei", "xfunction", "pfunction", "wfunction", "show navigation", "mjquery", "typeof", "defaulttype", "hidden", "show", "shown", "startr", "endr", "federico zivolo", "distributed", "mit license", "statict", "flip" ], "references": [ "xfe-IP-78.142.35.163-stix2-2.1-export.json", "xfe-URL-Enom.com-stix2-2.1-export.json", "xfe-URL-4vendeta.com-stix2-2.1-export.json", "https://4vendeta.com/assets/js/jquery.min.js", "https://4vendeta.com/assets/js/popper.min.js", "https://4vendeta.com/assets/js/bootstrap.min.js", "https://4vendeta.com/assets/js/meanmenu.min.js", "https://4vendeta.com/assets/js/parallax.min.js", "https://4vendeta.com/assets/js/ajaxchimp.min.js", "https://www.googletagmanager.com/gtag/js?id=UA-92521958-1", "https://www.googletagmanager.com/gtag/js?id=G-W8YD4P2ENY&l=dataLayer&cx=c", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.googletagmanager.com/gtm.js?id=GTM-5SN6BRV", "https://static.zdassets.com/ekr/snippet.js?key=7342b695-e394-4f25-89a0-da9d262a48da", "https://cp.enom.com/js/jquery-3.5.1.min.js", "https://cp.enom.com/responsive/_js/knockout-3.3.0.min.js", "https://cp.enom.com/js/global-functions.js", "https://cp.enom.com/js/punycode.min.js", "https://cp.enom.com/js/jquery.disableonsubmit.min.js", "https://cp.enom.com/js/jquery.cookie.min.js", "https://cp.enom.com/js/cart.minicart.min.js", "https://cp.enom.com/js/openWin.min.js", "https://cp.enom.com/js/jquery.jgrowl.min.js", "https://cp.enom.com/scripts/Session.min.js", "https://cp.enom.com/responsive/_js/init.min.js", "https://cp.enom.com/responsive/_js/bootstrap.js", "https://cp.enom.com/WebResource.axd?d=6rtXrDcnyiYD-9dFDFOkxTRcPVSrAN8fR-cHKzNqPTy7bHic-2LLMHDnielTzEI-sd1KplHrRBudcZJOm0-lxubO7k41&t=637453818340000000", "https://cp.enom.com/ScriptResource.axd?d=fVjQa-0YyNqO6JmV36bw6eBJdTjE2YSdtcunOWcKYcBNn73MOJKQA_rxX3YMhcxLTgyDsGTKy0p9NEPvxzpqEpBKtm3GLb2GgI1LFYMC0Xr2lh71ZCttzgNGFnc5mS_Fc_DY5UH0M19Mr958h1jvmK4kzAM1&t=363be08", "https://cp.enom.com/ScriptResource.axd?d=lDjPFfAIWSrEAVNgTHTrISQmLEFmHAaibvNJQuGRZDbWpGFPLrFwaGVpjCUsI6HkqzbpwmaAa0cJCrq8f0eqEvIsQM8lvN_dVYVyESnohON4oTvdMZHDmwG83uJA4m2oqykP8TTTSIeV2oaNrlIXaX8cOxC5Cv6aGmjpdB2u-227wdn30&t=363be08", "https://cdn.optimizely.com/js/26241557.js", "https://cp.enom.com/verisign-seal.htm", "https://cp.enom.com/global/TopMenu.ascx.js", "http://alp-vision.com/wp-includes/js/jquery/jquery.min.js?ver=3.5.1", "http://alp-vision.com/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=7.4.4", "http://alp-vision.com/wp-content/cache/autoptimize/js/autoptimize_78b4f9b28399aa3c8a405e45931ad058.js", "http://alp-vision.com/wp-includes/css/dist/block-library/style.min.css?ver=5.7.6", "http://fonts.googleapis.com/css?family=Abril+Fatface%3Aregular&subset=latin%2Ccyrillic&ver=5.7.6", "http://alp-vision.com/wp-content/themes/alp-vision/css/bootstrap.css?ver=1.0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2989, "hostname": 1208, "domain": 634, "FileHash-SHA256": 302 }, "indicator_count": 5133, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6261fd6a8d527fa569351e63", "name": "Malware hosting - unrealservers.net & heymman.com", "description": "function S.name, a.com, has been added to the end of a page to make sure it does not end up in an unauthorised place. and it will not get any more.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-22T00:57:14.125000", "tags": [ "e2f0fc", "fd7a07", "f0482b", "gradienttype0", "a5bcce", "helvetica", "negative", "arial", "bcd3e4", "style sheet", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "onload", "select", "error", "strong", "uint8array", "string", "null", "number", "function", "input", "array", "iframe", "date", "android", "verify", "stop", "this", "span", "enterprise", "click", "widget", "window", "form", "generator", "reload", "void", "dd2d2f", "e8e8e8", "d8d8d8", "fcfcfc", "e5e5e5", "lucida", "unicode", "lucida grande", "f9f9f9", "footer", "unavailable", "ngsanitize", "order now", "invalid", "snippet", "month", "hours", "fullyear", "regexp", "eeee", "mmmm d", "mena", "christ" ], "references": [ "xfe-URL-heymman.com-stix2-2.1-export.json", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.8/angular.min.js", "https://ajax.googleapis.com/ajax/libs/angularjs/1.4.2/angular-sanitize.js", "https://www.heymman.com/script.js", "https://www.heymman.com/style/main.css", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://www.google.com/recaptcha/api.js", "https://unrealservers.net/master.css", "xfe-URL-Ndevix.com-stix2-2.1-export.json", "xfe-URL-Misk.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 427, "URL": 1183, "FileHash-SHA256": 162, "domain": 441, "email": 4 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "626078c9aeb1f4837a1bfc7e", "name": "Malware hosting - allwest.com", "description": "\u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m \u00c3\u20ac\u00a6, is the source of a new version of the JavaScript code, which is being developed by the Apache web browser.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-20T21:19:05.670000", "tags": [ "guji", "regexp", "cfunction", "event", "afunction", "efunction", "function", "xfunction", "jnull", "yefunction", "customevent", "typeof n", "typeof wpcf7", "nonce", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "recaptchaapi", "render", "filter", "typenumber", "totalvalue", "linear", "secs", "index", "nameregion", "typevalue", "rangeto", "customuserspeed", "code", "typeof define", "date", "click", "smoothscroll", "number", "property", "fancybox", "null", "false", "scroll", "stop", "speed", "body", "error", "this", "typeerror", "symbol", "generator", "typeof e", "copyright", "closure library", "reduceright", "string", "aw981889198", "uint8array", "quota", "aafunction", "void", "hj", "object", "hotjar", "email", "typeof symbol", "telefon", "array", "survey", "meta", "cookie", "keypress", "trident", "live", "fullscreen", "generic", "window", "widget", "ciudad", "adore", "experiment", "mutation", "qe", "fnumber", "xhfunction", "yhfunction", "awconversionid", "g0cbkgbkb3j", "xdfunction", "adfunction", "cdfunction", "ddfunction", "typeof hj", "surveyv2", "surveyisolated", "heatmapviewer", "notification", "sentry", "ua411335272", "gfvhxsm5zyl", "xmlhttprequest", "domparser", "typeof module", "html tags", "ox20trnf", "dom element", "typeof t", "class", "attr", "pseudo", "child", "udc66udc67", "ud83d", "ufe0f", "ud83e", "udc68udc69", "udfcbudfcc", "u2640u2642", "source", "image", "ud83dudc6cud83c", "bsnull", "gtmmwm9r93", "typeof", "facebook pixel", "pixel code", "iterator", "constantvalue", "globalvariable", "facebook", "service", "phonenumber", "boolean", "select", "strong", "input", "iframe", "android", "verify", "span", "enterprise", "form", "reload", "adwords", "linkedin", "hs pixel", "loader", "addcookiedomain", "hubspot", "vui", "anda", "tente", "outubro", "trackingclient", "srpanj", "rabu", "vasaris", "helvetica neue", "helvetica", "arial", "accept", "n nn", "policy", "done", "800px", "40px", "i18n", "blockedemail", "typeof i18n", "captcha", "please", "april", "august", "close", "february", "june", "klik", "download", "next", "blank", "este", "rserver", "mais", "r300", "typeof d", "path", "caca", "pfunction", "contenttype", "zfunction", "bfunction", "mvoid", "ofunction", "array int8array", "caregexp", "legacy" ], "references": [ "xfe-URL-allwest.com-stix2-2.1-export.json", "https://www.googleadservices.com/pagead/conversion_async.js", "https://www.google-analytics.com/analytics.js", "https://www.googletagmanager.com/gtag/js?id=G-FVHXSM5ZYL&l=dataLayer&cx=c", "https://www.googletagmanager.com/gtag/js?id=G-0CBKGBKB3J&l=dataLayer&cx=c", "https://js.hsleadflows.net/leadflows.js", "https://js.hs-banner.com/9251231.js", "https://js.hs-analytics.net/analytics/1650488100000/9251231.js", "https://js.hsadspixel.net/fb.js", "https://www.gstatic.com/recaptcha/releases/QENb_qRrX0-mQMyENQjD6Fuj/recaptcha__en.js", "https://connect.facebook.net/signals/config/661596171311072?v=2.9.57&r=stable", "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.57", "https://connect.facebook.net/en_US/fbevents.js", "https://www.googleoptimize.com/optimize.js?id=GTM-MWM9R93", "https://www.allwest.com/wp-includes/js/wp-emoji-release.min.js?ver=5.9.3", "https://www.allwest.com/wp-includes/js/jquery/jquery.min.js?ver=3.6.0", "https://www.allwest.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2", "https://www.allwest.com/wp-content/plugins/svg-support/js/min/svgs-inline-min.js?ver=1.0.0", "https://www.googletagmanager.com/gtag/js?id=UA-41133527-3", "https://static.hotjar.com/c/hotjar-2836981.js?sv=5", "https://www.googletagmanager.com/gtag/js?id=UA-41133527-2", "https://www.googletagmanager.com/gtag/js?id=AW-CONVERSION_ID", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/981889198/?random=1650488340057&cv=9&fst=1650488340057&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4i1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.allwest.com%2F&tiba=All%20West%20Communications%20-%20telecommunication%20company&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://www.googletagmanager.com/gtag/js?id=AW-981889198", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/981889198/?random=1650488340630&cv=9&fst=1650488340630&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=1&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa4i1&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.allwest.com%2F&tiba=All%20West%20Communications%20-%20telecommunication%20company&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4", "https://www.allwest.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.allwest.com/wp-content/uploads/hummingbird-assets/c4be4d65e707f6328e3a72e79cfdfcb7.js", "https://www.allwest.com/wp-content/themes/allwestcommunications/js/jquery.main.js?ver=5.9.3", "https://www.allwest.com/wp-content/themes/allwestcommunications/js/custom.js?ver=5.9.3", "https://www.google.com/recaptcha/api.js?render=6Ld8S6EUAAAAAExG_6DO_Jj4DLY35ybebbA8R_eA&ver=3.0", "https://www.allwest.com/wp-content/plugins/contact-form-7/modules/recaptcha/index.js?ver=5.5.6", "https://www.allwest.com/wp-content/plugins/wp-smushit/app/assets/js/smush-lazy-load.min.js?ver=3.9.5", "https://js.hs-scripts.com/9251231.js" ], "public": 1, "adversary": "", "targeted_countries": [ "Tunisia" ], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "Qe", "display_name": "Qe", "target": null }, { "id": "Vui", "display_name": "Vui", "target": null }, { "id": "Outubro", "display_name": "Outubro", "target": null }, { "id": "Tente", "display_name": "Tente", "target": null }, { "id": "Anda", "display_name": "Anda", "target": null }, { "id": "Vasaris", "display_name": "Vasaris", "target": null }, { "id": "Rabu", "display_name": "Rabu", "target": null }, { "id": "Srpanj", "display_name": "Srpanj", "target": null }, { "id": "TrackingClient", "display_name": "TrackingClient", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 821, "URL": 1568, "domain": 251, "FileHash-SHA256": 70, "FileHash-MD5": 4, "FileHash-SHA1": 1 }, "indicator_count": 2715, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1475 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62509a05316b00bcca30c693", "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams", "description": "Here is the full text of the code for the new animation, which will take place at 20:00 GMT on Friday, 1:30 BST.. (19:45 GMT)..", "modified": "2022-05-08T00:03:14.586000", "created": "2022-04-08T20:24:37.141000", "tags": [ "hammer", "gc", "vob", "tvb", "service", "date", "check favorite", "dare", "continuecta", "vote", "goprivate", "buycredits", "ff8d00", "favorite", "error", "null", "nonce", "enterprise", "script", "please do", "not copy", "and paste", "this code", "cgrecaptchacfg", "ngrecaptcha", "eenterprise", "object", "customevent", "ethis", "layouttest", "faceliftlayout", "stubbutton", "similarmodels", "purchasepagev3", "langtag", "newbannerchat", "image", "typeof atrkopts", "dailagill", "strong", "streams", "your", "source of", "pleasure", "live sex", "normal", "cosplay", "fingering", "chat", "deepthroat", "close", "live", "free cams", "sex chat", "live porn", "sex cam", "livesex", "webcamsex", "adult cams", "free live sex chat", "webcam sex", "chat online", "free adults hd", "mins", "xxx cams", "xxx porn", "free live cam", "adult sex", "material", "majority", "here looking", "for child", "pornography", "move on", "on this", "website", "we will", "turn over", "free porn webcams", "live webcam", "online sex cam", "xxx girls", "live sex chat", "teen sexchat", "amateur video", "web cam", "sexcams", "shows", "porn chat", "bongacams", "function", "i2c1", "xeir", "cef4", "m4sr", "e4c4", "math", "ttmt", "y4giwe", "h5gg", "window", "css1062", "segoe ui", "emoji", "href", "roboto", "helvetica neue", "arial", "apple color", "symbol", "typecheckbox", "twitter", "web design", "iran", "author url", "github", "regexp", "pseudo", "child", "typeof n", "typeof t", "class", "attr", "typeof module", "this" ], "references": [ "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json", "https://payvtylhwjxnr.xyz/Content/script?v=2", "https://payvtylhwjxnr.xyz/Content/css/banks.css", "https://payvtylhwjxnr.xyz/Content/style?v=1", "xfe-IP-104.21.72.150-stix2-2.1-export.json", "xfe-IP-172.67.151.101-stix2-2.1-export.json", "https://static.selfpuc.com/mnpw3.js", "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full", "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on", "https://bongacams.com/GianaWatson", "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools", "https://d31qbv1cthcecs.cloudfront.net/atrk.js", "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js", "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB", "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js" ], "public": 1, "adversary": "", "targeted_countries": [ "New Caledonia", "New Zealand" ], "malware_families": [ { "id": "Hammer", "display_name": "Hammer", "target": null }, { "id": "Tvb", "display_name": "Tvb", "target": null }, { "id": "Vob", "display_name": "Vob", "target": null }, { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 425, "domain": 459, "URL": 1412, "FileHash-SHA256": 125 }, "indicator_count": 2421, "is_author": false, "is_subscribing": null, "subscriber_count": 71, "modified_text": "1487 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "this.jp", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "this.jp", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780476348.0392225 }