{ "type": "Domain", "indicator": "tlgr.org", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/tlgr.org", "alexa": "http://www.alexa.com/siteinfo/tlgr.org", "indicator": "tlgr.org", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3491971572, "indicator": "tlgr.org", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 41, "pulses": [ { "id": "64dca4eb3f10605dbeff12ac", "name": "Raccoon Stealer Announce Return After Hiatus", "description": "First observed in 2019 and advertised as a \u2018Malware-as-a-Service\u2019 (MaaS) threat on various cybercriminal forums, Raccoon is an information stealer targeting victim credentials and cryptocurrency wallets.", "modified": "2023-09-15T10:03:19.702000", "created": "2023-08-16T10:28:58.697000", "tags": [ "stealer", "raccoon", "infostealer" ], "references": [ "https://cyberint.com/blog/financial-services/raccoon-stealer/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 434, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 386597, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62ed397d23b4894198f2816e", "name": "DatasoftComnet-AntiSpam-Pulse1", "description": "Phishing Attempts and all malware links and URLs, IPs Hostnames", "modified": "2026-04-20T00:26:28.752000", "created": "2022-08-05T15:38:37.221000", "tags": [ "Latest", "malware", "phishing", "ransomware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 89, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dp@datasoftcomnet.com", "id": "117672", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 80, "email": 48, "hostname": 25, "FileHash-MD5": 65, "FileHash-SHA1": 73, "FileHash-SHA256": 105, "domain": 30 }, "indicator_count": 426, "is_author": false, "is_subscribing": null, "subscriber_count": 12, "modified_text": "42 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b033580c3323a89c21c9cf", "name": "Phishing | Mar 11, 2026 | Part 368/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 368/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:06:00.617000", "created": "2026-03-10T15:06:00.617000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1043, "domain": 957 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "82 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedf92c3d19b40bd452951", "name": "Phishing | Mar 10, 2026 | Part 319/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 319/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:56:18.419000", "created": "2026-03-09T14:56:18.419000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1039, "hostname": 961 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8c5e2e0a518de737cde0", "name": "Phishing | Mar 9, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:49:02.249000", "created": "2026-03-08T14:49:02.249000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3b7a4799c9b819cd55ed", "name": "Phishing | Mar 8, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:51:38.148000", "created": "2026-03-07T14:51:38.148000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae99d2b9058c066ad6357", "name": "Phishing | Mar 7, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:50:05.142000", "created": "2026-03-06T14:50:05.142000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99d81aac5b6449c5ad77c", "name": "Phishing | Mar 6, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:13:05.255000", "created": "2026-03-05T15:13:05.255000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a846c8e476e2a07a79dacc", "name": "Phishing | Mar 5, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:50:48.283000", "created": "2026-03-04T14:50:48.283000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1160, "hostname": 840 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f40beb2a2a159f8494ae", "name": "Phishing | Mar 4, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:45:31.405000", "created": "2026-03-03T14:45:31.405000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1160, "hostname": 840 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a5b9e89965500f47ac1834", "name": "Phishing | Mar 3, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 3, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T16:25:12.840000", "created": "2026-03-02T16:25:12.840000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a518197898d48b2d634f08", "name": "Phishing | Mar 2, 2026 | Part 321/729", "description": "Phishing indicators. Date: Mar 2, 2026. Part 321/729. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-02T04:54:49.079000", "created": "2026-03-02T04:54:49.079000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 865, "hostname": 1135 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a444b8378aaecba4f335a7", "name": "Phishing | Mar 2, 2026 | Part 324/732", "description": "Phishing indicators. Date: Mar 2, 2026. Part 324/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T13:52:56.703000", "created": "2026-03-01T13:52:56.703000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 874, "hostname": 1126 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a40a5d23b98ea1768abc83", "name": "Phishing | Mar 1, 2026 | Part 324/732", "description": "Phishing indicators. Date: Mar 1, 2026. Part 324/732. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T09:43:57.164000", "created": "2026-03-01T09:43:57.164000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 874, "hostname": 1126 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "91 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a388e8e28cb7c1abee4671", "name": "Phishing | Mar 1, 2026 | Part 325/733", "description": "Phishing indicators. Date: Mar 1, 2026. Part 325/733. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-01T00:31:36.575000", "created": "2026-03-01T00:31:36.575000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1092, "domain": 908 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "92 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6997ff8c84a0c1c8cf934069", "name": "Phishing | Feb 20, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-20T06:30:36.443000", "created": "2026-02-20T06:30:36.443000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1127, "domain": 873 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "100 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69976d6a657d912429496a81", "name": "Phishing | Feb 20, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T20:07:06.299000", "created": "2026-02-19T20:07:06.299000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1127, "domain": 873 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69972e596f4bd11bf795c9cb", "name": "Phishing | Feb 20, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 20, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T15:38:01.327000", "created": "2026-02-19T15:38:01.327000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1127, "domain": 873 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69970f0b40089300038f360e", "name": "Phishing | Feb 19, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-19T13:24:27.100000", "created": "2026-02-19T13:24:27.100000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 873, "hostname": 1127 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "101 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699638da281e76eb625ff28f", "name": "Phishing | Feb 19, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 19, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T22:10:34.411000", "created": "2026-02-18T22:10:34.411000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 873, "hostname": 1127 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "699579801efeb16a7b81c86e", "name": "Phishing | Feb 18, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-18T08:34:08.819000", "created": "2026-02-18T08:34:08.819000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 873, "hostname": 1127 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "102 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69949e08542fea7a3e3c1c8d", "name": "Phishing | Feb 18, 2026 | Part 327/735", "description": "Phishing indicators. Date: Feb 18, 2026. Part 327/735. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-17T16:57:44.588000", "created": "2026-02-17T16:57:44.588000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 873, "hostname": 1127 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "103 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69929c14c673239c58a6c78e", "name": "Phishing | Feb 16, 2026 | Part 332/741", "description": "Phishing indicators. Date: Feb 16, 2026. Part 332/741. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-16T04:24:52.169000", "created": "2026-02-16T04:24:52.169000", "tags": [ "phishing", "phishing-database", "threatfox" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1074, "domain": 926 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "104 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69915ceafcdab9f100acaff4", "name": "Phishing | Feb 15, 2026 | Part 339/749", "description": "Phishing indicators. Date: Feb 15, 2026. Part 339/749. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-15T05:43:06.034000", "created": "2026-02-15T05:43:06.034000", "tags": [ "phishing", "threatfox", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1003, "domain": 997 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "105 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69908e6e79da394a2f50f646", "name": "Phishing | Feb 15, 2026 | Part 343/754", "description": "Phishing indicators. Date: Feb 15, 2026. Part 343/754. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-14T15:02:06.720000", "created": "2026-02-14T15:02:06.720000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1021, "hostname": 979 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "106 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698c60fa7b5d9955057bc3bb", "name": "Phishing | Feb 11, 2026 | Part 370/783", "description": "Phishing indicators. Date: Feb 11, 2026. Part 370/783. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-11T10:59:06.477000", "created": "2026-02-11T10:59:06.477000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1166, "hostname": 834 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "109 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6981ab4c09f1455982da4992", "name": "Phishing | 2026-01-31 | Part 89/163", "description": "Phishing indicators. Date: 2026-01-31. Part 89/163. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-02-03T08:01:16.902000", "created": "2026-02-03T08:01:16.902000", "tags": [ "phishing", "phishing-database" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 4251, "domain": 5749 }, "indicator_count": 10000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "117 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688990fa0d8382bd5f02d806", "name": "EbeeJuly2025 Pt1", "description": "IOCs of multiple threaats observed and collected in July 2025", "modified": "2025-08-29T03:04:16.203000", "created": "2025-07-30T03:26:50.115000", "tags": [], "references": [ "Julypt1.pdf" ], "public": 1, "adversary": "Multiple", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 20, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "IMEBEEIMFINE", "id": "343873", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 39, "FileHash-MD5": 131, "FileHash-SHA1": 144, "FileHash-SHA256": 232, "CIDR": 1, "CVE": 3, "domain": 150, "email": 9, "hostname": 37 }, "indicator_count": 746, "is_author": false, "is_subscribing": null, "subscriber_count": 40, "modified_text": "275 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6654138435c5832ca2c4028f", "name": "DOH Domains IOCs", "description": "The following is a full list of items that you might not have known existed::..com, or, if you were interested in them, are the most likely ones to come up with", "modified": "2024-08-26T04:12:43.497000", "created": "2024-05-27T05:00:52.918000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "fueledbycoffeeDXB", "id": "272228", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "domain": 1335, "hostname": 667 }, "indicator_count": 2009, "is_author": false, "is_subscribing": null, "subscriber_count": 26, "modified_text": "643 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6609ed2764d1beb5a94fa0a4", "name": "Malware Filter - Phishing List - 31-03-2024", "description": "", "modified": "2024-03-31T23:09:27.718000", "created": "2024-03-31T23:09:27.718000", "tags": [], "references": [ "https://malware-filter.gitlab.io/malware-filter/phishing-filter-domains.txt" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 59, "hostname": 332 }, "indicator_count": 391, "is_author": false, "is_subscribing": null, "subscriber_count": 1622, "modified_text": "791 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65709feb03b8f1cdc6abe335", "name": "Raccoon Stealer malware 2.3.0", "description": "", "modified": "2023-12-06T16:23:06.809000", "created": "2023-12-06T16:23:06.809000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 208, "hostname": 2, "domain": 32, "FileHash-MD5": 168, "FileHash-SHA1": 539, "URL": 189 }, "indicator_count": 1138, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64ffeb3867304dc27b7ed82e", "name": "Orpheus TTPs (by ManagedSIEMTeam)", "description": "", "modified": "2023-10-11T00:00:51.078000", "created": "2023-09-12T04:38:16.190000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": "64ff064f2582a2a681f4e6a8", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 9 }, "indicator_count": 55, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "964 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64ff064f2582a2a681f4e6a8", "name": "Orpheus TTPs August 2023", "description": "", "modified": "2023-10-11T00:00:51.078000", "created": "2023-09-11T12:21:35.642000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ManagedSIEMTeam", "id": "111951", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 9 }, "indicator_count": 55, "is_author": false, "is_subscribing": null, "subscriber_count": 50, "modified_text": "964 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64dcd6ebdf0ed22d6f544880", "name": "Raccoon Stealer Announce Return After Hiatus", "description": "We are the first company in the world to offer a full range of security tools and tools to help combat phishing and other cyber-attacks, but how do we keep up with this growing trend?", "modified": "2023-09-15T14:02:24.610000", "created": "2023-08-16T14:02:19.942000", "tags": [ "raccoon", "figure", "raccoon stealer", "ip address", "racoon stealer", "javascript", "number", "suspicious", "raccoon malware", "ethereum", "exodus", "first", "stealer", "racealer", "infostealer", "legend", "dragon", "amigo", "explorer", "virustotal", "main", "download", "path", "mask", "february", "april", "bitcoin", "click", "contact", "racoon" ], "references": [ "https://cyberint.com/blog/financial-services/raccoon-stealer/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Racoon", "display_name": "Racoon", "target": null }, { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1090", "name": "Proxy", "display_name": "T1090 - Proxy" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" } ], "industries": [ "Finance", "Financial" ], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "parvesh4399", "id": "224939", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 30, "is_author": false, "is_subscribing": null, "subscriber_count": 55, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64ddf9c985a39d2762c771fe", "name": "Raccoon Stealer Announce Return After Hiatus", "description": "", "modified": "2023-09-15T10:03:19.702000", "created": "2023-08-17T10:43:21.590000", "tags": [ "stealer", "raccoon", "infostealer" ], "references": [ "https://cyberint.com/blog/financial-services/raccoon-stealer/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": "64ddd043075527748659cec7", "export_count": 33, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Tr1sa111", "id": "192483", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 277, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64ddd043075527748659cec7", "name": "Raccoon Stealer Announce Return After Hiatus", "description": "", "modified": "2023-09-15T10:03:19.702000", "created": "2023-08-17T07:46:11.409000", "tags": [ "stealer", "raccoon", "infostealer" ], "references": [ "https://cyberint.com/blog/financial-services/raccoon-stealer/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": "64dca4eb3f10605dbeff12ac", "export_count": 25, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tr2222200", "id": "207905", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 186, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64dca85e2eb2f561b240da8e", "name": "Raccoon Stealer Announce Return After Hiatus", "description": "", "modified": "2023-09-15T10:03:19.702000", "created": "2023-08-16T10:43:42.223000", "tags": [ "raccoon", "figure", "raccoon stealer", "ip address", "racoon stealer", "javascript", "number", "suspicious", "raccoon malware", "ethereum", "exodus", "first", "stealer", "racealer", "infostealer", "legend", "dragon", "amigo", "explorer", "virustotal", "main", "download", "path", "mask", "february", "april", "bitcoin", "click", "contact" ], "references": [ "https://cyberint.com/blog/financial-services/raccoon-stealer/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ChaiPatti", "id": "217274", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_217274/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 72, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64dca234247c8db04664ff5d", "name": "raccoon", "description": "A security alert has been issued by the Ministry of Defence (MoD) and the Office of National Statistics (ONS) to monitor the threat posed by cyber-thieves, known as \u201cTrojan Horse\".", "modified": "2023-09-15T09:05:55.294000", "created": "2023-08-16T10:17:24.866000", "tags": [ "suspicious", "initial", "call", "hashes", "ip addresses" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "JordanPowell@123", "id": "246048", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 44, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "64dbd0ecd944ae862dc13616", "name": "Raccoon Stealer malware 2.3.0", "description": "", "modified": "2023-09-15T02:01:46.848000", "created": "2023-08-15T19:24:28.449000", "tags": [ "http", "https", "urls", "hash", "sha1", "malicious" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "cryptocti", "id": "110256", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 189, "FileHash-MD5": 189, "FileHash-SHA1": 560, "FileHash-SHA256": 229, "domain": 32, "hostname": 2 }, "indicator_count": 1201, "is_author": false, "is_subscribing": null, "subscriber_count": 499, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc50ab789f367c193cadad", "name": "New Version of Raccoon Stealer Released - SOCRadar\u00ae Cyber Intelligence Inc.", "description": "Raccoon Stealer, a malware designed to steal the passwords and credit cards of users, has been reintroduced with a new version, according to Sekoia, an international security firm.", "modified": "2022-07-29T00:00:24.010000", "created": "2022-06-29T13:16:27.823000", "tags": [ "raccoon", "racoon", "maas", "downloads", "netwalker", "raccoon stealer", "c2 server", "winapi", "iocs", "racoon stealer", "os version", "post request", "dlls", "march", "atomic" ], "references": [ "https://socradar.io/new-version-of-raccoon-stealer-released/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Raccoon", "display_name": "Raccoon", "target": null }, { "id": "Racoon", "display_name": "Racoon", "target": null }, { "id": "Netwalker", "display_name": "Netwalker", "target": null }, { "id": "Downloads", "display_name": "Downloads", "target": null }, { "id": "MaaS", "display_name": "MaaS", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1407", "name": "Download New Code at Runtime", "display_name": "T1407 - Download New Code at Runtime" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "eric.ford", "id": "42510", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_42510/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 28, "FileHash-SHA1": 28, "FileHash-SHA256": 56, "domain": 11 }, "indicator_count": 130, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62bc5c43ca848271d2f1c944", "name": "New Version of Raccoon Stealer", "description": "", "modified": "2022-07-29T00:00:24.010000", "created": "2022-06-29T14:05:55.767000", "tags": [ "raccoon", "racoon", "maas", "downloads", "netwalker", "raccoon stealer", "c2 server", "winapi", "iocs", "racoon stealer", "os version", "post request", "dlls", "march", "atomic" ], "references": [ "https://socradar.io/new-version-of-raccoon-stealer-released/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Raccoon", "display_name": "Raccoon", "target": null }, { "id": "Racoon", "display_name": "Racoon", "target": null }, { "id": "Netwalker", "display_name": "Netwalker", "target": null }, { "id": "Downloads", "display_name": "Downloads", "target": null }, { "id": "MaaS", "display_name": "MaaS", "target": null } ], "attack_ids": [ { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1407", "name": "Download New Code at Runtime", "display_name": "T1407 - Download New Code at Runtime" }, { "id": "T1518", "name": "Software Discovery", "display_name": "T1518 - Software Discovery" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" }, { "id": "T1555", "name": "Credentials from Password Stores", "display_name": "T1555 - Credentials from Password Stores" }, { "id": "T1614", "name": "System Location Discovery", "display_name": "T1614 - System Location Discovery" } ], "industries": [], "TLP": "white", "cloned_from": "62bc50ab789f367c193cadad", "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tf.ransomware", "id": "119736", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 28, "FileHash-SHA1": 28, "FileHash-SHA256": 56, "domain": 11 }, "indicator_count": 130, "is_author": false, "is_subscribing": null, "subscriber_count": 87, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://ltna.com.au/cyber", "https://socradar.io/new-version-of-raccoon-stealer-released/", "Julypt1.pdf", "https://cyberint.com/blog/financial-services/raccoon-stealer/", "https://malware-filter.gitlab.io/malware-filter/phishing-filter-domains.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [ "Raccoon" ], "industries": [] }, "other": { "adversary": [ "Multiple" ], "malware_families": [ "Netwalker", "Downloads", "Raccoon", "Maas", "Racoon" ], "industries": [ "Financial", "Finance" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 41, "pulses": [ { "id": "64dca4eb3f10605dbeff12ac", "name": "Raccoon Stealer Announce Return After Hiatus", "description": "First observed in 2019 and advertised as a \u2018Malware-as-a-Service\u2019 (MaaS) threat on various cybercriminal forums, Raccoon is an information stealer targeting victim credentials and cryptocurrency wallets.", "modified": "2023-09-15T10:03:19.702000", "created": "2023-08-16T10:28:58.697000", "tags": [ "stealer", "raccoon", "infostealer" ], "references": [ "https://cyberint.com/blog/financial-services/raccoon-stealer/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Raccoon", "display_name": "Raccoon", "target": null } ], "attack_ids": [ { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 434, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlienVault", "id": "2", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png", "is_subscribed": true, "is_following": false }, "indicator_type_counts": { "URL": 7, "FileHash-MD5": 13, "FileHash-SHA1": 13, "FileHash-SHA256": 13, "domain": 10 }, "indicator_count": 56, "is_author": false, "is_subscribing": null, "subscriber_count": 386597, "modified_text": "989 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62ed397d23b4894198f2816e", "name": "DatasoftComnet-AntiSpam-Pulse1", "description": "Phishing Attempts and all malware links and URLs, IPs Hostnames", "modified": "2026-04-20T00:26:28.752000", "created": "2022-08-05T15:38:37.221000", "tags": [ "Latest", "malware", "phishing", "ransomware" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 89, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": true, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dp@datasoftcomnet.com", "id": "117672", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 80, "email": 48, "hostname": 25, "FileHash-MD5": 65, "FileHash-SHA1": 73, "FileHash-SHA256": 105, "domain": 30 }, "indicator_count": 426, "is_author": false, "is_subscribing": null, "subscriber_count": 12, "modified_text": "42 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69b033580c3323a89c21c9cf", "name": "Phishing | Mar 11, 2026 | Part 368/776", "description": "Phishing indicators. Date: Mar 11, 2026. Part 368/776. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-10T15:06:00.617000", "created": "2026-03-10T15:06:00.617000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1043, "domain": 957 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "82 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aedf92c3d19b40bd452951", "name": "Phishing | Mar 10, 2026 | Part 319/726", "description": "Phishing indicators. Date: Mar 10, 2026. Part 319/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:56:18.419000", "created": "2026-03-09T14:56:18.419000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1039, "hostname": 961 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad8c5e2e0a518de737cde0", "name": "Phishing | Mar 9, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 9, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:49:02.249000", "created": "2026-03-08T14:49:02.249000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac3b7a4799c9b819cd55ed", "name": "Phishing | Mar 8, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 8, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:51:38.148000", "created": "2026-03-07T14:51:38.148000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aae99d2b9058c066ad6357", "name": "Phishing | Mar 7, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 7, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:50:05.142000", "created": "2026-03-06T14:50:05.142000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a99d81aac5b6449c5ad77c", "name": "Phishing | Mar 6, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 6, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T15:13:05.255000", "created": "2026-03-05T15:13:05.255000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1161, "hostname": 839 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a846c8e476e2a07a79dacc", "name": "Phishing | Mar 5, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 5, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:50:48.283000", "created": "2026-03-04T14:50:48.283000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1160, "hostname": 840 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f40beb2a2a159f8494ae", "name": "Phishing | Mar 4, 2026 | Part 320/726", "description": "Phishing indicators. Date: Mar 4, 2026. Part 320/726. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:45:31.405000", "created": "2026-03-03T14:45:31.405000", "tags": [ "phishing" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1160, "hostname": 840 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "tlgr.org", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "tlgr.org", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780274581.7473352 }