{
  "type": "Domain",
  "indicator": "transip.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/transip.com",
    "alexa": "http://www.alexa.com/siteinfo/transip.com",
    "indicator": "transip.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4227507680,
      "indicator": "transip.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "69f2e121bccc56769ea096e9",
          "name": "May4-May 5th&the timestamp that lived forever",
          "description": "ILOVEYOU",
          "modified": "2026-05-31T10:27:23.455000",
          "created": "2026-04-30T04:57:05.360000",
          "tags": [
            "domain",
            "ip check",
            "http host",
            "contacted",
            "analysis date",
            "file score",
            "trojan",
            "public ip",
            "check external",
            "ip lookup",
            "virustotal"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 263,
            "FileHash-SHA1": 259,
            "FileHash-SHA256": 695,
            "hostname": 463,
            "domain": 291,
            "CVE": 5,
            "CIDR": 34,
            "URL": 536,
            "email": 62
          },
          "indicator_count": 2608,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "15 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69eb254f17eb4a2a990f07e5",
          "name": "LevelBlue - Open Threat Exchange",
          "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]",
          "modified": "2026-05-28T07:10:11.800000",
          "created": "2026-04-24T08:09:51.488000",
          "tags": [
            "pdfkit",
            "cve202225765",
            "exploit script",
            "github",
            "unicordev",
            "cves",
            "xml external",
            "entity",
            "pdfs",
            "knowledge base",
            "python",
            "mozilla",
            "virustotal",
            "cisa",
            "apple",
            "microsoft",
            "pdfkit ruby",
            "remote code",
            "execution",
            "urls",
            "malware",
            "raid",
            "caddywiper",
            "wipes",
            "cve202543529",
            "webkit",
            "february",
            "cve202620643",
            "bypass",
            "march",
            "webkit bug",
            "command",
            "control",
            "levelblue",
            "open threat"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wipes",
              "display_name": "Wipes",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1084,
            "FileHash-SHA1": 874,
            "FileHash-SHA256": 3052,
            "CVE": 36,
            "domain": 437,
            "hostname": 1086,
            "URL": 1411,
            "CIDR": 15,
            "email": 13
          },
          "indicator_count": 8008,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "3 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a01d3836a1a757aded89ba4",
          "name": "The 777 Quartz Loop: Structural Polyglot Forgery & Global Wiper Convergence",
          "description": "Malicious C2 is hidden in plain sight. Using webcontent.com (Reg. 1998), the factory mimics legitimate com.apple.WebKit.WebContent traffic. This is the permanent \"static\" that makes the Wiper indistinguishable from OS noise.C2 Anchors: ://webcontent.com, ://webcontent.comIP Nodes: 35.208.49.255, 18.208.88.157, 98.84.224.111, 3.33.251.168The \"Rose Quartz\" Structural MixA \"Frankensign\" universal bypass. It \"United\" three OS trust boundaries into a single loop:DigiCert (Windows): Forged overlay using the broken MD5 a1d6...6e72.Apple ARM (macOS): 64c/d or B0 thumbprints pivoting through WebKit/QuartzCore.Google (Drop): Execution via a Google 202 shell (GoogleUpdate.exe).The 777 AnchorThe 777 entropy pattern is the mathematical anchor forcing this messy alignment. It cannot be \"fixed\" by revocation because it is already cached in the internet's trust model.",
          "modified": "2026-05-12T08:41:44.805000",
          "created": "2026-05-11T13:02:59.167000",
          "tags": [
            "status",
            "creation date",
            "date",
            "pulse indicator",
            "url analysis",
            "passive dns",
            "urls",
            "files",
            "whois registrar",
            "related tags",
            "server",
            "domain status",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "email",
            "registrar abuse",
            "github",
            "google",
            "webcontent",
            "issue",
            "discussion",
            "safari vs",
            "cyberkit",
            "webkit port",
            "apple community",
            "clearing",
            "graph summary",
            "The Russian Doll Tactic",
            "pdfkit[.]net",
            "mathematical stalemate",
            "CLAMAV",
            "MD5/nested cert chains within"
          ],
          "references": [
            "Rec: block for *.webcontent.com and binaries matching the B0/64c/d anchors or the 777 hex-cluster.",
            "Pending Review.",
            "The 7 YARA detections identified in your analysis typically trigger on the 777-anchor hex-cluster found within the high-entropy overlay. This binary \"United\" the following trust boundaries:DigiCert (Windows): Forged overlay utilizing the broken MD5 a1d6...6e72",
            "Do Not Run",
            "The Structural Loop: The .NET framework often relies on legacy certificate validation libraries that still accept the MD5 a1d6...6e72 chain as \"legacy-valid.\" When this document is opened on an Apple Silicon device, the WebKit/ARM64 engine inherits the \"Trusted\" status from the document\u2019s container, allowing the 64c/d anchor to execute a memory-injection without a fresh signature check.",
            "Edge Node Impact: This \"sloppy\" intersection is what allows the payload to burn through edge security; the gateway sees a valid .NET structure and a valid WebKit process, failing to recognize the 777-anchor forgery that unites them.",
            "Binary Profile: The 38MB \"Big One\" ShellCompilation: August 8, 2018 [Static Layer Foundation]Packing: UPX v0.89.6 - v1.24 (Markus & Laszlo)Signatures: SHA-256: 3a23e3eb2bc7c91ccb52aaa1daf33ac78b1ace02107717ba50f27abba4aa44b0Structural Forgery: The 38,351 KB footprint is intentionally bloated with an unmapped overlay to masquerade as a legitimate system utility. This specific variation exploits the RichHash 99b5586e... to bypass heuristic whitelists.",
            "Research Suggests:",
            "The Convergence: Threat actors are exploiting a critical logic gap where .NET/PDFKit document signing (Windows-side) intersects with WebKit/QuartzCore rendering (macOS/ARM-side). By nesting a broken MD5 overlay within a document designed to be parsed by WebKit, the attacker creates a cross-platform \"trust bridge.\"",
            "This binary is a foundation-level threat designed to embed itself into the internet's cached trust model as \"static noise.\" It bridges the gap between the .NET/PDFKit and WebKit/QuartzCore environments through a triple-chain polyglot signature.",
            "Technical Indicators & Forgery MixSHA-256: 3a23e3eb2bc7c91ccb52aaa1daf33ac78b1ace02107717ba50f27abba4aa44b0MD5: a95e0f8611e4169be89ef384c8a7a71aCompilation: 2018-08-08 (The \"Static Layer\" 2020 foundation).The 777 Anchor: The 777 entropy pattern in the unmapped overlay (Size: 38,351 KB) forces the \"messy\" alignment between DigiCert, Apple ARM (64c/d), and Google 202 identities.Structural Bypass: Exploits the broken/abused MD5 a1d6...6e72 chain as a \"Frank Abagnale\" signature overlay to bypass Zero-Trust EDR.",
            "The Spy Loop: Beacons to the squatted infrastructure (*.webcontent.com) and associated IP nodes (35.208.49.255, 18.208.88.157).",
            "The Wiper: Contains the high-confidence destructive module capable of a FACTORY_RESET anti-forensic purge.",
            "The Russian Doll Tactic: The top-level 38MB SHA is just the Delivery Shell. Inside that, the malware carries encrypted blobs that have their own unique SHA-256 signatures. These are the actual Wiper, SpyNote, and C2 configuration modules.",
            "Attackers nest these SHAs so that if a vendor blocks the \"Big One\" (the 38MB shell), the internal payloads can be re-packed into a new shell with a new top-level hash in minutes."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 707,
            "URL": 1888,
            "email": 14,
            "hostname": 1443,
            "FileHash-SHA256": 1662,
            "IPv4": 198,
            "FileHash-MD5": 295,
            "FileHash-SHA1": 283,
            "Mutex": 1,
            "IPv6": 10,
            "CIDR": 1,
            "CVE": 2
          },
          "indicator_count": 6504,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "19 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ad6b274e21fb0a83dbf66e",
          "name": "CAPE Sandbox Lokibot exe process  TRANSIP",
          "description": "<viewport\" content=\"width=device-width, initial-scale=1.0\"> <meta name=\"robots\" content=\"noindex, nofollow\"> <linkrel=\"shortcuticon\"href=\"//reserved.transip.nl/assets/img/favicon.ico\" type=\"image/x-icon\" /> <link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,900' rel='stylesheet' type='text/css'> <link rel=\"stylesheet\" href=\"//reserved.transip.nl/assets/css/combined-min.css\"> <title>Bezet!</title> </head> <body> <div class=\"container\"> <div role=\"navigation\" class=\"reserved-nav-container\"> <div class=\"col-xs-6 reserved-nav-left reserved-nav-brand\"> <a href=\"https://transip.nl/\" class=\"reserved-nav-brand-link lang_nl\" rel=\"nofollow\"> <svg version=\"1.1\" id=\"transip-logo\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" xml:space=\"preserve\"> <path class=\"transip-logo-part\"9V1.8H2.9v2.9H0v2.1h2.9V13.4c0,1,0.3,2.1,1.1,2.8c0.8,0.8,2.2,1.2,4.3,1.2h1.2c2.5,0,3.8-0.5,4.6-1.301c0.7-0.801,0.8-2,0.8-3.199v-1.5h-2.3v1H12.7z",
          "modified": "2026-04-07T12:00:03.026000",
          "created": "2026-03-08T12:27:19.918000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 1,
            "hostname": 52,
            "URL": 13,
            "domain": 6,
            "CVE": 1
          },
          "indicator_count": 75,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "54 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a8bf1c40de166b01605b97",
          "name": "pdfkit.net",
          "description": "Facebook.com has been closed down because of a security breach, but its users have been able to access a link to a website set up to monitor what is going on in the UK and Ireland. <--- this text was already here when running pdfkit.net stats. Interesting.",
          "modified": "2026-04-03T23:13:53.390000",
          "created": "2026-03-04T23:24:12.962000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 200,
            "FileHash-SHA1": 200,
            "FileHash-SHA256": 800,
            "domain": 8,
            "hostname": 7,
            "URL": 9
          },
          "indicator_count": 1224,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "58 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a185462e3c17c346bcdf79",
          "name": "The Trans-Pacific Mesh & Starfield Pipeline Subversion",
          "description": "The September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirm an advanced architectural alignment targeting the Hillsboro \"Silicon Forest\" ring and the TallComponents (.NET) document pipeline. By nesting an unauthorized clientAuth extension within a legitimate Starfield (Mesh Digital) signature, the operative successfully bridged the gap between web traffic and hardware-level telematics.\nThis campaign weaponized the 159,942 Majestic Trust Flow to validate a Serial 1 SOA shadow zone, neutralizing filters while executing ASP.NET Core (Kestrel) request smuggling via the 13.32.205.51 node. This subversion is evidenced by the 60-second TTL oscillation of 3.169.202.x clusters, creating a detectable \"fast-flux\" latency at the HIO52 (Hillsboro) edge. Finally, the Mesh Digital registrant pivot to hex-encoded 34326... and 1f8f41... identifiers secures the Tallfield Pipeline\u2014a hijacked Azure-hosted backend for identity packaging of Amex and UGA credentials.",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T11:51:34.696000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 710,
            "URL": 355,
            "hostname": 252,
            "CVE": 4,
            "CIDR": 6,
            "FileHash-MD5": 615,
            "FileHash-SHA1": 585,
            "email": 21,
            "FileHash-SHA256": 4316,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 6866,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "61 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "The Wiper: Contains the high-confidence destructive module capable of a FACTORY_RESET anti-forensic purge.",
        "Binary Profile: The 38MB \"Big One\" ShellCompilation: August 8, 2018 [Static Layer Foundation]Packing: UPX v0.89.6 - v1.24 (Markus & Laszlo)Signatures: SHA-256: 3a23e3eb2bc7c91ccb52aaa1daf33ac78b1ace02107717ba50f27abba4aa44b0Structural Forgery: The 38,351 KB footprint is intentionally bloated with an unmapped overlay to masquerade as a legitimate system utility. This specific variation exploits the RichHash 99b5586e... to bypass heuristic whitelists.",
        "Pending Review.",
        "Attackers nest these SHAs so that if a vendor blocks the \"Big One\" (the 38MB shell), the internal payloads can be re-packed into a new shell with a new top-level hash in minutes.",
        "Technical Indicators & Forgery MixSHA-256: 3a23e3eb2bc7c91ccb52aaa1daf33ac78b1ace02107717ba50f27abba4aa44b0MD5: a95e0f8611e4169be89ef384c8a7a71aCompilation: 2018-08-08 (The \"Static Layer\" 2020 foundation).The 777 Anchor: The 777 entropy pattern in the unmapped overlay (Size: 38,351 KB) forces the \"messy\" alignment between DigiCert, Apple ARM (64c/d), and Google 202 identities.Structural Bypass: Exploits the broken/abused MD5 a1d6...6e72 chain as a \"Frank Abagnale\" signature overlay to bypass Zero-Trust EDR.",
        "The Convergence: Threat actors are exploiting a critical logic gap where .NET/PDFKit document signing (Windows-side) intersects with WebKit/QuartzCore rendering (macOS/ARM-side). By nesting a broken MD5 overlay within a document designed to be parsed by WebKit, the attacker creates a cross-platform \"trust bridge.\"",
        "The Russian Doll Tactic: The top-level 38MB SHA is just the Delivery Shell. Inside that, the malware carries encrypted blobs that have their own unique SHA-256 signatures. These are the actual Wiper, SpyNote, and C2 configuration modules.",
        "The Spy Loop: Beacons to the squatted infrastructure (*.webcontent.com) and associated IP nodes (35.208.49.255, 18.208.88.157).",
        "Do Not Run",
        "The Structural Loop: The .NET framework often relies on legacy certificate validation libraries that still accept the MD5 a1d6...6e72 chain as \"legacy-valid.\" When this document is opened on an Apple Silicon device, the WebKit/ARM64 engine inherits the \"Trusted\" status from the document\u2019s container, allowing the 64c/d anchor to execute a memory-injection without a fresh signature check.",
        "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters.",
        "Edge Node Impact: This \"sloppy\" intersection is what allows the payload to burn through edge security; the gateway sees a valid .NET structure and a valid WebKit process, failing to recognize the 777-anchor forgery that unites them.",
        "Rec: block for *.webcontent.com and binaries matching the B0/64c/d anchors or the 777 hex-cluster.",
        "This binary is a foundation-level threat designed to embed itself into the internet's cached trust model as \"static noise.\" It bridges the gap between the .NET/PDFKit and WebKit/QuartzCore environments through a triple-chain polyglot signature.",
        "Research Suggests:",
        "The 7 YARA detections identified in your analysis typically trigger on the 777-anchor hex-cluster found within the high-entropy overlay. This binary \"United\" the following trust boundaries:DigiCert (Windows): Forged overlay utilizing the broken MD5 a1d6...6e72"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Wipes"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "69f2e121bccc56769ea096e9",
      "name": "May4-May 5th&the timestamp that lived forever",
      "description": "ILOVEYOU",
      "modified": "2026-05-31T10:27:23.455000",
      "created": "2026-04-30T04:57:05.360000",
      "tags": [
        "domain",
        "ip check",
        "http host",
        "contacted",
        "analysis date",
        "file score",
        "trojan",
        "public ip",
        "check external",
        "ip lookup",
        "virustotal"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 263,
        "FileHash-SHA1": 259,
        "FileHash-SHA256": 695,
        "hostname": 463,
        "domain": 291,
        "CVE": 5,
        "CIDR": 34,
        "URL": 536,
        "email": 62
      },
      "indicator_count": 2608,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "15 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69eb254f17eb4a2a990f07e5",
      "name": "LevelBlue - Open Threat Exchange",
      "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]",
      "modified": "2026-05-28T07:10:11.800000",
      "created": "2026-04-24T08:09:51.488000",
      "tags": [
        "pdfkit",
        "cve202225765",
        "exploit script",
        "github",
        "unicordev",
        "cves",
        "xml external",
        "entity",
        "pdfs",
        "knowledge base",
        "python",
        "mozilla",
        "virustotal",
        "cisa",
        "apple",
        "microsoft",
        "pdfkit ruby",
        "remote code",
        "execution",
        "urls",
        "malware",
        "raid",
        "caddywiper",
        "wipes",
        "cve202543529",
        "webkit",
        "february",
        "cve202620643",
        "bypass",
        "march",
        "webkit bug",
        "command",
        "control",
        "levelblue",
        "open threat"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wipes",
          "display_name": "Wipes",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1084,
        "FileHash-SHA1": 874,
        "FileHash-SHA256": 3052,
        "CVE": 36,
        "domain": 437,
        "hostname": 1086,
        "URL": 1411,
        "CIDR": 15,
        "email": 13
      },
      "indicator_count": 8008,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 70,
      "modified_text": "3 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a01d3836a1a757aded89ba4",
      "name": "The 777 Quartz Loop: Structural Polyglot Forgery & Global Wiper Convergence",
      "description": "Malicious C2 is hidden in plain sight. Using webcontent.com (Reg. 1998), the factory mimics legitimate com.apple.WebKit.WebContent traffic. This is the permanent \"static\" that makes the Wiper indistinguishable from OS noise.C2 Anchors: ://webcontent.com, ://webcontent.comIP Nodes: 35.208.49.255, 18.208.88.157, 98.84.224.111, 3.33.251.168The \"Rose Quartz\" Structural MixA \"Frankensign\" universal bypass. It \"United\" three OS trust boundaries into a single loop:DigiCert (Windows): Forged overlay using the broken MD5 a1d6...6e72.Apple ARM (macOS): 64c/d or B0 thumbprints pivoting through WebKit/QuartzCore.Google (Drop): Execution via a Google 202 shell (GoogleUpdate.exe).The 777 AnchorThe 777 entropy pattern is the mathematical anchor forcing this messy alignment. It cannot be \"fixed\" by revocation because it is already cached in the internet's trust model.",
      "modified": "2026-05-12T08:41:44.805000",
      "created": "2026-05-11T13:02:59.167000",
      "tags": [
        "status",
        "creation date",
        "date",
        "pulse indicator",
        "url analysis",
        "passive dns",
        "urls",
        "files",
        "whois registrar",
        "related tags",
        "server",
        "domain status",
        "whois lookup",
        "dnssec",
        "domain name",
        "abuse contact",
        "email",
        "registrar abuse",
        "github",
        "google",
        "webcontent",
        "issue",
        "discussion",
        "safari vs",
        "cyberkit",
        "webkit port",
        "apple community",
        "clearing",
        "graph summary",
        "The Russian Doll Tactic",
        "pdfkit[.]net",
        "mathematical stalemate",
        "CLAMAV",
        "MD5/nested cert chains within"
      ],
      "references": [
        "Rec: block for *.webcontent.com and binaries matching the B0/64c/d anchors or the 777 hex-cluster.",
        "Pending Review.",
        "The 7 YARA detections identified in your analysis typically trigger on the 777-anchor hex-cluster found within the high-entropy overlay. This binary \"United\" the following trust boundaries:DigiCert (Windows): Forged overlay utilizing the broken MD5 a1d6...6e72",
        "Do Not Run",
        "The Structural Loop: The .NET framework often relies on legacy certificate validation libraries that still accept the MD5 a1d6...6e72 chain as \"legacy-valid.\" When this document is opened on an Apple Silicon device, the WebKit/ARM64 engine inherits the \"Trusted\" status from the document\u2019s container, allowing the 64c/d anchor to execute a memory-injection without a fresh signature check.",
        "Edge Node Impact: This \"sloppy\" intersection is what allows the payload to burn through edge security; the gateway sees a valid .NET structure and a valid WebKit process, failing to recognize the 777-anchor forgery that unites them.",
        "Binary Profile: The 38MB \"Big One\" ShellCompilation: August 8, 2018 [Static Layer Foundation]Packing: UPX v0.89.6 - v1.24 (Markus & Laszlo)Signatures: SHA-256: 3a23e3eb2bc7c91ccb52aaa1daf33ac78b1ace02107717ba50f27abba4aa44b0Structural Forgery: The 38,351 KB footprint is intentionally bloated with an unmapped overlay to masquerade as a legitimate system utility. This specific variation exploits the RichHash 99b5586e... to bypass heuristic whitelists.",
        "Research Suggests:",
        "The Convergence: Threat actors are exploiting a critical logic gap where .NET/PDFKit document signing (Windows-side) intersects with WebKit/QuartzCore rendering (macOS/ARM-side). By nesting a broken MD5 overlay within a document designed to be parsed by WebKit, the attacker creates a cross-platform \"trust bridge.\"",
        "This binary is a foundation-level threat designed to embed itself into the internet's cached trust model as \"static noise.\" It bridges the gap between the .NET/PDFKit and WebKit/QuartzCore environments through a triple-chain polyglot signature.",
        "Technical Indicators & Forgery MixSHA-256: 3a23e3eb2bc7c91ccb52aaa1daf33ac78b1ace02107717ba50f27abba4aa44b0MD5: a95e0f8611e4169be89ef384c8a7a71aCompilation: 2018-08-08 (The \"Static Layer\" 2020 foundation).The 777 Anchor: The 777 entropy pattern in the unmapped overlay (Size: 38,351 KB) forces the \"messy\" alignment between DigiCert, Apple ARM (64c/d), and Google 202 identities.Structural Bypass: Exploits the broken/abused MD5 a1d6...6e72 chain as a \"Frank Abagnale\" signature overlay to bypass Zero-Trust EDR.",
        "The Spy Loop: Beacons to the squatted infrastructure (*.webcontent.com) and associated IP nodes (35.208.49.255, 18.208.88.157).",
        "The Wiper: Contains the high-confidence destructive module capable of a FACTORY_RESET anti-forensic purge.",
        "The Russian Doll Tactic: The top-level 38MB SHA is just the Delivery Shell. Inside that, the malware carries encrypted blobs that have their own unique SHA-256 signatures. These are the actual Wiper, SpyNote, and C2 configuration modules.",
        "Attackers nest these SHAs so that if a vendor blocks the \"Big One\" (the 38MB shell), the internal payloads can be re-packed into a new shell with a new top-level hash in minutes."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 707,
        "URL": 1888,
        "email": 14,
        "hostname": 1443,
        "FileHash-SHA256": 1662,
        "IPv4": 198,
        "FileHash-MD5": 295,
        "FileHash-SHA1": 283,
        "Mutex": 1,
        "IPv6": 10,
        "CIDR": 1,
        "CVE": 2
      },
      "indicator_count": 6504,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "19 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ad6b274e21fb0a83dbf66e",
      "name": "CAPE Sandbox Lokibot exe process  TRANSIP",
      "description": "<viewport\" content=\"width=device-width, initial-scale=1.0\"> <meta name=\"robots\" content=\"noindex, nofollow\"> <linkrel=\"shortcuticon\"href=\"//reserved.transip.nl/assets/img/favicon.ico\" type=\"image/x-icon\" /> <link href='https://fonts.googleapis.com/css?family=Source+Sans+Pro:400,900' rel='stylesheet' type='text/css'> <link rel=\"stylesheet\" href=\"//reserved.transip.nl/assets/css/combined-min.css\"> <title>Bezet!</title> </head> <body> <div class=\"container\"> <div role=\"navigation\" class=\"reserved-nav-container\"> <div class=\"col-xs-6 reserved-nav-left reserved-nav-brand\"> <a href=\"https://transip.nl/\" class=\"reserved-nav-brand-link lang_nl\" rel=\"nofollow\"> <svg version=\"1.1\" id=\"transip-logo\" xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" xml:space=\"preserve\"> <path class=\"transip-logo-part\"9V1.8H2.9v2.9H0v2.1h2.9V13.4c0,1,0.3,2.1,1.1,2.8c0.8,0.8,2.2,1.2,4.3,1.2h1.2c2.5,0,3.8-0.5,4.6-1.301c0.7-0.801,0.8-2,0.8-3.199v-1.5h-2.3v1H12.7z",
      "modified": "2026-04-07T12:00:03.026000",
      "created": "2026-03-08T12:27:19.918000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 1,
        "hostname": 52,
        "URL": 13,
        "domain": 6,
        "CVE": 1
      },
      "indicator_count": 75,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "54 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a8bf1c40de166b01605b97",
      "name": "pdfkit.net",
      "description": "Facebook.com has been closed down because of a security breach, but its users have been able to access a link to a website set up to monitor what is going on in the UK and Ireland. <--- this text was already here when running pdfkit.net stats. Interesting.",
      "modified": "2026-04-03T23:13:53.390000",
      "created": "2026-03-04T23:24:12.962000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 200,
        "FileHash-SHA1": 200,
        "FileHash-SHA256": 800,
        "domain": 8,
        "hostname": 7,
        "URL": 9
      },
      "indicator_count": 1224,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "58 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a185462e3c17c346bcdf79",
      "name": "The Trans-Pacific Mesh & Starfield Pipeline Subversion",
      "description": "The September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirm an advanced architectural alignment targeting the Hillsboro \"Silicon Forest\" ring and the TallComponents (.NET) document pipeline. By nesting an unauthorized clientAuth extension within a legitimate Starfield (Mesh Digital) signature, the operative successfully bridged the gap between web traffic and hardware-level telematics.\nThis campaign weaponized the 159,942 Majestic Trust Flow to validate a Serial 1 SOA shadow zone, neutralizing filters while executing ASP.NET Core (Kestrel) request smuggling via the 13.32.205.51 node. This subversion is evidenced by the 60-second TTL oscillation of 3.169.202.x clusters, creating a detectable \"fast-flux\" latency at the HIO52 (Hillsboro) edge. Finally, the Mesh Digital registrant pivot to hex-encoded 34326... and 1f8f41... identifiers secures the Tallfield Pipeline\u2014a hijacked Azure-hosted backend for identity packaging of Amex and UGA credentials.",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-02-27T11:51:34.696000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 710,
        "URL": 355,
        "hostname": 252,
        "CVE": 4,
        "CIDR": 6,
        "FileHash-MD5": 615,
        "FileHash-SHA1": 585,
        "email": 21,
        "FileHash-SHA256": 4316,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 6866,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "61 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "transip.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "transip.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780278738.2547376
}