{ "type": "Domain", "indicator": "v.fail", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/v.fail", "alexa": "http://www.alexa.com/siteinfo/v.fail", "indicator": "v.fail", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2701644966, "indicator": "v.fail", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 27, "pulses": [ { "id": "65708e0d95a8c74cc715f7a2", "name": "West.cn", "description": "", "modified": "2023-12-06T15:06:53.350000", "created": "2023-12-06T15:06:53.350000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 208, "domain": 533, "hostname": 757, "URL": 1861, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708c8f50527fb73205bfca", "name": "Dreamhost.com - Drift Widget", "description": "", "modified": "2023-12-06T15:00:31.809000", "created": "2023-12-06T15:00:31.809000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 174, "domain": 464, "URL": 1119, "hostname": 156, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 1916, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708c5b24dc4c51811f6de7", "name": "nocix malware Qe", "description": "", "modified": "2023-12-06T14:59:39.528000", "created": "2023-12-06T14:59:39.528000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 125, "hostname": 507, "URL": 1232, "domain": 170, "FileHash-MD5": 1 }, "indicator_count": 2035, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708bf87a08635a650eeb9b", "name": "ctgserver.net", "description": "", "modified": "2023-12-06T14:58:00.096000", "created": "2023-12-06T14:58:00.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1286, "domain": 560, "hostname": 1602, "URL": 7975, "FileHash-MD5": 85, "FileHash-SHA1": 1 }, "indicator_count": 11509, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708befc4f4c7e2be4370d9", "name": "ctgserver.net", "description": "", "modified": "2023-12-06T14:57:51.922000", "created": "2023-12-06T14:57:51.922000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1286, "domain": 560, "hostname": 1602, "URL": 7975, "FileHash-MD5": 85, "FileHash-SHA1": 1 }, "indicator_count": 11509, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708bae2f0c59d34f050b9e", "name": "Malware and bots", "description": "", "modified": "2023-12-06T14:56:46.779000", "created": "2023-12-06T14:56:46.779000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 168, "hostname": 427, "domain": 214, "URL": 1188, "FileHash-MD5": 1, "FileHash-SHA1": 1, "email": 1 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708b7bb1d8a5ad0edc6615", "name": "Lh , ReduceRight Malware", "description": "", "modified": "2023-12-06T14:55:55.190000", "created": "2023-12-06T14:55:55.190000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 167, "domain": 249, "URL": 1152, "hostname": 391, "FileHash-MD5": 45 }, "indicator_count": 2004, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707fe17dfdfe16066d16de", "name": "Bexar.org", "description": "", "modified": "2023-12-06T14:06:25.800000", "created": "2023-12-06T14:06:25.800000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1735, "hostname": 1833, "domain": 1025, "URL": 4668, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9409, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628ce74526894454664e1bab", "name": "cloudron.io", "description": "function ar(aw,av,au,at) is a new version of the Matomo tracker, which allows users to track where a tracker has been located, and when it is activated.", "modified": "2022-06-23T00:03:28.624000", "created": "2022-05-24T14:10:13.562000", "tags": [ "span", "type", "href", "tbody", "tfoot", "thead", "input", "helvetica neue", "helvetica", "arial", "twitter", "date", "docviewtop", "shadow", "rocketchat", "sogo", "gitlab", "wordpress", "matomo", "kanboard", "taiga", "ninja", "slow", "scroll", "dom exception", "google", "regexp", "mmm d", "mmmm d", "null", "this", "number", "destroy", "controller", "array", "error", "android", "false", "function", "index", "slickcenter", "slick", "object", "translate", "translate3d", "jquery", "typeof c", "copyright", "bootstrap", "javascript", "azaz", "popover", "typeof f", "typeof b", "width", "pseudo", "child", "sufeffxa0", "class", "accept", "string", "please", "blob", "post", "link", "license" ], "references": [ "https://analytics.cloudron.io/piwik.js", "https://www.cloudron.io/3rdparty/jquery-1.11.0.js", "https://www.cloudron.io/3rdparty/bootstrap.min.js", "https://www.cloudron.io/3rdparty/slick.js", "https://www.cloudron.io/3rdparty/angular.min.js", "https://www.cloudron.io/3rdparty/angular-loader.min.js", "https://www.cloudron.io/3rdparty/angular-route.min.js", "https://www.cloudron.io/3rdparty/angular-base64.min.js", "https://www.cloudron.io/index.js", "https://www.cloudron.io/3rdparty/bootstrap.min.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 541, "URL": 1300, "domain": 180, "FileHash-SHA256": 72, "FileHash-SHA1": 1 }, "indicator_count": 2094, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1441 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6280398780fbe64692dd54fd", "name": "West.cn", "description": "If you want to know more about Shockwave Flash, spare a thought for the members of your own storage system:mt.co.g.o.mimeTypes.com, mime", "modified": "2022-06-13T00:00:32.864000", "created": "2022-05-14T23:21:43.936000", "tags": [ "jquery", "date", "vue jquery", "template", "layer", "paas", "dist", "wjf3m", "ajax", "business", "string", "number", "regexp", "copyright", "uint8array", "fnumber", "aw1045757556", "closure library", "xdfunction", "code", "ddos", "image", "script", "document", "unescape", "msie", "canvas", "domain", "click", "input", "label", "jdomname", "strong", "jactive15toast", "jclearinput", "case", "datatarget", "jdomainregcount", "span", "function", "x786e", "x53d6", "cite", "x4fe1", "iframe", "null", "prompt", "x6700", "x591a", "array", "numarray", "data", "midsize", "action", "keyword", "firstfix", "object", "5n3j", "3f4r", "5p3s", "1f5m", "hhe2", "bbf2", "3y3z", "1223", "6q6m", "zfunction", "psettimeout", "tsettimeout", "hsetinterval", "iparseint", "hnull", "pnull", "tnull", "lv1s", "efunction", "typeof t", "typeof e", "adobeedge", "typeof r", "webkittransform", "moztransform", "body", "this", "notifier", "invert", "name", "param", "value", "error", "false", "trigger", "restart", "form", "config", "constants", "true", "modalhelper", "relative", "fixed", "account login", "activexobject", "haslocation", "xmlhttprequest", "xmlregexp", "temp", "extpart", "foundation", "mit license", "write", "rhino", "mark", "import", "classnamedom", "onbeforedestroy", "login", "auto", "init", "typeof b", "width", "pseudo", "child", "enulle", "class", "accept", "shockwave flash", "new date1e3", "ka6e5", "la10" ], "references": [ "xfe-IP-103.24.249.209-stix2-2.1-export.json", "xfe-URL-West.cn-stix2-2.1-export.json", "https://m.west.cn/jscripts/baidutj/hm.js", "http://m.west.cn/jscripts/baidutj/hm.js", "https://www.west.cn/js2016/lib/jquery.SuperSlide/jquery.SuperSlide.2.1.1.x.js", "https://www.west.cn/js2016/root/jqinclude.js?t=20211126a", "https://www.googletagmanager.com/gtag/js?id=AW-1045757556" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 533, "URL": 1861, "hostname": 757, "FileHash-SHA256": 208, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1451 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6271740be1d2d55007677274", "name": "Fiberhub.com and versaweb.com", "description": "The following is the full text of the code used to create Twitter's new web-based \"bootstrap\" - a guide to what to do if you want to use it in your browser.", "modified": "2022-06-02T00:03:59.540000", "created": "2022-05-03T18:27:23.636000", "tags": [ "html5 shiv", "jdalton", "jonneal", "mitgpl2", "typeof c", "typeof module", "null", "plugin", "function", "copyright", "twitter", "bootstrap", "http", "conflict", "focus", "object", "error", "click", "open", "next", "target", "trigger", "config", "checkbox", "delta", "false", "scroll", "vd", "number", "string", "ienew ca", "date", "closure library", "quota", "aafunction", "dafunction", "fbcd", "328373057580084", "prop", "init", "autoconfig", "protocol", "adnxsdomain", "aoldomain", "adrolltpc", "regexp", "typeof b", "pseudo", "child", "array", "width", "sufeffxa0", "class", "accept", "please", "chat", "search", "language", "feel", "file", "call", "strongstart", "address", "again" ], "references": [ "xfe-IP-76.164.203.68-stix2-2.1-export.json", "http://www.versaweb.com/js/bootstrap.js", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "http://www.versaweb.com/css/1024.css", "https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js", "https://d.adroll.com/pixel/LZLVHVDGLRC6BEJRRIQDVW/HBKRUDDSQJCU7GD5KH3RWC?adroll_fpc=fd1d5ad32fd771b6d89af530ec6ca1cf-1651601137287&arrfrr=http%3A%2F%2Fwww.versaweb.com%2F&pv=14491019928.1296&cookie=&adroll_s_ref=&keyw=", "https://d.adroll.com/consent/check/LZLVHVDGLRC6BEJRRIQDVW?arrfrr=http%3A%2F%2Fwww.versaweb.com%2F&_s=1b87c8c5132a03372125d888e43b0a86&_b=2", "https://s.adroll.com/j/exp/LZLVHVDGLRC6BEJRRIQDVW/index.js", "xfe-URL-versaweb.com-stix2-2.1-export.json", "xfe-URL-fiberhub.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=UA-33008870-1", "https://www.fiberhub.com/js/bootstrap.js", "https://cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Vd", "display_name": "Vd", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 590, "URL": 1312, "domain": 376, "FileHash-SHA256": 203 }, "indicator_count": 2481, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1462 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "626a8a564da0d5b27dc02619", "name": "App By Web", "description": "Israeli malware hosting", "modified": "2022-05-28T00:03:46.141000", "created": "2022-04-28T12:36:38.103000", "tags": [ "hebrew", "truetype", "woff2", "woff", "body", "fh5cooffcanvas", "function", "click", "main menu", "superfish var", "parallax", "offcanvas", "mobile menu", "animations var", "mstouchaction", "superfish menu", "plugin", "copyright", "joel birch", "dual", "fill", "touchaction", "y position", "hoverintent", "brian cherne", "param", "threshold", "mit license", "or selector", "author", "1parseint", "mark dalgleish", "http", "webkitopacity", "webkit", "khtmlopacity", "khtml", "typeof d", "error", "this", "caleb troughton", "typeof f", "adapter", "bootstrap", "javascript", "typeof c", "twitter", "focus", "azaz", "including", "this software", "but not", "limited to", "terms of", "open", "bsd license", "redistribution", "redistributions", "neither", "direct", "gc", "regexp", "typeof b", "pseudo", "child", "array", "width", "sufeffxa0", "class", "null", "date", "accept", "boolean", "modernizr", "custom build", "build", "afunction", "cfunction", "typeerror", "object", "documenttouch", "websocket", "string", "silk", "script", "arial", "edge", "iframe", "promise", "void", "android", "trident", "embed", "meta", "roboto", "term", "\u05d4\u05d6\u05de\u05e0\u05ea \u05de\u05d5\u05e0\u05d9\u05ea", "wtaxi", "wapp", "app by web ltd", "03-5115656", "03-5109109", "+97235115656", "\u05de\u05e2\u05e8\u05db\u05d5\u05ea \u05d4\u05e1\u05e2\u05d9\u05dd", "\u05db\u05e8\u05d8\u05d9\u05e1 \u05d0\u05e9\u05e8\u05d0\u05d9 \u05d1\u05de\u05d5\u05e0\u05d9\u05ea", "web ltd", "reserved" ], "references": [ "xfe-URL-appbyweb.net-stix2-2.1-export.json", "http://appbyweb.net/AppByWeb", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "http://appbyweb.net/AppByWeb/js/superfish.js", "http://appbyweb.net/AppByWeb/js/main.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Gc", "display_name": "Gc", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1554, "hostname": 533, "domain": 211, "FileHash-SHA256": 199 }, "indicator_count": 2497, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1467 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62676c65b80720b582b46037", "name": "Dreamhost.com - Drift Widget", "description": "function.1, a new version of JavaScript, has been added to the end of the year to make it easier for users to keep up with the latest developments in the search for a specific date.", "modified": "2022-05-25T00:04:03.622000", "created": "2022-04-26T03:52:05.599000", "tags": [ "template7class", "regexp", "root", "context", "match", "body", "template7", "error", "prop", "function", "date", "null", "slice", "void", "factory", "window", "find", "simple", "false", "hj", "object", "hotjar", "email", "typeof symbol", "typeof e", "telefon", "array", "survey", "meta", "cookie", "scroll", "keypress", "trident", "live", "fullscreen", "generic", "widget", "ciudad", "adore", "experiment", "mutation", "click", "pluginname", "hidden", "nttt", "fieldset", "class", "form", "fast", "jquery", "format", "february", "april", "june", "august", "nova", "paris", "tokyo", "easy", "speed", "back", "target", "copy", "kill", "this", "infinity", "accept", "locale", "custom build", "https", "boolean", "new boolean", "typeof", "typeerror", "bootstrap", "typeof t", "javascript", "show", "drift widget", "segoe ui", "emoji", "type", "copyright", "browse", "roboto", "helvetica neue", "arial", "noto", "apple color", "twitter", "typeof require", "modulenotfound", "font awesome", "typeof define", "script", "new date", "number", "trackevent", "string", "watched", "search", "clicked", "path", "starter", "download", "derek", "code", "esnull", "gtmphvk7ln", "closure library", "xdfunction", "reduceright", "vd", "g1f7wlmm0k2", "r420", "uint8array", "typeof d", "ieproto", "typeof n", "widgetrootqa", "driftconductor" ], "references": [ "xfe-URL-Dreamhost.com-stix2-2.1-export.json", "https://js.driftt.com/include/1650944100000/2y43hyefanc8.js", "https://www.google-analytics.com/plugins/ua/linkid.js", "https://www.googletagmanager.com/gtag/js?id=G-1F7WLMM0K2&l=dataLayer&cx=c", "https://www.google-analytics.com/gtm/optimize.js?id=GTM-PHVK7LN", "https://www.googletagmanager.com/gtm.js?id=GTM-TLN654", "https://kit.fontawesome.com/7d998cc9b7.js", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://www.dreamhost.com/assets/bootstrap-aa47564acfdf18ce859b8e1fd130d889920ae66415b3db4de8505d42a0477b09.css", "https://js.driftt.com/core?embedId=2y43hyefanc8®ion=US&forceShow=false&skipCampaigns=false&sessionId=5a8c1b8d-2626-4a43-a7a6-76e9416f2f52&sessionStarted=1650943819.009&campaignRefreshToken=a2d9846a-8932-4e3c-a8d5-878681a555e0&hideController=false&pageLoadStartTime=1650943817154&mode=CHAT&driftEnableLog=false", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650943817154", "https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html", "https://www.dreamhost.com/assets/scripts/bootstrap-7670fc8587f9fd0608d2af67f392281a9a4fbf4cb4252952ecb8d34f6ee286b3.js", "https://www.dreamhost.com/assets/scripts/webp-support-1dd791309dc3fa5b166a0a326e49345fe5acb5acbc1831f4c7be87efce1abf51.js", "https://www.dreamhost.com/assets/site-75a1aba399db4de4e4093997b8fc8ff8ec5e65b5f4258c9a658a5cacacbf6e0d.js", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://cdn.abrankings.com/js/client.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "hj", "display_name": "hj", "target": null }, { "id": "Vd", "display_name": "Vd", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 174, "URL": 1119, "domain": 464, "hostname": 156, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 1916, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1470 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6262fc8eadd28fedcc1f00f0", "name": "RoLR: Stichting Registrar of Last Resort Foundation", "description": "Regulator of Last Resort (RoLR) has announced that it has incorporated into the European Union (EU) and will begin registering domains in the next few weeks, with the aim of providing a range of services.", "modified": "2022-05-22T00:01:01.264000", "created": "2022-04-22T19:05:50.548000", "tags": [ "regexp", "function", "typeof b", "error", "width", "pseudo", "child", "null", "array", "sufeffxa0", "date", "class", "accept", "rolr", "registrar", "welcome", "eu corporation", "icann", "whois lookup" ], "references": [ "xfe-URL-netsol.com-stix2-2.1-export.json", "https://www.rolr.eu/", "http://www.rolr.eu/js/jquery.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 498, "URL": 1105, "domain": 179, "FileHash-SHA256": 23 }, "indicator_count": 1805, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1473 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62618afdab12239895b96788", "name": "nocix malware Qe", "description": "\u00c2\u00a31.5m, \u00e2\u201a\u00ac2.4m \u00c3\u20ac\u00a6, is the source of a new version of the JavaScript code, which is being developed by the Apache web browser.", "modified": "2022-05-21T00:03:44.725000", "created": "2022-04-21T16:49:01.885000", "tags": [ "font awesome", "license", "font", "sil ofl", "mit license", "woff2", "woff", "truetype", "fontawesome", "typeof e", "typeof symbol", "regexp", "hotjar", "typeof hj", "surveyv2", "surveyisolated", "heatmapviewer", "notification", "sentry", "number", "aa6060", "ui function", "e0e0e0", "eeeeee", "code for", "gauges function", "ui code", "abort", "worker", "allow", "body", "oldvalue", "transtion type", "datafield", "name", "minus", "plus", "ctrla", "click", "function", "error", "bootstrap", "javascript", "typeof c", "copyright", "twitter", "focus", "azaz", "typeof b", "width", "pseudo", "child", "null", "array", "sufeffxa0", "date", "class", "accept", "qe", "string", "uint8array", "fnumber", "xhfunction", "yhfunction", "aw701859743", "code", "closure library", "pfunction", "contenttype", "zfunction", "bfunction", "mvoid", "ofunction", "script", "typeerror", "symbol", "array int8array", "caregexp", "legacy" ], "references": [ "xfe-URL-Nocix.net-stix2-2.1-export.json", "https://www.googleadservices.com/pagead/conversion_async.js", "https://www.google-analytics.com/analytics.js", "https://www.googletagmanager.com/gtag/js?id=AW-701859743", "https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js", "https://www.nocix.net/js/bootstrap.min.js", "https://www.nocix.net/js/nocix.js", "https://www.nocix.net/speedtest/speedtest.js?r=4343", "https://static.hotjar.com/c/hotjar-596666.js?sv=5", "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Qe", "display_name": "Qe", "target": null } ], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 507, "URL": 1232, "domain": 170, "FileHash-SHA256": 125, "FileHash-MD5": 1 }, "indicator_count": 2035, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1474 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62608b1b8d323a111026565a", "name": "Malware hosting - freebit.com freebit.net", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=v, v.b, and b.d(d) for all of its value.", "modified": "2022-05-20T00:01:19.453000", "created": "2022-04-20T22:37:15.955000", "tags": [ "getstate", "filter", "regexp", "function", "typeof b", "error", "null", "width", "pseudo", "child", "array", "sufeffxa0", "date", "class", "accept", "woff2", "fontface", "u1c801c88", "u20b4", "u2de02dff", "ua640a69f", "ufe2efe2f", "u04b004b1", "u2116", "u1ea01ef9", "e9edee", "ea3d31", "45deg", "import", "fontawesome", "html", "pron w3", "hiragino kaku", "gothic pron", "meiryo", "ir side", "menu", "hidden", "select", "click", "mspointerdown", "list", "grid", "changelayout", "40deg", "100px", "logrid", "lolist", "mstransitionend", "xfunction", "bxslider", "copyright", "written", "mit license", "next", "prev", "start", "stop", "section", "alert", "author", "link", "license", "commercial use", "noncommercial", "ccbync license", "targetsbound0", "targetsdone0" ], "references": [ "http://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js", "xfe-URL-freebit.com-stix2-2.1-export.json", "xfe-URL-Freebit.net-stix2-2.1-export.json", "http://freebit.com/common/js/jquery.mixitup.min.js", "http://freebit.com/common/js/slide.js", "http://freebit.com/common/js/jquery.bxslider.min.js", "http://freebit.com/common/js/variablelist_top.js?v=2", "http://freebit.com/common/js/function.js", "http://freebit.com/common/css/reset.css", "http://freebit.com/common/css/common.css", "http://freebit.com/common/css/top.css", "http://freebit.com/topnews.css", "https://fonts.googleapis.com/css2?family=Montserrat:wght@500;600;700&display=swap" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 187, "URL": 1132, "hostname": 428, "FileHash-SHA256": 40 }, "indicator_count": 1787, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1475 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "625effa1c4edcef37385c4eb", "name": "ctgserver.net", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T18:29:53.960000", "tags": [ "0x1d3c", "function", "json", "date", "0x3abb84", "0x400e43", "0x4e2be0", "0x27ecdf", "this", "0x217f25", "webview", "array", "typeof e", "regexp", "null", "object", "string", "post", "typeof r", "error", "android", "void", "math", "k3wc3w", "o4wo4w", "b0z1", "a4r1", "b2bbbb", "o5r1", "image", "typeof s", "typeof console", "contenttype", "number", "60number", "new date", "close", "sector", "typeof symbol", "crispclient", "crisp im", "typeof b", "width", "pseudo", "child", "sufeffxa0", "class", "accept" ], "references": [ "http://v1-ab.cdn-static.cn/editor/js/jquery.min.js", "https://client.crisp.chat/l.js", "http://www.ctgserver.net/zhuzi-statistic.js?path=http%3a%2f%2fwww.ctgserver.net%2f&siteid=68944&referer=", "http://sgoutong.baidu.com/embed/1649840755/asset/embed/mobilelite/main.js", "https://aiff.cdn.bcebos.com/sensors%2Fonline%2Fsa-sdk-javascript-1.14.24%2Fsensorsdata.min.js", "https://goutong.baidu.com/site/889/a8439b4fa4b46ae6d1cb7840806b342d/b.js?siteId=12877102", "http://push.zhanzhang.baidu.com/push.js", "http://api.geetest.com/gettype.php?gt=70bfe290f45725d99fae0063c5188b8f&callback=geetest_1650391760798", "http://static.geetest.com/static/js/geetest.6.0.9.js", "http://api.geetest.com/get.php?gt=70bfe290f45725d99fae0063c5188b8f&challenge=36bbdc68ea2e3279d57269471b837a6b&product=popup&width=301px&offline=false&lang=zh-cn&protocol=http://&type=slide&path=/static/js/geetest.6.0.9.js&callback=geetest_1650391756575", "http://sgoutong.baidu.com/embed/1649840755/asset/embed/mobile_nb.js", "https://sofire.bdstatic.com/js/dfxaf.js", "https://p.qiao.baidu.com/cps3/site/poll?cb=jsonp_bridge_1650392095190_21922384256393768&l=1&sign=&v=165039175860477407&s=12877102&e=26958486&isAFF=1&filterAdvertisement=1&dev=1&auth=%7B%22anonym%22%3A0%2C%22key%22%3A%223bfef1eb-bde9-4fbf-ba96-abad738f1775%22%2C%22sn%22%3A%22%22%2C%22id%22%3A%22165039175860477407%22%2C%22from%22%3A4%2C%22token%22%3A%22bridge%22%7D&_time=1650392095190", "http://www.zhuzi.me/zhuzi-statistic.js?path=http%3a%2f%2fwww.zhuzi.me%2f&siteid=62221&referer=", "xfe-URL-Zhuzi.me-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7975, "FileHash-SHA256": 1286, "hostname": 1602, "domain": 560, "FileHash-MD5": 85, "FileHash-SHA1": 1 }, "indicator_count": 11509, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1476 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "625eff927c93e3e5cd50e191", "name": "ctgserver.net", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.", "modified": "2022-05-19T00:00:49.028000", "created": "2022-04-19T18:29:38.810000", "tags": [ "0x1d3c", "function", "json", "date", "0x3abb84", "0x400e43", "0x4e2be0", "0x27ecdf", "this", "0x217f25", "webview", "array", "typeof e", "regexp", "null", "object", "string", "post", "typeof r", "error", "android", "void", "math", "k3wc3w", "o4wo4w", "b0z1", "a4r1", "b2bbbb", "o5r1", "image", "typeof s", "typeof console", "contenttype", "number", "60number", "new date", "close", "sector", "typeof symbol", "crispclient", "crisp im", "typeof b", "width", "pseudo", "child", "sufeffxa0", "class", "accept" ], "references": [ "http://v1-ab.cdn-static.cn/editor/js/jquery.min.js", "https://client.crisp.chat/l.js", "http://www.ctgserver.net/zhuzi-statistic.js?path=http%3a%2f%2fwww.ctgserver.net%2f&siteid=68944&referer=", "http://sgoutong.baidu.com/embed/1649840755/asset/embed/mobilelite/main.js", "https://aiff.cdn.bcebos.com/sensors%2Fonline%2Fsa-sdk-javascript-1.14.24%2Fsensorsdata.min.js", "https://goutong.baidu.com/site/889/a8439b4fa4b46ae6d1cb7840806b342d/b.js?siteId=12877102", "http://push.zhanzhang.baidu.com/push.js", "http://api.geetest.com/gettype.php?gt=70bfe290f45725d99fae0063c5188b8f&callback=geetest_1650391760798", "http://static.geetest.com/static/js/geetest.6.0.9.js", "http://api.geetest.com/get.php?gt=70bfe290f45725d99fae0063c5188b8f&challenge=36bbdc68ea2e3279d57269471b837a6b&product=popup&width=301px&offline=false&lang=zh-cn&protocol=http://&type=slide&path=/static/js/geetest.6.0.9.js&callback=geetest_1650391756575", "http://sgoutong.baidu.com/embed/1649840755/asset/embed/mobile_nb.js", "https://sofire.bdstatic.com/js/dfxaf.js", "https://p.qiao.baidu.com/cps3/site/poll?cb=jsonp_bridge_1650392095190_21922384256393768&l=1&sign=&v=165039175860477407&s=12877102&e=26958486&isAFF=1&filterAdvertisement=1&dev=1&auth=%7B%22anonym%22%3A0%2C%22key%22%3A%223bfef1eb-bde9-4fbf-ba96-abad738f1775%22%2C%22sn%22%3A%22%22%2C%22id%22%3A%22165039175860477407%22%2C%22from%22%3A4%2C%22token%22%3A%22bridge%22%7D&_time=1650392095190", "http://www.zhuzi.me/zhuzi-statistic.js?path=http%3a%2f%2fwww.zhuzi.me%2f&siteid=62221&referer=", "xfe-URL-Zhuzi.me-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 7975, "FileHash-SHA256": 1286, "hostname": 1602, "domain": 560, "FileHash-MD5": 85, "FileHash-SHA1": 1 }, "indicator_count": 11509, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1476 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "625614852d13a468fd3f7ef9", "name": "Malware and bots", "description": "function se(t,e,n, r, n; if you want to know what type of document you are, you can use the new RegExp(M) to set it.", "modified": "2022-05-12T00:04:24.089000", "created": "2022-04-13T00:08:37.870000", "tags": [ "bygmo", "gmohd", "dx gmo", "nftadam", "iosandroid gmo", "csr sdgs", "english", "4444 gmo2020417", "developers gmo", "devsecopsthon", "tech", "font awesome", "free", "license", "cc by", "sil ofl", "code", "mit license", "brands", "fliph", "google", "import", "acbac1", "typeemail", "2deg", "1deg", "4deg", "css3", "animation cheat", "sheet", "justin aguilar", "questions", "slideexpandup", "expandup", "gradienttype0", "false", "copyright", "twitter", "f56505", "font", "font path", "woff", "truetype", "fontawesome", "unicode private", "tbody", "tfoot", "thead", "span", "multiple", "type", "href", "input", "halflings", "gradienttype1", "please", "function", "param", "method", "value", "target", "null", "array", "validator", "select", "checkbox", "date", "body", "error", "form", "meta", "class", "regexp", "typeof b", "width", "pseudo", "child", "sufeffxa0", "accept", "20px", "24px", "45deg", "typesubmit", "typenumber", "helvetica", "timelimit", "dialog", "content", "callback", "bodynoscroll", "click", "html", "confirm", "notice", "typeof e", "typeof t", "attr", "js foundation", "typeof module" ], "references": [ "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/jquery.min.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/dialog.min.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/common.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/css/public.css", "xfe-URL-c81e728d9d4c2f636f067f89cc14862c.com-stix2-2.1-export.json", "https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js", "http://downloads.mailchimp.com/js/jquery.form-n-validate.js", "http://imhrzluowdso.gq/i/css/bootstrap.css", "http://imhrzluowdso.gq/i/css/font-awesome.css", "http://imhrzluowdso.gq/i/css/bootstrap-theme.css", "http://imhrzluowdso.gq/i/css/animations.css", "http://imhrzluowdso.gq/i/css/style.css", "xfe-URL-imhrzluowdso.gq-stix2-2.1-export.json", "https://use.fontawesome.com/releases/v5.0.6/css/all.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1188, "domain": 214, "hostname": 427, "FileHash-SHA256": 168, "FileHash-MD5": 1, "FileHash-SHA1": 1, "email": 1 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1483 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6253010ef22c26bcdba2869a", "name": "Lh , ReduceRight Malware", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.", "modified": "2022-05-10T00:02:48.350000", "created": "2022-04-10T16:08:46.450000", "tags": [ "reduceright", "number", "string", "gztj64z90qf", "regexp", "r300", "error", "copyright", "dafunction", "gafunction", "uint8array", "date", "path", "void", "fontface", "woff", "woff2", "sans", "u1c801c88", "u20b4", "u2de02dff", "ua640a69f", "ufe2efe2f", "u04b004b1", "lh", "trackevent", "onceperelement", "u003e div", "xgfunction", "gtmk6chb3b", "query", "form", "click", "closure library", "pfunction", "contenttype", "zfunction", "bfunction", "mvoid", "ofunction", "script", "fragment", "xdfunction", "light", "regular", "bold", "verdana", "sansserif", "helvetica", "sltb", "slsavebutton2", "arial", "slh2", "slh3", "slsavebutton", "xrt2", "version", "xparsefloat", "typeof b", "function", "pseudo", "child", "array", "width", "sufeffxa0", "class", "null", "accept" ], "references": [ "xfe-URL-ketoluqidslim.us-stix2-2.1-export.json", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/7bf60781816875acb6c04aa4f706c4ad.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/af74c0184a1151090f275e5d06fe0387.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/63c9d725454afa40dc86453f4a52812f.css", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/a36a95c9dccfd8d0b6ccb62ed162150a.css", "https://www.googletagmanager.com/gtag/js?id=G-ZTJ64Z90QF&l=dataLayer&cx=c", "https://www.googleoptimize.com/optimize.js?id=OPT-MTGSVG5", "https://www.google-analytics.com/analytics.js", "https://www.googletagmanager.com/gtm.js?id=GTM-K6CHB3B", "https://fonts.googleapis.com/css2?family=Open+Sans&family=Oswald:wght@400;600;700&family=Roboto+Condensed:wght@400;700&display=swap", "xfe-URL-nertiob.pw-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Lh", "display_name": "Lh", "target": null }, { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1153, "hostname": 391, "FileHash-SHA256": 167, "domain": 249, "FileHash-MD5": 45 }, "indicator_count": 2005, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6250b15f2509705305127d3d", "name": "Unnamed Malware", "description": "This is the full text of an online forum for people under the age of 18, set up in the United States, and published on the website of the site's founder, JK Rowling.", "modified": "2022-05-08T22:03:06.754000", "created": "2022-04-08T22:04:15.223000", "tags": [ "error", "modulenotfound", "infinite", "function", "mouseevent", "dommousescroll", "date", "event", "bscroll", "u200", "typeof s", "0xa60881", "0x1e0610", "0x489cca", "0x4d5bd1", "0x1a7a9a", "0x3145fc", "0x2d9acb", "0xbf1b3e", "0x47699d", "push", "shift", "cookie", "slice", "open", "code", "path", "info", "null", "this", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "window", "canvas", "tencent", "barrio", "regexp", "typeof b", "width", "pseudo", "child", "array", "sufeffxa0", "class", "accept", "arisa bd", "director", "uncut bd", "4 bd", "milk1 bd", "cage1 bd", "discodepart1 bd", "discodepart2 bd", "milk4 bd", "wife", "mother", "shown", "meta", "viewport" ], "references": [ "xfe-IP-103.120.25.185-stix2-2.1-export.json", "http://www.yichenghy.com/common.js", "http://www.yichenghy.com/tj.js", "https://yeyeai3.xyz/", "https://www.2610.app:5766/?agent=7762453360", "https://www.2610.app:5766/js/jquery-1.11.3.min.js", "http://v8714.com/", "https://www.2610.app:5766/js/xinstall_inner_e.min.js?v=1004", "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://6553w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "https://6553w.com:2188/m/js/2203141811-fhcpLogin.js", "xfe-URL-www.yichenghy.com-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 903, "hostname": 370, "domain": 112, "FileHash-SHA256": 20, "FileHash-MD5": 3 }, "indicator_count": 1408, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1486 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "624f2e8aebe8893d7e4f68d5", "name": "IBM EARLY WARNING URL - ketoqitugslim.us", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.", "modified": "2022-05-07T00:03:18.570000", "created": "2022-04-07T18:33:46.056000", "tags": [ "tbody", "span", "thead", "tfoot", "typecheckbox", "typeradio", "multiple", "href", "typesearch", "helvetica", "typemonth", "typebutton", "typereset", "typesubmit", "arial", "date", "version", "xparsefloat", "regexp", "error", "typeof b", "function", "pseudo", "child", "array", "width", "sufeffxa0", "class", "null", "accept" ], "references": [ "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/7bf60781816875acb6c04aa4f706c4ad.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/af74c0184a1151090f275e5d06fe0387.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/23190726c18d12eb341ebb4c6d4573ab.css", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/89782cd052fb72c4f9df6bd5644f2afb.css", "xfe-URL-ketoqitugslim.us-stix2-2.0-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 659, "hostname": 266, "domain": 112, "FileHash-MD5": 5 }, "indicator_count": 1042, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1488 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6249a9e497137f9627e5a794", "name": "\u7f8e\u9ad8\u6885\u2014botnet", "description": "At.ts.t, At.com, is the new version of HTML, which can now be viewed in full on Google's web browser and on Apple's mobile app for the first time.", "modified": "2022-04-03T14:09:48.093000", "created": "2022-04-03T14:06:28.503000", "tags": [ "event", "null", "promise", "html", "width", "hasclass", "loadx20error", "ajaxcomplete", "unique", "609237fvvpkt", "push", "first", "open", "checkbox", "trigger", "jquery", "write", "blackberry", "android", "androidos", "firefox", "chrome", "skyfire", "opera", "opera mobi", "dolfin", "kindle", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "window", "shift", "date", "canvas", "tencent", "barrio", "slice", "regexp", "function", "typeof b", "error", "pseudo", "child", "array", "sufeffxa0", "class", "accept", "testflight", "typeof e", "typeof n", "typeof t", "typeof r", "x20trnf", "this" ], "references": [ "http://slulutz02.com/", "https://mgttse001.vip/static/js/jquery.js", "https://mgttse001.vip/template/m1938pc/pic/hf1", "https://m2855.com:35003/", "https://m9277.com/tsnew-download/index.html", "https://www.7631.app:8755/js/jquery-1.11.3.min.js", "https://www.7631.app:8755/js/xinstall_inner_e.min.js?v=1004", "https://www.7631.app:8755/js/mobile-detect.min.js?v=1004", "https://m9277.com/tsnew-download/js/jquery.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1048, "domain": 132, "hostname": 311 }, "indicator_count": 1491, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1521 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6249a9e3fcaee2fb956ffacc", "name": "\u7f8e\u9ad8\u6885\u2014botnet", "description": "At.ts.t, At.com, is the new version of HTML, which can now be viewed in full on Google's web browser and on Apple's mobile app for the first time.", "modified": "2022-04-03T14:06:27.271000", "created": "2022-04-03T14:06:27.271000", "tags": [ "event", "null", "promise", "html", "width", "hasclass", "loadx20error", "ajaxcomplete", "unique", "609237fvvpkt", "push", "first", "open", "checkbox", "trigger", "jquery", "write", "blackberry", "android", "androidos", "firefox", "chrome", "skyfire", "opera", "opera mobi", "dolfin", "kindle", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "window", "shift", "date", "canvas", "tencent", "barrio", "slice", "regexp", "function", "typeof b", "error", "pseudo", "child", "array", "sufeffxa0", "class", "accept", "testflight", "typeof e", "typeof n", "typeof t", "typeof r", "x20trnf", "this" ], "references": [ "http://slulutz02.com/", "https://mgttse001.vip/static/js/jquery.js", "https://mgttse001.vip/template/m1938pc/pic/hf1", "https://m2855.com:35003/", "https://m9277.com/tsnew-download/index.html", "https://www.7631.app:8755/js/jquery-1.11.3.min.js", "https://www.7631.app:8755/js/xinstall_inner_e.min.js?v=1004", "https://www.7631.app:8755/js/mobile-detect.min.js?v=1004", "https://m9277.com/tsnew-download/js/jquery.min.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1047, "domain": 132, "hostname": 311 }, "indicator_count": 1490, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1521 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62497a9c72edc277fb20e52f", "name": "'+titlestr+'", "description": "If you want to see what is going on at this time of year, spare a thought for T.t.m.T.g.ts.com; T-t=t,", "modified": "2022-04-03T10:44:44.074000", "created": "2022-04-03T10:44:44.074000", "tags": [ "typeof t", "typeof symbol", "nthis", "msger", "typeof e", "image", "error", "typeerror", "new date", "codeverify", "0xa60881", "0x1e0610", "0x489cca", "0x4d5bd1", "0x1a7a9a", "0x3145fc", "0x2d9acb", "0xbf1b3e", "0x47699d", "push", "shift", "date", "cookie", "slice", "open", "code", "path", "info", "null", "this", "webpackrequire", "othis", "object", "array", "executor", "canvas", "function", "slidercaptcha", "createelement", "textdanger", "plugin", "rgba", "imagedata", "false", "touchstart", "trident", "click", "typeof", "typeof define", "typeof c", "copyright", "twitter", "bootstrap", "rolemenu", "typeof f", "typeof g", "james levine", "udid", "x61x70x70x6cx79", "azaz", "0x5372", "0x19", "0x3de55b", "0x24a5d4", "0x5c", "0x19c89f", "0x2f1b4a", "0x4d1e1f", "0x1a", "0x29", "window", "honor", "root", "length", "indexof", "x0ax20x20x20x20", "location", "math", "0x10", "0x18", "history", "config", "onload", "android", "regexp", "x20trnf", "class", "attr", "pseudo", "child", "swiper", "most", "mit license", "january", "typeof b", "sufeffxa0", "void", "typeof n", "appappapp", "next", "toh5", "channelcode", "androidos", "linux", "ipad", "macintosh", "promise", "xmlhttprequest", "0x1d9131", "0x180bcc", "0x4b6177", "0x13f349", "0x3bcb54", "0xbbe80d", "0x57b7de", "0x2ea74e", "0x4fb0f2", "0x25f113", "tencent", "barrio", "width", "accept", "cnzzdata", "czuuid", "umdistinctid", "version", "october", "win32", "name", "html", "meta", "viewport" ], "references": [ "http://www.laijcm.com/common.js", "http://www.laijcm.com/tj.js", "http://kk164.xyz/", "https://x4707.com:5443/?register=1", "https://6112.hnsstjc.com/a002/xpjtz.php", "https://6112.hnsstjc.com/a002/js/fontSize.js", "https://6112.hnsstjc.com/a002/js/jquery-1.8.3.min.js", "https://6112.hnsstjc.com/a002/js/swiper.min.js", "https://6112.hnsstjc.com/a002/xpj.php", "https://www.xvsgwa.com/qz1IJUpc.html", "https://c.cnzz.com/core.php?web_id=1280875449&t=z", "https://s9.cnzz.com/z_stat.php?id=1280875449&web_id=1280875449", "https://www.bibo14.app:2611/js/jquery-1.11.3.min.js", "https://www.bibo14.app:2611/js/cncc.js", "https://www.bibo14.app:2611/js/xinstall_inner_e.min.js?v=1004", "https://www.bibo14.app:2611/js/down.js?v=1022", "https://www.bibo14.app:2611/css/h5/reset.css", "https://www.dongtiankuangye.com/a002/config.js", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.js", "https://www.dongtiankuangye.com/a002/js/libs/jquery-1.12.4/jquery-1.12.4.min.js", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.css", "https://pojd783.cc:8443/index.html?shareName=pojd783.cc", "https://sdk.51.la/event/js-sdk-event.min.js?u=Je0ztO5GuwfJ6eip", "https://sdk.51.la/js-sdk-pro.min.js", "https://pojd783.cc:8443/js/sharetrace.min.js", "https://js112.oss-accelerate.aliyuncs.com/os.js", "https://ty66as.jxdysw.cn/1whpv", "https://ty66as.jxdysw.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "https://ty66as.jxdysw.cn/dist/vendors/clipboard/clipboard.min.js", "https://ty66as.jxdysw.cn/dist/captcha/disk/slidercaptcha.js", "https://ssl.captcha.qq.com/TCaptcha.js", "https://cstaticdun.126.net/load.min.js?t=202007291602", "https://t.captcha.qq.com/template/drag_ele.html?t=1648982190651", "https://captcha.gtimg.com/1/tcaptcha-frame.db8b9289.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1528, "hostname": 543, "domain": 209, "FileHash-SHA256": 127, "email": 1, "FileHash-MD5": 4 }, "indicator_count": 2412, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1521 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6249330bfdce75b6a0667154", "name": "Malware cont..", "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.", "modified": "2022-04-03T05:39:23.816000", "created": "2022-04-03T05:39:23.816000", "tags": [ "2000px", "120deg", "10px", "e9e7e7", "b2b2b2", "webkitkeyframes", "f8f8f8", "d3d4d3", "c9c5c5", "alpha", "web mit", "license http", "invalid", "activexobject", "msies", "msanimationend", "typeof e", "typeof f", "typeof y", "typeof define", "function", "null", "typeof t", "array", "value", "regexp", "textarea", "azaz", "typeof n", "this", "date", "infinity", "iframe", "error", "typeof b", "pseudo", "child", "width", "sufeffxa0", "class", "accept" ], "references": [ "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js", "https://cdn.staticfile.org/vue/1.0.21/vue.min.js", "https://cdn.staticfile.org/layer/3.1.1/layer.js", "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 914, "FileHash-SHA256": 23, "hostname": 339, "domain": 126 }, "indicator_count": 1402, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1521 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621fff12d2c54f70fea90576", "name": "Bexar.org", "description": "", "modified": "2022-04-01T00:01:54.852000", "created": "2022-03-02T23:34:42.531000", "tags": [], "references": [ "www.bexar.org - urlscan.io.pdf", "bexar api 4.pdf", "bexar api 8.pdf", "bexar 6.pdf", "bexar api 2.pdf", "bexar api 7.pdf", "bexar api 3.pdf", "bexar api 9.pdf", "bexar api 12.pdf", "bexar api 17.pdf", "bexar api 15.pdf", "bexar api 18.pdf", "bexar api 10.pdf", "bexar api 19.pdf", "bexar api 20.pdf", "bexar api 13.pdf", "bexar api 21.pdf", "bexar api 14.pdf", "bexar api 22.pdf", "bexar1.pdf", "bexar api5.pdf", "bexar2.pdf", "bexar3.pdf", "bexar.org 3.2.22.pdf", "bexar6.pdf", "bexar5.pdf", "bexar api_1.pdf", "bexar10.pdf", "bexar api.pdf", "bexar_v1df.pdf", "bexarv4df.pdf", "bexarv2df.pdf", "bexarv6df.pdf", "bexasv3df.pdf", "bexarv7df.pdf", "bear_v apidf.pdf" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1833, "URL": 4669, "domain": 1025, "FileHash-SHA256": 1735, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9410, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://www.cloudron.io/3rdparty/angular-loader.min.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/63c9d725454afa40dc86453f4a52812f.css", "https://6112.hnsstjc.com/a002/xpjtz.php", "http://freebit.com/common/js/jquery.bxslider.min.js", "bexar api 19.pdf", "https://cstaticdun.126.net/load.min.js?t=202007291602", "https://www.nocix.net/js/bootstrap.min.js", "bexar2.pdf", "https://kit.fontawesome.com/7d998cc9b7.js", "http://downloads.mailchimp.com/js/jquery.form-n-validate.js", "http://freebit.com/common/css/common.css", "xfe-URL-Nocix.net-stix2-2.1-export.json", "https://www.7631.app:8755/js/mobile-detect.min.js?v=1004", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/af74c0184a1151090f275e5d06fe0387.js", "https://www.dongtiankuangye.com/a002/js/libs/jquery-1.12.4/jquery-1.12.4.min.js", "https://ajax.googleapis.com/ajax/libs/jquery/1.11.3/jquery.min.js", "https://www.bibo14.app:2611/js/cncc.js", "https://js112.oss-accelerate.aliyuncs.com/os.js", "https://fonts.googleapis.com/css2?family=Montserrat:wght@500;600;700&display=swap", "https://cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv.min.js", "bexar api 9.pdf", "http://api.geetest.com/gettype.php?gt=70bfe290f45725d99fae0063c5188b8f&callback=geetest_1650391760798", "http://sgoutong.baidu.com/embed/1649840755/asset/embed/mobile_nb.js", "https://goutong.baidu.com/site/889/a8439b4fa4b46ae6d1cb7840806b342d/b.js?siteId=12877102", "https://yeyeai3.xyz/", "https://6553w.com:2188/m/js/2203141811-HomeLogin~LotteryHall~VnsLogin~activity~amhgLogin~aqvnsLogin~betnewLocgin~blrLogin~blushLogin~cLogin~6995ba01.js", "xfe-URL-nertiob.pw-stix2-2.1-export.json", "https://pojd783.cc:8443/js/sharetrace.min.js", "https://ty66as.jxdysw.cn/dist/captcha/disk/slidercaptcha.js", "bexar5.pdf", "https://www.dreamhost.com/assets/bootstrap-aa47564acfdf18ce859b8e1fd130d889920ae66415b3db4de8505d42a0477b09.css", "https://ty66as.jxdysw.cn/dist/vendors/bootstrap/js/bootstrap.min.js", "xfe-URL-versaweb.com-stix2-2.1-export.json", "bexar api 13.pdf", "https://googleads.g.doubleclick.net/pagead/ads?client=ca-pub-2581829468247892&output=html&adk=1812271804&adf=3025194257&lmt=1651149220&plat=16%3A8388608%2C17%3A32%2C24%3A32%2C25%3A32%2C32%3A32&format=0x0&url=http%3A%2F%2Fappbyweb.net%2FAppByWeb%2F&ea=0&pra=5&wgl=1&dt=1651149220376&bpp=1&bdt=121&idt=18&shv=r20220425&mjsv=m202204200101&ptt=9&saldr=aa&abxe=1&cookie=ID%3De83d6067a4dac5b6-229192c549d200d1%3AT%3D1651148802%3ART%3D1651148802%3AS%3DALNI_MZSt9utXhYBHAIH9xwQp72WuxQxTw&nras=1&correlator=1655793633284&", "https://www.dreamhost.com/assets/site-75a1aba399db4de4e4093997b8fc8ff8ec5e65b5f4258c9a658a5cacacbf6e0d.js", "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js", "https://fonts.googleapis.com/css2?family=Open+Sans&family=Oswald:wght@400;600;700&family=Roboto+Condensed:wght@400;700&display=swap", "https://ssl.captcha.qq.com/TCaptcha.js", "http://www.rolr.eu/js/jquery.min.js", "https://www.dongtiankuangye.com/a002/config.js", "http://api.geetest.com/get.php?gt=70bfe290f45725d99fae0063c5188b8f&challenge=36bbdc68ea2e3279d57269471b837a6b&product=popup&width=301px&offline=false&lang=zh-cn&protocol=http://&type=slide&path=/static/js/geetest.6.0.9.js&callback=geetest_1650391756575", "https://embed.tawk.to/_s/v4/app/625d36b405c/languages/en.js", "http://freebit.com/common/css/reset.css", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.js", "https://m2855.com:35003/", "https://www.googletagmanager.com/gtm.js?id=GTM-TLN654", "http://freebit.com/common/js/variablelist_top.js?v=2", "xfe-URL-Dreamhost.com-stix2-2.1-export.json", "xfe-URL-netsol.com-stix2-2.1-export.json", "https://www.fiberhub.com/js/bootstrap.js", "https://www.bibo14.app:2611/css/h5/reset.css", "https://www.google-analytics.com/plugins/ua/linkid.js", "bexar api 18.pdf", "bexar_v1df.pdf", "https://cdn.abrankings.com/js/client.js", "bexasv3df.pdf", "https://t.captcha.qq.com/template/drag_ele.html?t=1648982190651", "https://www.west.cn/js2016/lib/jquery.SuperSlide/jquery.SuperSlide.2.1.1.x.js", "https://sdk.51.la/js-sdk-pro.min.js", "https://www.googleoptimize.com/optimize.js?id=OPT-MTGSVG5", "http://v1-ab.cdn-static.cn/editor/js/jquery.min.js", "bexar api 17.pdf", "https://www.dreamhost.com/assets/scripts/bootstrap-7670fc8587f9fd0608d2af67f392281a9a4fbf4cb4252952ecb8d34f6ee286b3.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/dialog.min.js", "xfe-URL-West.cn-stix2-2.1-export.json", "https://www.nocix.net/js/nocix.js", "http://v8714.com/", "bexar api 2.pdf", "www.bexar.org - urlscan.io.pdf", "https://www.googletagmanager.com/gtag/js?id=G-1F7WLMM0K2&l=dataLayer&cx=c", "bexar 6.pdf", "bexar10.pdf", "http://appbyweb.net/AppByWeb/js/main.js", "bexar api 4.pdf", "https://captcha.gtimg.com/1/tcaptcha-frame.db8b9289.js", "bexar api 21.pdf", "https://www.rolr.eu/", "http://freebit.com/common/js/jquery.mixitup.min.js", "http://freebit.com/common/js/slide.js", "http://www.ctgserver.net/zhuzi-statistic.js?path=http%3a%2f%2fwww.ctgserver.net%2f&siteid=68944&referer=", "https://pagead2.googlesyndication.com/pagead/managed/js/adsense/m202204200101/show_ads_impl_fy2019.js", "bexar api 7.pdf", "https://www.cloudron.io/3rdparty/angular.min.js", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/css/public.css", "http://sgoutong.baidu.com/embed/1649840755/asset/embed/mobilelite/main.js", "xfe-URL-Zhuzi.me-stix2-2.1-export.json", "xfe-IP-76.164.203.68-stix2-2.1-export.json", "https://sofire.bdstatic.com/js/dfxaf.js", "http://imhrzluowdso.gq/i/css/animations.css", "xfe-URL-fiberhub.com-stix2-2.1-export.json", "https://www.googletagmanager.com/gtag/js?id=AW-701859743", "https://cdn.staticfile.org/layer/3.1.1/layer.js", "https://m.west.cn/jscripts/baidutj/hm.js", "http://www.versaweb.com/js/bootstrap.js", "bexar3.pdf", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/jquery.min.js", "http://www.laijcm.com/tj.js", "xfe-URL-imhrzluowdso.gq-stix2-2.1-export.json", "bexar api 15.pdf", "https://6553w.com:2188/m/js/2203141811-fhcpLogin.js", "https://www.dongtiankuangye.com/a002/js/plugins/swiper/swiper.min.css", "https://client.crisp.chat/l.js", "xfe-URL-appbyweb.net-stix2-2.1-export.json", "http://appbyweb.net/AppByWeb/js/jquery.easing.1.3.js", "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1", "https://mgttse001.vip/static/js/jquery.js", "http://slulutz02.com/", "https://static.hotjar.com/c/hotjar-596666.js?sv=5", "http://m.west.cn/jscripts/baidutj/hm.js", "https://cdn.staticfile.org/vue/1.0.21/vue.min.js", "https://www.googletagmanager.com/gtag/js?id=AW-1045757556", "http://freebit.com/topnews.css", "http://push.zhanzhang.baidu.com/push.js", "bexarv7df.pdf", "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js", "https://www.dreamhost.com/assets/scripts/webp-support-1dd791309dc3fa5b166a0a326e49345fe5acb5acbc1831f4c7be87efce1abf51.js", "http://appbyweb.net/AppByWeb/js/jquery.min.js", "https://www.west.cn/js2016/root/jqinclude.js?t=20211126a", "http://static.geetest.com/static/js/geetest.6.0.9.js", "xfe-IP-103.120.25.185-stix2-2.1-export.json", "https://m9277.com/tsnew-download/index.html", "http://www.laijcm.com/common.js", "https://x4707.com:5443/?register=1", "https://js.driftt.com/core?embedId=2y43hyefanc8®ion=US&forceShow=false&skipCampaigns=false&sessionId=5a8c1b8d-2626-4a43-a7a6-76e9416f2f52&sessionStarted=1650943819.009&campaignRefreshToken=a2d9846a-8932-4e3c-a8d5-878681a555e0&hideController=false&pageLoadStartTime=1650943817154&mode=CHAT&driftEnableLog=false", "bexarv4df.pdf", "https://www.googletagmanager.com/gtag/js?id=UA-33008870-1", "bexar1.pdf", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/89782cd052fb72c4f9df6bd5644f2afb.css", "http://freebit.com/common/js/function.js", "https://6112.hnsstjc.com/a002/js/fontSize.js", "http://kk164.xyz/", "bexar api 8.pdf", "https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.3/jquery.min.js", "https://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js", "https://www.cloudron.io/index.js", "http://www.yichenghy.com/tj.js", "https://www.7631.app:8755/js/xinstall_inner_e.min.js?v=1004", "https://www.google-analytics.com/analytics.js", "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css", "https://cstaticdun.126.net/load.min.js?v=2203141811", "https://script.hotjar.com/modules.0076bf93c385ddf0ff58.js", "https://files.appbyweb.net/Fonts/OpenSansHebrew/font.css", "https://www.googletagmanager.com/gtm.js?id=GTM-K6CHB3B", "https://www.2610.app:5766/?agent=7762453360", "bexar api 14.pdf", "https://ty66as.jxdysw.cn/1whpv", "bexarv6df.pdf", "https://c.cnzz.com/core.php?web_id=1280875449&t=z", "https://pojd783.cc:8443/index.html?shareName=pojd783.cc", "http://appbyweb.net/AppByWeb/js/superfish.js", "http://imhrzluowdso.gq/i/css/bootstrap.css", "https://c81e728d9d4c2f636f067f89cc14862c.com/static_new/js/common.js", "http://appbyweb.net/AppByWeb/js/hoverIntent.js", "https://s9.cnzz.com/z_stat.php?id=1280875449&web_id=1280875449", "http://appbyweb.net/AppByWeb/js/jquery.stellar.min.js", "https://www.2610.app:5766/js/jquery-1.11.3.min.js", "http://imhrzluowdso.gq/i/css/font-awesome.css", "https://www.nocix.net/speedtest/speedtest.js?r=4343", "xfe-URL-www.yichenghy.com-stix2-2.1-export.json", "http://www.zhuzi.me/zhuzi-statistic.js?path=http%3a%2f%2fwww.zhuzi.me%2f&siteid=62221&referer=", "bexar6.pdf", "https://www.bibo14.app:2611/js/down.js?v=1022", "https://sdk.51.la/event/js-sdk-event.min.js?u=Je0ztO5GuwfJ6eip", "http://imhrzluowdso.gq/i/css/style.css", "https://www.googletagmanager.com/gtag/js?id=G-ZTJ64Z90QF&l=dataLayer&cx=c", "https://www.cloudron.io/3rdparty/angular-route.min.js", "http://ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js", "https://js.driftt.com/core/chat?region=US&driftEnableLog=false&pageLoadStartTime=1650943817154", "bexar api_1.pdf", "https://d.adroll.com/pixel/LZLVHVDGLRC6BEJRRIQDVW/HBKRUDDSQJCU7GD5KH3RWC?adroll_fpc=fd1d5ad32fd771b6d89af530ec6ca1cf-1651601137287&arrfrr=http%3A%2F%2Fwww.versaweb.com%2F&pv=14491019928.1296&cookie=&adroll_s_ref=&keyw=", "https://www.cloudron.io/3rdparty/slick.js", "http://appbyweb.net/AppByWeb/js/modernizr-2.6.2.min.js", "http://appbyweb.net/AppByWeb/js/jquery.waypoints.min.js", "xfe-URL-freebit.com-stix2-2.1-export.json", "https://www.bibo14.app:2611/js/jquery-1.11.3.min.js", "http://appbyweb.net/AppByWeb", "bexar api.pdf", "xfe-URL-ketoluqidslim.us-stix2-2.1-export.json", "https://d.adroll.com/consent/check/LZLVHVDGLRC6BEJRRIQDVW?arrfrr=http%3A%2F%2Fwww.versaweb.com%2F&_s=1b87c8c5132a03372125d888e43b0a86&_b=2", "https://vars.hotjar.com/box-4924254a9ce4dc9b959b6e4a9b662d60.html", "https://p.qiao.baidu.com/cps3/site/poll?cb=jsonp_bridge_1650392095190_21922384256393768&l=1&sign=&v=165039175860477407&s=12877102&e=26958486&isAFF=1&filterAdvertisement=1&dev=1&auth=%7B%22anonym%22%3A0%2C%22key%22%3A%223bfef1eb-bde9-4fbf-ba96-abad738f1775%22%2C%22sn%22%3A%22%22%2C%22id%22%3A%22165039175860477407%22%2C%22from%22%3A4%2C%22token%22%3A%22bridge%22%7D&_time=1650392095190", "https://m9277.com/tsnew-download/js/jquery.min.js", "https://s.adroll.com/j/exp/LZLVHVDGLRC6BEJRRIQDVW/index.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/a36a95c9dccfd8d0b6ccb62ed162150a.css", "bexarv2df.pdf", "xfe-URL-c81e728d9d4c2f636f067f89cc14862c.com-stix2-2.1-export.json", "https://6112.hnsstjc.com/a002/js/swiper.min.js", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/7bf60781816875acb6c04aa4f706c4ad.js", "bexar api 12.pdf", "https://mgttse001.vip/template/m1938pc/pic/hf1", "bexar api 10.pdf", "https://6112.hnsstjc.com/a002/js/jquery-1.8.3.min.js", "http://appbyweb.net/AppByWeb/js/bootstrap.min.js", "bexar api5.pdf", "https://www.bibo14.app:2611/js/xinstall_inner_e.min.js?v=1004", "bexar api 3.pdf", "http://imhrzluowdso.gq/i/css/bootstrap-theme.css", "https://www.googleadservices.com/pagead/conversion_async.js", "https://use.fontawesome.com/releases/v5.0.6/css/all.css", "bexar api 22.pdf", "xfe-URL-Freebit.net-stix2-2.1-export.json", "https://www.cloudron.io/3rdparty/bootstrap.min.css", "https://www.2610.app:5766/js/xinstall_inner_e.min.js?v=1004", "https://nertiob.pw/lander/us-leanstartketov8-pre2-cryp.im/assets/23190726c18d12eb341ebb4c6d4573ab.css", "bear_v apidf.pdf", "https://6112.hnsstjc.com/a002/xpj.php", "bexar.org 3.2.22.pdf", "http://www.yichenghy.com/common.js", "xfe-URL-ketoqitugslim.us-stix2-2.0-export.json", "http://www.versaweb.com/css/1024.css", "http://freebit.com/common/css/top.css", "https://aiff.cdn.bcebos.com/sensors%2Fonline%2Fsa-sdk-javascript-1.14.24%2Fsensorsdata.min.js", "https://analytics.cloudron.io/piwik.js", "https://www.cloudron.io/3rdparty/bootstrap.min.js", "bexar api 20.pdf", "https://www.cloudron.io/3rdparty/angular-base64.min.js", "https://ty66as.jxdysw.cn/dist/vendors/clipboard/clipboard.min.js", "https://www.7631.app:8755/js/jquery-1.11.3.min.js", "https://partner.googleadservices.com/gampad/cookie.js?domain=appbyweb.net&callback=_gfp_s_&client=ca-pub-2581829468247892", "https://www.cloudron.io/3rdparty/jquery-1.11.0.js", "https://www.xvsgwa.com/qz1IJUpc.html", "https://js.driftt.com/include/1650944100000/2y43hyefanc8.js", "https://www.google-analytics.com/gtm/optimize.js?id=GTM-PHVK7LN", "xfe-IP-103.24.249.209-stix2-2.1-export.json" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Vd", "Lh", "Gc", "Qe", "Reduceright", "Hj" ], "industries": [ "Government" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 27, "pulses": [ { "id": "65708e0d95a8c74cc715f7a2", "name": "West.cn", "description": "", "modified": "2023-12-06T15:06:53.350000", "created": "2023-12-06T15:06:53.350000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 208, "domain": 533, "hostname": 757, "URL": 1861, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708c8f50527fb73205bfca", "name": "Dreamhost.com - Drift Widget", "description": "", "modified": "2023-12-06T15:00:31.809000", "created": "2023-12-06T15:00:31.809000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 174, "domain": 464, "URL": 1119, "hostname": 156, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 1916, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708c5b24dc4c51811f6de7", "name": "nocix malware Qe", "description": "", "modified": "2023-12-06T14:59:39.528000", "created": "2023-12-06T14:59:39.528000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 125, "hostname": 507, "URL": 1232, "domain": 170, "FileHash-MD5": 1 }, "indicator_count": 2035, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708bf87a08635a650eeb9b", "name": "ctgserver.net", "description": "", "modified": "2023-12-06T14:58:00.096000", "created": "2023-12-06T14:58:00.096000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1286, "domain": 560, "hostname": 1602, "URL": 7975, "FileHash-MD5": 85, "FileHash-SHA1": 1 }, "indicator_count": 11509, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708befc4f4c7e2be4370d9", "name": "ctgserver.net", "description": "", "modified": "2023-12-06T14:57:51.922000", "created": "2023-12-06T14:57:51.922000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1286, "domain": 560, "hostname": 1602, "URL": 7975, "FileHash-MD5": 85, "FileHash-SHA1": 1 }, "indicator_count": 11509, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708bae2f0c59d34f050b9e", "name": "Malware and bots", "description": "", "modified": "2023-12-06T14:56:46.779000", "created": "2023-12-06T14:56:46.779000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 168, "hostname": 427, "domain": 214, "URL": 1188, "FileHash-MD5": 1, "FileHash-SHA1": 1, "email": 1 }, "indicator_count": 2000, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708b7bb1d8a5ad0edc6615", "name": "Lh , ReduceRight Malware", "description": "", "modified": "2023-12-06T14:55:55.190000", "created": "2023-12-06T14:55:55.190000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 167, "domain": 249, "URL": 1152, "hostname": 391, "FileHash-MD5": 45 }, "indicator_count": 2004, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65707fe17dfdfe16066d16de", "name": "Bexar.org", "description": "", "modified": "2023-12-06T14:06:25.800000", "created": "2023-12-06T14:06:25.800000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1735, "hostname": 1833, "domain": 1025, "URL": 4668, "email": 4, "FileHash-MD5": 133, "FileHash-SHA1": 6, "CIDR": 5 }, "indicator_count": 9409, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "909 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628ce74526894454664e1bab", "name": "cloudron.io", "description": "function ar(aw,av,au,at) is a new version of the Matomo tracker, which allows users to track where a tracker has been located, and when it is activated.", "modified": "2022-06-23T00:03:28.624000", "created": "2022-05-24T14:10:13.562000", "tags": [ "span", "type", "href", "tbody", "tfoot", "thead", "input", "helvetica neue", "helvetica", "arial", "twitter", "date", "docviewtop", "shadow", "rocketchat", "sogo", "gitlab", "wordpress", "matomo", "kanboard", "taiga", "ninja", "slow", "scroll", "dom exception", "google", "regexp", "mmm d", "mmmm d", "null", "this", "number", "destroy", "controller", "array", "error", "android", "false", "function", "index", "slickcenter", "slick", "object", "translate", "translate3d", "jquery", "typeof c", "copyright", "bootstrap", "javascript", "azaz", "popover", "typeof f", "typeof b", "width", "pseudo", "child", "sufeffxa0", "class", "accept", "string", "please", "blob", "post", "link", "license" ], "references": [ "https://analytics.cloudron.io/piwik.js", "https://www.cloudron.io/3rdparty/jquery-1.11.0.js", "https://www.cloudron.io/3rdparty/bootstrap.min.js", "https://www.cloudron.io/3rdparty/slick.js", "https://www.cloudron.io/3rdparty/angular.min.js", "https://www.cloudron.io/3rdparty/angular-loader.min.js", "https://www.cloudron.io/3rdparty/angular-route.min.js", "https://www.cloudron.io/3rdparty/angular-base64.min.js", "https://www.cloudron.io/index.js", "https://www.cloudron.io/3rdparty/bootstrap.min.css" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 541, "URL": 1300, "domain": 180, "FileHash-SHA256": 72, "FileHash-SHA1": 1 }, "indicator_count": 2094, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "1441 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6280398780fbe64692dd54fd", "name": "West.cn", "description": "If you want to know more about Shockwave Flash, spare a thought for the members of your own storage system:mt.co.g.o.mimeTypes.com, mime", "modified": "2022-06-13T00:00:32.864000", "created": "2022-05-14T23:21:43.936000", "tags": [ "jquery", "date", "vue jquery", "template", "layer", "paas", "dist", "wjf3m", "ajax", "business", "string", "number", "regexp", "copyright", "uint8array", "fnumber", "aw1045757556", "closure library", "xdfunction", "code", "ddos", "image", "script", "document", "unescape", "msie", "canvas", "domain", "click", "input", "label", "jdomname", "strong", "jactive15toast", "jclearinput", "case", "datatarget", "jdomainregcount", "span", "function", "x786e", "x53d6", "cite", "x4fe1", "iframe", "null", "prompt", "x6700", "x591a", "array", "numarray", "data", "midsize", "action", "keyword", "firstfix", "object", "5n3j", "3f4r", "5p3s", "1f5m", "hhe2", "bbf2", "3y3z", "1223", "6q6m", "zfunction", "psettimeout", "tsettimeout", "hsetinterval", "iparseint", "hnull", "pnull", "tnull", "lv1s", "efunction", "typeof t", "typeof e", "adobeedge", "typeof r", "webkittransform", "moztransform", "body", "this", "notifier", "invert", "name", "param", "value", "error", "false", "trigger", "restart", "form", "config", "constants", "true", "modalhelper", "relative", "fixed", "account login", "activexobject", "haslocation", "xmlhttprequest", "xmlregexp", "temp", "extpart", "foundation", "mit license", "write", "rhino", "mark", "import", "classnamedom", "onbeforedestroy", "login", "auto", "init", "typeof b", "width", "pseudo", "child", "enulle", "class", "accept", "shockwave flash", "new date1e3", "ka6e5", "la10" ], "references": [ "xfe-IP-103.24.249.209-stix2-2.1-export.json", "xfe-URL-West.cn-stix2-2.1-export.json", "https://m.west.cn/jscripts/baidutj/hm.js", "http://m.west.cn/jscripts/baidutj/hm.js", "https://www.west.cn/js2016/lib/jquery.SuperSlide/jquery.SuperSlide.2.1.1.x.js", "https://www.west.cn/js2016/root/jqinclude.js?t=20211126a", "https://www.googletagmanager.com/gtag/js?id=AW-1045757556" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 533, "URL": 1861, "hostname": 757, "FileHash-SHA256": 208, "FileHash-MD5": 1 }, "indicator_count": 3360, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "1451 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "v.fail", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "v.fail", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780448162.8396804 }