{ "type": "Domain", "indicator": "xpertlearninghub.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/xpertlearninghub.com", "alexa": "http://www.alexa.com/siteinfo/xpertlearninghub.com", "indicator": "xpertlearninghub.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4236850641, "indicator": "xpertlearninghub.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 50, "pulses": [ { "id": "6a1ab6efb8f3c8da4f6b358c", "name": "GREYVIBE Threat Actor: TTPs, Malware, and Infrastructure Analysis.", "description": "GREYVIBE is a cyber threat actor identified by WithSecure, primarily targeting Ukraine and entities related to Ukraine since August 2025. The group's activities show significant overlaps in their attack infrastructure and operational methodologies, which indicate a persistent campaign aligned with Russian state interests, especially in the context of the Russia-Ukraine war. GREYVIBE's operations have been characterized by the use of various attack vectors, including spear-phishing emails, fake captcha pages, and fraudulent websites impersonating Ukrainian organizations. These methods have facilitated the distribution of malware, predominantly custom-developed variants like PhantomRelay, FallSpy, and LegionRelay.", "modified": "2026-05-30T10:12:00.827000", "created": "2026-05-30T10:07:43.020000", "tags": [ "research", "whitepaper", "mohammad kazem hassan nejad", "2026", "powershell", "fallspy", "legionrelay", "lookvalps", "lookvaljs", "javascript", "daylight", "teasoup", "android spyware", "august", "telegram", "dronelink", "princessclub", "phantomrelayv1", "greyvibe", "domain name", "phantommail", "sha256", "domain", "development", "phantomclick", "club site", "teams", "kongtuke", "april", "nsis", "service", "impacket" ], "references": [ "https://labs.withsecure.com/publications/greyvibe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "LegionRelay", "display_name": "LegionRelay", "target": null }, { "id": "DroneLink", "display_name": "DroneLink", "target": null }, { "id": "PrincessClub", "display_name": "PrincessClub", "target": null }, { "id": "PhantomRelayV1", "display_name": "PhantomRelayV1", "target": null }, { "id": "LOOKVALJS", "display_name": "LOOKVALJS", "target": null }, { "id": "GREYVIBE", "display_name": "GREYVIBE", "target": null } ], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1021.001", "name": "Remote Desktop Protocol", "display_name": "T1021.001 - Remote Desktop Protocol" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" } ], "industries": [ "Military", "Government", "Energy" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 55, "FileHash-MD5": 14, "FileHash-SHA1": 13, "FileHash-SHA256": 67, "IPv4": 9, "URL": 3, "hostname": 4 }, "indicator_count": 165, "is_author": false, "is_subscribing": null, "subscriber_count": 542, "modified_text": "1 day ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "5fa1852d337eca8e99c2ec32", "name": "Malware - Malware Domain Feed V2 - November 03 2020", "description": "Command and Control domains for Malware. These domains are extracted from a number of sources, and are suspicious.", "modified": "2026-05-30T03:19:46.084000", "created": "2020-11-03T16:28:29.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 553456, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "otxrobottwo", "id": "78495", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 49967, "domain": 75353 }, "indicator_count": 125320, "is_author": false, "is_subscribing": null, "subscriber_count": 1727, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aed5f47baf25a1d6c8b3dc", "name": "Payload_Delivery | Mar 10, 2026", "description": "Payload_Delivery indicators. Date: Mar 10, 2026. Total: 1915 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:15:16.856000", "created": "2026-03-09T14:15:16.856000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 928, "domain": 296, "URL": 260, "FileHash-SHA256": 147, "FileHash-MD5": 141, "FileHash-SHA1": 137 }, "indicator_count": 1909, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad82b9997c1b840f57babd", "name": "Payload_Delivery | Mar 9, 2026", "description": "Payload_Delivery indicators. Date: Mar 9, 2026. Total: 1632 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:07:53.390000", "created": "2026-03-08T14:07:53.390000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 743, "URL": 189, "domain": 279, "FileHash-MD5": 141, "FileHash-SHA1": 137, "FileHash-SHA256": 138 }, "indicator_count": 1627, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac31e3dd28f6cb8ab73a3e", "name": "Payload_Delivery | Mar 8, 2026", "description": "Payload_Delivery indicators. Date: Mar 8, 2026. Total: 1526 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:10:43.097000", "created": "2026-03-07T14:10:43.097000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 570, "domain": 302, "URL": 284, "FileHash-SHA1": 120, "FileHash-SHA256": 121, "FileHash-MD5": 124 }, "indicator_count": 1521, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aadf17b6a785e92897bbec", "name": "Payload_Delivery | Mar 7, 2026", "description": "Payload_Delivery indicators. Date: Mar 7, 2026. Total: 1249 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:05:11.516000", "created": "2026-03-06T14:05:11.516000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 440, "domain": 319, "URL": 290, "FileHash-MD5": 67, "FileHash-SHA256": 64, "FileHash-SHA1": 63 }, "indicator_count": 1243, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a98e6627158c25a08d6a69", "name": "Payload_Delivery | Mar 6, 2026", "description": "Payload_Delivery indicators. Date: Mar 6, 2026. Total: 1141 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T14:08:38.726000", "created": "2026-03-05T14:08:38.726000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 302, "domain": 358, "URL": 281, "FileHash-MD5": 67, "FileHash-SHA256": 64, "FileHash-SHA1": 63 }, "indicator_count": 1135, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a83d131507e8566b447349", "name": "Payload_Delivery | Mar 5, 2026", "description": "Payload_Delivery indicators. Date: Mar 5, 2026. Total: 905 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:09:23.204000", "created": "2026-03-04T14:09:23.204000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 191, "hostname": 209, "domain": 305, "FileHash-MD5": 67, "FileHash-SHA256": 64, "FileHash-SHA1": 63 }, "indicator_count": 899, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a73dcffd2b4f393a53bea2", "name": "PreCog Sweep - 2026-03-03 20h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T20:00:15.395000", "created": "2026-03-03T20:00:15.395000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 107, "URL": 44, "domain": 71 }, "indicator_count": 222, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a736c6ad01ad8cb3a1936a", "name": "PreCog Sweep - 2026-03-03 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T19:30:14.427000", "created": "2026-03-03T19:30:14.427000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 107, "domain": 69, "URL": 47 }, "indicator_count": 223, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a72fbe70d1c5f16245b753", "name": "PreCog Sweep - 2026-03-03 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T19:00:14.382000", "created": "2026-03-03T19:00:14.382000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 70, "hostname": 106, "URL": 47 }, "indicator_count": 223, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a728b74e0da70585fae212", "name": "PreCog Sweep - 2026-03-03 18h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T18:30:15.084000", "created": "2026-03-03T18:30:15.084000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 106, "URL": 45, "domain": 69 }, "indicator_count": 220, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a721aecdce20b8695ddae8", "name": "PreCog Sweep - 2026-03-03 18h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T18:00:14.702000", "created": "2026-03-03T18:00:14.702000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 102, "domain": 67, "URL": 40 }, "indicator_count": 209, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a71aa7e4ee5f84122ab43c", "name": "PreCog Sweep - 2026-03-03 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T17:30:15.224000", "created": "2026-03-03T17:30:15.224000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 67, "URL": 40, "hostname": 101 }, "indicator_count": 208, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a713a2e2e07de447e7fe19", "name": "PreCog Sweep - 2026-03-03 17h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T17:00:17.987000", "created": "2026-03-03T17:00:17.987000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 101, "domain": 67, "URL": 40 }, "indicator_count": 208, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a70c9a280c24f4aaa13438", "name": "PreCog Sweep - 2026-03-03 16h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T16:30:18.637000", "created": "2026-03-03T16:30:18.637000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 98, "domain": 67, "URL": 40 }, "indicator_count": 205, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a70592388972653a3a28e9", "name": "PreCog Sweep - 2026-03-03 16h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T16:00:17.923000", "created": "2026-03-03T16:00:17.923000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 97, "domain": 64, "URL": 35 }, "indicator_count": 196, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6fe8bb2a120e46f9916e6", "name": "PreCog Sweep - 2026-03-03 15h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T15:30:19.412000", "created": "2026-03-03T15:30:19.412000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 98, "domain": 64, "URL": 35 }, "indicator_count": 197, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f783c4ed98e3879b6379", "name": "PreCog Sweep - 2026-03-03 15h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T15:00:19.758000", "created": "2026-03-03T15:00:19.758000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 123, "domain": 38, "URL": 35 }, "indicator_count": 196, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6f079677e56ab33852896", "name": "PreCog Sweep - 2026-03-03 14h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T14:30:17.553000", "created": "2026-03-03T14:30:17.553000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 42, "hostname": 121, "URL": 35 }, "indicator_count": 198, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6ea5e8f6b46a1a4b60981", "name": "Payload_Delivery | Mar 4, 2026", "description": "Payload_Delivery indicators. Date: Mar 4, 2026. Total: 686 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-03T14:04:14.163000", "created": "2026-03-03T14:04:14.163000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 185, "domain": 334, "FileHash-SHA256": 1, "hostname": 159 }, "indicator_count": 679, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6e972f7f205b15e498610", "name": "PreCog Sweep - 2026-03-03 14h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T14:00:18.747000", "created": "2026-03-03T14:00:18.747000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 212, "URL": 45, "domain": 125 }, "indicator_count": 382, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6e267af981eb532140c64", "name": "PreCog Sweep - 2026-03-03 13h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T13:30:15.397000", "created": "2026-03-03T13:30:15.397000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 44, "domain": 125, "hostname": 210 }, "indicator_count": 379, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6db5fcce92f3ccfba6b08", "name": "PreCog Sweep - 2026-03-03 13h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T13:00:15.486000", "created": "2026-03-03T13:00:15.486000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 41, "hostname": 212, "domain": 128 }, "indicator_count": 381, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6d457ce73a632067fcb22", "name": "PreCog Sweep - 2026-03-03 12h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T12:30:15.451000", "created": "2026-03-03T12:30:15.451000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 212, "domain": 131, "URL": 40 }, "indicator_count": 383, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6cd4ff7ffb85829f4871f", "name": "PreCog Sweep - 2026-03-03 12h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T12:00:15.759000", "created": "2026-03-03T12:00:15.759000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 103, "hostname": 186, "URL": 40 }, "indicator_count": 329, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6c647f05a05dd301b6bc2", "name": "PreCog Sweep - 2026-03-03 11h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T11:30:15.048000", "created": "2026-03-03T11:30:15.048000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 186, "domain": 102, "URL": 40 }, "indicator_count": 328, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6bf40a00daa2c46f64632", "name": "PreCog Sweep - 2026-03-03 11h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T11:00:16.798000", "created": "2026-03-03T11:00:16.798000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 186, "domain": 102, "URL": 40 }, "indicator_count": 328, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6b8361f816ba8a1e27cc8", "name": "PreCog Sweep - 2026-03-03 10h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T10:30:14.502000", "created": "2026-03-03T10:30:14.502000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 184, "domain": 102, "URL": 40 }, "indicator_count": 326, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6b1317efe9d94db573d26", "name": "PreCog Sweep - 2026-03-03 10h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T10:00:17.455000", "created": "2026-03-03T10:00:17.455000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 184, "domain": 102, "URL": 40 }, "indicator_count": 326, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6aa271320d8322fa8ad26", "name": "PreCog Sweep - 2026-03-03 09h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T09:30:15.742000", "created": "2026-03-03T09:30:15.742000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 184, "domain": 102, "URL": 40 }, "indicator_count": 326, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6a31fdeaafd348b28c755", "name": "PreCog Sweep - 2026-03-03 09h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T09:00:15.765000", "created": "2026-03-03T09:00:15.765000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 100, "hostname": 182, "URL": 39 }, "indicator_count": 321, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a69c173d2a34fe621ab4ac", "name": "PreCog Sweep - 2026-03-03 08h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T08:30:15.954000", "created": "2026-03-03T08:30:15.954000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 149, "URL": 38, "domain": 103 }, "indicator_count": 290, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a695103bd330b834f1ba51", "name": "PreCog Sweep - 2026-03-03 08h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T08:00:16.759000", "created": "2026-03-03T08:00:16.759000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 103, "hostname": 164, "URL": 46 }, "indicator_count": 313, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a68e0701ac97bffe4ec8c8", "name": "PreCog Sweep - 2026-03-03 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T07:30:15.794000", "created": "2026-03-03T07:30:15.794000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 164, "domain": 102, "URL": 47 }, "indicator_count": 313, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a68700e945342e51ee6aab", "name": "PreCog Sweep - 2026-03-03 07h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T07:00:16.656000", "created": "2026-03-03T07:00:16.656000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 162, "domain": 102, "URL": 52 }, "indicator_count": 316, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a67ff79c45c3a5f65459c5", "name": "PreCog Sweep - 2026-03-03 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T06:30:15.792000", "created": "2026-03-03T06:30:15.792000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 162, "domain": 102, "URL": 54 }, "indicator_count": 318, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a678ef4d0928acb69b20c4", "name": "PreCog Sweep - 2026-03-03 06h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T06:00:15.744000", "created": "2026-03-03T06:00:15.744000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 56, "domain": 102, "hostname": 160 }, "indicator_count": 318, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a671e842bd450e81cd0c24", "name": "PreCog Sweep - 2026-03-03 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T05:30:16.538000", "created": "2026-03-03T05:30:16.538000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 56, "domain": 102, "hostname": 160 }, "indicator_count": 318, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a66ae1c6aa4e75f6d165c6", "name": "PreCog Sweep - 2026-03-03 05h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T05:00:17.026000", "created": "2026-03-03T05:00:17.026000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 102, "hostname": 160, "URL": 56 }, "indicator_count": 318, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a663d8558141ca2f39e311", "name": "PreCog Sweep - 2026-03-03 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T04:30:16.709000", "created": "2026-03-03T04:30:16.709000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 160, "domain": 101, "URL": 57 }, "indicator_count": 318, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a65cd5fc5da2b8eacdd3f9", "name": "PreCog Sweep - 2026-03-03 04h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T04:00:21.579000", "created": "2026-03-03T04:00:21.579000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 159, "domain": 101, "URL": 70 }, "indicator_count": 330, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a655c7103d0cb37f574c10", "name": "PreCog Sweep - 2026-03-03 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T03:30:15.925000", "created": "2026-03-03T03:30:15.925000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 159, "domain": 101, "URL": 70 }, "indicator_count": 330, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a64ec03804c2187f6128d9", "name": "PreCog Sweep - 2026-03-03 03h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T03:00:16.402000", "created": "2026-03-03T03:00:16.402000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 101, "hostname": 157, "URL": 73 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a647b772b81874533b4639", "name": "PreCog Sweep - 2026-03-03 02h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T02:30:15.712000", "created": "2026-03-03T02:30:15.712000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 101, "hostname": 157, "URL": 73 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a640b0663d04e5b9a3a682", "name": "PreCog Sweep - 2026-03-03 02h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T02:00:16.462000", "created": "2026-03-03T02:00:16.462000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 157, "domain": 100, "URL": 74 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a639a7babb7de79cad2563", "name": "PreCog Sweep - 2026-03-03 01h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T01:30:15.950000", "created": "2026-03-03T01:30:15.950000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 157, "domain": 100, "URL": 74 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a632a1c72ed6f7c507a432", "name": "PreCog Sweep - 2026-03-03 01h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T01:00:17.341000", "created": "2026-03-03T01:00:17.341000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 157, "domain": 100, "URL": 74 }, "indicator_count": 331, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a62b98444523af731b1bd0", "name": "PreCog Sweep - 2026-03-03 00h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T00:30:16.531000", "created": "2026-03-03T00:30:16.531000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 100, "hostname": 156, "URL": 74 }, "indicator_count": 330, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a6249110d339e77f577f41", "name": "PreCog Sweep - 2026-03-03 00h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T00:00:16.978000", "created": "2026-03-03T00:00:16.978000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 105, "hostname": 163, "URL": 76 }, "indicator_count": 344, "is_author": false, "is_subscribing": null, "subscriber_count": 193, "modified_text": "90 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research", "https://labs.withsecure.com/publications/greyvibe", "https://ltna.com.au/cyber" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Legionrelay", "Princessclub", "Phantomrelayv1", "Greyvibe", "Dronelink", "Lookvaljs" ], "industries": [ "Energy", "Government", "Military" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 50, "pulses": [ { "id": "6a1ab6efb8f3c8da4f6b358c", "name": "GREYVIBE Threat Actor: TTPs, Malware, and Infrastructure Analysis.", "description": "GREYVIBE is a cyber threat actor identified by WithSecure, primarily targeting Ukraine and entities related to Ukraine since August 2025. The group's activities show significant overlaps in their attack infrastructure and operational methodologies, which indicate a persistent campaign aligned with Russian state interests, especially in the context of the Russia-Ukraine war. GREYVIBE's operations have been characterized by the use of various attack vectors, including spear-phishing emails, fake captcha pages, and fraudulent websites impersonating Ukrainian organizations. These methods have facilitated the distribution of malware, predominantly custom-developed variants like PhantomRelay, FallSpy, and LegionRelay.", "modified": "2026-05-30T10:12:00.827000", "created": "2026-05-30T10:07:43.020000", "tags": [ "research", "whitepaper", "mohammad kazem hassan nejad", "2026", "powershell", "fallspy", "legionrelay", "lookvalps", "lookvaljs", "javascript", "daylight", "teasoup", "android spyware", "august", "telegram", "dronelink", "princessclub", "phantomrelayv1", "greyvibe", "domain name", "phantommail", "sha256", "domain", "development", "phantomclick", "club site", "teams", "kongtuke", "april", "nsis", "service", "impacket" ], "references": [ "https://labs.withsecure.com/publications/greyvibe" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "LegionRelay", "display_name": "LegionRelay", "target": null }, { "id": "DroneLink", "display_name": "DroneLink", "target": null }, { "id": "PrincessClub", "display_name": "PrincessClub", "target": null }, { "id": "PhantomRelayV1", "display_name": "PhantomRelayV1", "target": null }, { "id": "LOOKVALJS", "display_name": "LOOKVALJS", "target": null }, { "id": "GREYVIBE", "display_name": "GREYVIBE", "target": null } ], "attack_ids": [ { "id": "T1005", "name": "Data from Local System", "display_name": "T1005 - Data from Local System" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1021.001", "name": "Remote Desktop Protocol", "display_name": "T1021.001 - Remote Desktop Protocol" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1041", "name": "Exfiltration Over C2 Channel", "display_name": "T1041 - Exfiltration Over C2 Channel" }, { "id": "T1059.001", "name": "PowerShell", "display_name": "T1059.001 - PowerShell" }, { "id": "T1059.003", "name": "Windows Command Shell", "display_name": "T1059.003 - Windows Command Shell" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" } ], "industries": [ "Military", "Government", "Energy" ], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "PetrP.73", "id": "154605", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 55, "FileHash-MD5": 14, "FileHash-SHA1": 13, "FileHash-SHA256": 67, "IPv4": 9, "URL": 3, "hostname": 4 }, "indicator_count": 165, "is_author": false, "is_subscribing": null, "subscriber_count": 542, "modified_text": "1 day ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "5fa1852d337eca8e99c2ec32", "name": "Malware - Malware Domain Feed V2 - November 03 2020", "description": "Command and Control domains for Malware. These domains are extracted from a number of sources, and are suspicious.", "modified": "2026-05-30T03:19:46.084000", "created": "2020-11-03T16:28:29.011000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 553456, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 3, "follower_count": 0, "vote": 0, "author": { "username": "otxrobottwo", "id": "78495", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 49967, "domain": 75353 }, "indicator_count": 125320, "is_author": false, "is_subscribing": null, "subscriber_count": 1727, "modified_text": "2 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aed5f47baf25a1d6c8b3dc", "name": "Payload_Delivery | Mar 10, 2026", "description": "Payload_Delivery indicators. Date: Mar 10, 2026. Total: 1915 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-09T14:15:16.856000", "created": "2026-03-09T14:15:16.856000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 928, "domain": 296, "URL": 260, "FileHash-SHA256": 147, "FileHash-MD5": 141, "FileHash-SHA1": 137 }, "indicator_count": 1909, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "83 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ad82b9997c1b840f57babd", "name": "Payload_Delivery | Mar 9, 2026", "description": "Payload_Delivery indicators. Date: Mar 9, 2026. Total: 1632 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-08T14:07:53.390000", "created": "2026-03-08T14:07:53.390000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 743, "URL": 189, "domain": 279, "FileHash-MD5": 141, "FileHash-SHA1": 137, "FileHash-SHA256": 138 }, "indicator_count": 1627, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "84 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69ac31e3dd28f6cb8ab73a3e", "name": "Payload_Delivery | Mar 8, 2026", "description": "Payload_Delivery indicators. Date: Mar 8, 2026. Total: 1526 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-07T14:10:43.097000", "created": "2026-03-07T14:10:43.097000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 570, "domain": 302, "URL": 284, "FileHash-SHA1": 120, "FileHash-SHA256": 121, "FileHash-MD5": 124 }, "indicator_count": 1521, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "85 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69aadf17b6a785e92897bbec", "name": "Payload_Delivery | Mar 7, 2026", "description": "Payload_Delivery indicators. Date: Mar 7, 2026. Total: 1249 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-06T14:05:11.516000", "created": "2026-03-06T14:05:11.516000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 440, "domain": 319, "URL": 290, "FileHash-MD5": 67, "FileHash-SHA256": 64, "FileHash-SHA1": 63 }, "indicator_count": 1243, "is_author": false, "is_subscribing": null, "subscriber_count": 91, "modified_text": "86 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a98e6627158c25a08d6a69", "name": "Payload_Delivery | Mar 6, 2026", "description": "Payload_Delivery indicators. Date: Mar 6, 2026. Total: 1141 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-05T14:08:38.726000", "created": "2026-03-05T14:08:38.726000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 302, "domain": 358, "URL": 281, "FileHash-MD5": 67, "FileHash-SHA256": 64, "FileHash-SHA1": 63 }, "indicator_count": 1135, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "87 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a83d131507e8566b447349", "name": "Payload_Delivery | Mar 5, 2026", "description": "Payload_Delivery indicators. Date: Mar 5, 2026. Total: 905 indicators. For more threat intelligence visit https://ltna.com.au/cyber", "modified": "2026-03-04T14:09:23.204000", "created": "2026-03-04T14:09:23.204000", "tags": [ "payload_delivery" ], "references": [ "https://ltna.com.au/cyber" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "LTNA-Australia", "id": "380633", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_380633/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 191, "hostname": 209, "domain": 305, "FileHash-MD5": 67, "FileHash-SHA256": 64, "FileHash-SHA1": 63 }, "indicator_count": 899, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "88 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a73dcffd2b4f393a53bea2", "name": "PreCog Sweep - 2026-03-03 20h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T20:00:15.395000", "created": "2026-03-03T20:00:15.395000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 107, "URL": 44, "domain": 71 }, "indicator_count": 222, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69a736c6ad01ad8cb3a1936a", "name": "PreCog Sweep - 2026-03-03 19h", "description": "Novel threat indicators detected by PreCog Sweep Engine", "modified": "2026-03-03T19:30:14.427000", "created": "2026-03-03T19:30:14.427000", "tags": [ "precog", "automated", "novel-ioc", "c2", "malware" ], "references": [ "https://analytics.dugganusa.com/api/v1/stix/master", "https://github.com/pduggusa/dugganusa-research" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "pduggusa", "id": "371400", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_371400/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 107, "domain": 69, "URL": 47 }, "indicator_count": 223, "is_author": false, "is_subscribing": null, "subscriber_count": 192, "modified_text": "89 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "xpertlearninghub.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "xpertlearninghub.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780284854.161608 }