{ "type": "Domain", "indicator": "yaipool.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/yaipool.com", "alexa": "http://www.alexa.com/siteinfo/yaipool.com", "indicator": "yaipool.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4003286218, "indicator": "yaipool.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "679473f2278902e5b84b644b", "name": "clickfix", "description": "", "modified": "2025-03-02T00:03:08.022000", "created": "2025-01-25T05:17:38.761000", "tags": [ "fakecaptcha" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 75, "hostname": 46 }, "indicator_count": 121, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "455 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "672d58413e1c4de26a69a099", "name": "URLHaus data - 07-11-2024", "description": "", "modified": "2024-12-08T00:03:38.154000", "created": "2024-11-08T00:16:01.297000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ua-wget", "exe", "msi", "opendir", "rar", "zip", "CobaltStrike", "dll", "github", "b-cdn", "ps1", "hajime", "shellcode", "webdav", "sh", "base64", "Encoded", "NetSupportRAT", "SmartApeSG", "ASPXShell", "32", "qbot", "PureLogStealer", "AsyncRAT", "docx", "donutmarte", "rev-base64-loader", "reverse_base64", "Formbook", "NanoCore", "AgentTesla", "encoded_base64", "hta", "VIPKeylogger", "CHE", "geofenced", "CoinMiner", "redtail", "RedLineStealer", "HeliBot", "gafgyt", "shellscript", "Metasploit", "batch", "VenomRAT", "Loki", "rev_base_64", "hacktool", "assailant", "nitol", "sparc", "PowerPC", "motorola", "renesas", "ddos", "JasonRAT", "xworm", "SystemBC", "Aktia", "Braodo", "stealer", "png", "connectwise", "RemcosRAT", "WhiteSnakeStealer", "BRA", "PDF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 8, "hostname": 7 }, "indicator_count": 1015, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "539 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "679473f2278902e5b84b644b", "name": "clickfix", "description": "", "modified": "2025-03-02T00:03:08.022000", "created": "2025-01-25T05:17:38.761000", "tags": [ "fakecaptcha" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 75, "hostname": 46 }, "indicator_count": 121, "is_author": false, "is_subscribing": null, "subscriber_count": 182, "modified_text": "455 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "672d58413e1c4de26a69a099", "name": "URLHaus data - 07-11-2024", "description": "", "modified": "2024-12-08T00:03:38.154000", "created": "2024-11-08T00:16:01.297000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ua-wget", "exe", "msi", "opendir", "rar", "zip", "CobaltStrike", "dll", "github", "b-cdn", "ps1", "hajime", "shellcode", "webdav", "sh", "base64", "Encoded", "NetSupportRAT", "SmartApeSG", "ASPXShell", "32", "qbot", "PureLogStealer", "AsyncRAT", "docx", "donutmarte", "rev-base64-loader", "reverse_base64", "Formbook", "NanoCore", "AgentTesla", "encoded_base64", "hta", "VIPKeylogger", "CHE", "geofenced", "CoinMiner", "redtail", "RedLineStealer", "HeliBot", "gafgyt", "shellscript", "Metasploit", "batch", "VenomRAT", "Loki", "rev_base_64", "hacktool", "assailant", "nitol", "sparc", "PowerPC", "motorola", "renesas", "ddos", "JasonRAT", "xworm", "SystemBC", "Aktia", "Braodo", "stealer", "png", "connectwise", "RemcosRAT", "WhiteSnakeStealer", "BRA", "PDF" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 66, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 8, "hostname": 7 }, "indicator_count": 1015, "is_author": false, "is_subscribing": null, "subscriber_count": 1621, "modified_text": "539 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "yaipool.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "yaipool.com", "found": true, "verdict": "malicious", "url_count": 1, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://yaipool.com/dropbeast.exe", "status": "offline", "threat": "malware_download", "date_added": "2024-11-07", "tags": [ "exe" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780225703.773795 }