{ "type": "Domain", "indicator": "ydray.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/ydray.com", "alexa": "http://www.alexa.com/siteinfo/ydray.com", "indicator": "ydray.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 404593, "indicator": "ydray.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "6758d6b3e0c841ad80ceb0f0", "name": "URLHaus data - 10-12-2024", "description": "", "modified": "2025-01-10T00:01:00.333000", "created": "2024-12-11T00:02:58.919000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "mirai", "APT", "censys", "injector", "SilverFox", "ValleyRAT", "zip", "apk", "ascii", "powershell", "ps1", "redir-302", "Rhadamanthys", "exe", "bat", "SnakeKeylogger", "KongTuke", "FYU789", "pw-FYU789", "remcos", "AsyncRAT", "G6T3GD", "pw-G6T3GD", "Encoded", "opendir", "rev-base64-loader", "base64-loader", "vbs", "programmmersj69", "spymax", "SpyNote", "js", "MintsLoader" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 7, "hostname": 3 }, "indicator_count": 1010, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "674512ccd78ed29db9d2a7eb", "name": "URLHaus data - 25-11-2024", "description": "", "modified": "2024-12-26T00:00:44.753000", "created": "2024-11-26T00:14:04.387000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ascii", "ps1", "ua-wget", "hajime", "exe", "QuasarRAT", "zip", "povertystealer", "opendir", "Kaiji", "BlackMoon", "sh", "bitbucket", "VenomRAT", "LummaStealer", "DarkTortilla", "AsyncRAT", "MAC741", "pw-MAC741", "G2024FG", "pw-G2024FG", "GY73VF5", "pw-GY73VF5", "SnakeKeylogger", "NetSupport", "encrypted", "GuLoader", "Vidar", "x86-32", "xworm", "ClickFix", "html", "mshta", "RedLineStealer", "GootLoader", "malware", "gafgyt", "Encoded", "rev-base64-loader", "vbs", "AgentTesla", "msi", "rat", "RemcosRAT", "encrpyted", "bazaloader", "Formbook", "SocGholish" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 56, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 10, "domain": 10 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "671ad40b4afa0ab5fb455c3b", "name": "URLHaus data - 24-10-2024", "description": "", "modified": "2024-11-23T23:00:05.926000", "created": "2024-10-24T23:11:07.832000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "SocGholish", "zip", "ps1", "hacktool", "ngrok", "opendir", "RDPWrap", "bat", "Alien", "exe", "AsyncRAT", "pw-TF92GJ", "TF92GJ", "6681", "pw-6681", "remcos", "hajime", "CoinMiner", "Stealc", "32", "sparc", "SnakeKeylogger", "PowerPC", "motorola", "renesas", "x86-32", "ua-wget", "gafgyt" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 2 }, "indicator_count": 1006, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "556 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "671198a61875a7929fb35153", "name": "URLHaus data - 17-10-2024", "description": "", "modified": "2024-11-16T23:03:46.606000", "created": "2024-10-17T23:07:16.524000", "tags": [ "32", "bashlite", "elf", "gafgyt", "sparc", "32-bit", "mips", "Mozi", "intel", "mirai", "ua-wget", "sh", "arm", "exe", "motorola", "64-bit", "x86-64", "qkdjdjj22", "botnet", "fbi.gov", "moobot", "Okiru", "Yakuza", "94.159.113.48", "DEU", "dll", "geofenced", "StrelaStealer", "opendir", "SocGholish", "ascii", "Encoded", "GuLoader", "encrypted", "PureLogStealer", "64", "AsyncRAT", "HG620GF", "pw-HG620GF", "Amadey", "stealer", "meterpreter", "pw-TF398FD", "TF398FD", "16OCT2024ESM", "pw-16OCT2024ESM", "CoinMiner", "xmrig", "Havoc", "AgentTesla", "androm", "backdoor", "dropped_file", "hitbrovi", "trojan", "bin", "exploit", "marte", "Formbook", "rev-base64-loader", "vbs", "hacktool", "fake-msf-defender", "dcrat", "fake-protonvpn", "ps", "ps1", "powersploit", "LummaStealer", "zip", "hta", "powershell", "SnakeKeylogger", "batch", "rat", "RemcosRAT", "vjw0rm", "ddos", "VIPKeylogger", "RedLine", "SectopRAT", "MassLogger", "bruteratel", "msi", "Stealc", "linpeas", "c2", "ransomhub", "javascript" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 77, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 14, "hostname": 6 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "563 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6582d2441e06aff3a1cc218b", "name": "Orpheus TTPs November 2023", "description": "", "modified": "2023-12-20T11:38:44.558000", "created": "2023-12-20T11:38:44.558000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ManagedSIEMTeam", "id": "111951", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 4, "is_author": false, "is_subscribing": null, "subscriber_count": 50, "modified_text": "896 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "6758d6b3e0c841ad80ceb0f0", "name": "URLHaus data - 10-12-2024", "description": "", "modified": "2025-01-10T00:01:00.333000", "created": "2024-12-11T00:02:58.919000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "hajime", "mirai", "APT", "censys", "injector", "SilverFox", "ValleyRAT", "zip", "apk", "ascii", "powershell", "ps1", "redir-302", "Rhadamanthys", "exe", "bat", "SnakeKeylogger", "KongTuke", "FYU789", "pw-FYU789", "remcos", "AsyncRAT", "G6T3GD", "pw-G6T3GD", "Encoded", "opendir", "rev-base64-loader", "base64-loader", "vbs", "programmmersj69", "spymax", "SpyNote", "js", "MintsLoader" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 7, "hostname": 3 }, "indicator_count": 1010, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "509 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "674512ccd78ed29db9d2a7eb", "name": "URLHaus data - 25-11-2024", "description": "", "modified": "2024-12-26T00:00:44.753000", "created": "2024-11-26T00:14:04.387000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "ascii", "ps1", "ua-wget", "hajime", "exe", "QuasarRAT", "zip", "povertystealer", "opendir", "Kaiji", "BlackMoon", "sh", "bitbucket", "VenomRAT", "LummaStealer", "DarkTortilla", "AsyncRAT", "MAC741", "pw-MAC741", "G2024FG", "pw-G2024FG", "GY73VF5", "pw-GY73VF5", "SnakeKeylogger", "NetSupport", "encrypted", "GuLoader", "Vidar", "x86-32", "xworm", "ClickFix", "html", "mshta", "RedLineStealer", "GootLoader", "malware", "gafgyt", "Encoded", "rev-base64-loader", "vbs", "AgentTesla", "msi", "rat", "RemcosRAT", "encrpyted", "bazaloader", "Formbook", "SocGholish" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 56, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 10, "domain": 10 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "524 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "671ad40b4afa0ab5fb455c3b", "name": "URLHaus data - 24-10-2024", "description": "", "modified": "2024-11-23T23:00:05.926000", "created": "2024-10-24T23:11:07.832000", "tags": [ "32-bit", "elf", "mips", "Mozi", "arm", "mirai", "SocGholish", "zip", "ps1", "hacktool", "ngrok", "opendir", "RDPWrap", "bat", "Alien", "exe", "AsyncRAT", "pw-TF92GJ", "TF92GJ", "6681", "pw-6681", "remcos", "hajime", "CoinMiner", "Stealc", "32", "sparc", "SnakeKeylogger", "PowerPC", "motorola", "renesas", "x86-32", "ua-wget", "gafgyt" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 44, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "hostname": 4, "domain": 2 }, "indicator_count": 1006, "is_author": false, "is_subscribing": null, "subscriber_count": 1624, "modified_text": "556 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "671198a61875a7929fb35153", "name": "URLHaus data - 17-10-2024", "description": "", "modified": "2024-11-16T23:03:46.606000", "created": "2024-10-17T23:07:16.524000", "tags": [ "32", "bashlite", "elf", "gafgyt", "sparc", "32-bit", "mips", "Mozi", "intel", "mirai", "ua-wget", "sh", "arm", "exe", "motorola", "64-bit", "x86-64", "qkdjdjj22", "botnet", "fbi.gov", "moobot", "Okiru", "Yakuza", "94.159.113.48", "DEU", "dll", "geofenced", "StrelaStealer", "opendir", "SocGholish", "ascii", "Encoded", "GuLoader", "encrypted", "PureLogStealer", "64", "AsyncRAT", "HG620GF", "pw-HG620GF", "Amadey", "stealer", "meterpreter", "pw-TF398FD", "TF398FD", "16OCT2024ESM", "pw-16OCT2024ESM", "CoinMiner", "xmrig", "Havoc", "AgentTesla", "androm", "backdoor", "dropped_file", "hitbrovi", "trojan", "bin", "exploit", "marte", "Formbook", "rev-base64-loader", "vbs", "hacktool", "fake-msf-defender", "dcrat", "fake-protonvpn", "ps", "ps1", "powersploit", "LummaStealer", "zip", "hta", "powershell", "SnakeKeylogger", "batch", "rat", "RemcosRAT", "vjw0rm", "ddos", "VIPKeylogger", "RedLine", "SectopRAT", "MassLogger", "bruteratel", "msi", "Stealc", "linpeas", "c2", "ransomhub", "javascript" ], "references": [ "https://urlhaus.abuse.ch/browse/" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 77, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "CyberHunterAutoFeed", "id": "182496", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1000, "domain": 14, "hostname": 6 }, "indicator_count": 1020, "is_author": false, "is_subscribing": null, "subscriber_count": 1625, "modified_text": "563 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6582d2441e06aff3a1cc218b", "name": "Orpheus TTPs November 2023", "description": "", "modified": "2023-12-20T11:38:44.558000", "created": "2023-12-20T11:38:44.558000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ManagedSIEMTeam", "id": "111951", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 1, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 4, "is_author": false, "is_subscribing": null, "subscriber_count": 50, "modified_text": "896 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "ydray.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "ydray.com", "found": true, "verdict": "malicious", "url_count": 9, "online_count": 0, "blacklists": { "spamhaus_dbl": "not listed", "surbl": "not listed" }, "urls": [ { "url": "https://ydray.com/get/t/u17333423791033sLyb8e7c04b4bd1beh?id=1c96f83c-41b7-42cb-b96d-b60d57fcef83", "status": "offline", "threat": "malware_download", "date_added": "2024-12-10", "tags": [ "AsyncRAT", "G6T3GD", "pw-G6T3GD" ] }, { "url": "https://ydray.com/get/t/u17322046861784hvAk732f9c5d264aDy", "status": "offline", "threat": "malware_download", "date_added": "2024-11-25", "tags": [ "AsyncRAT", "GY73VF5", "pw-GY73VF5" ] }, { "url": "https://ydray.com/get/t/u17301338698058vULh2b415048c9ceDy", "status": "offline", "threat": "malware_download", "date_added": "2024-10-29", "tags": [ "AsyncRAT", "GT691HJ", "pw-GT691HJ" ] }, { "url": "https://ydray.com/get/t/u17296973057724SRrJe56b919a0b2duF", "status": "offline", "threat": "malware_download", "date_added": "2024-10-25", "tags": [ "AsyncRAT", "pw-TF92GJ", "TF92GJ" ] }, { "url": "https://ydray.com/get/t/u17297082277942LlVz99ed31f68eabfM", "status": "offline", "threat": "malware_download", "date_added": "2024-10-25", "tags": [ "23OCT2024ESM", "AsyncRAT", "pw-23OCT2024ESM" ] }, { "url": "https://ydray.com/get/t/u1729697424183SLWs5d074ca2323fBT", "status": "offline", "threat": "malware_download", "date_added": "2024-10-24", "tags": [ "AsyncRAT", "pw-TF92GJ", "TF92GJ" ] }, { "url": "https://ydray.com/get/t/u17296395283148YiFnaad6e7290179IF", "status": "offline", "threat": "malware_download", "date_added": "2024-10-24", "tags": [ "22OCT2024ESM", "AsyncRAT", "pw-22OCT2024ESM" ] }, { "url": "https://ydray.com/get/t/u17296429169844EgxWc532b4f9c2bfNk", "status": "offline", "threat": "malware_download", "date_added": "2024-10-24", "tags": [ "22OCT2024ESM", "AsyncRAT", "pw-22OCT2024ESM" ] }, { "url": "https://ydray.com/get/t/u17290663674746gFwb38bd70be00c5oQ", "status": "offline", "threat": "malware_download", "date_added": "2024-10-17", "tags": [ "16OCT2024ESM", "AsyncRAT", "pw-16OCT2024ESM" ] } ], "error": null }, "from_cache": true, "_cached_at": 1780526150.2041528 }