{ "type": "Domain", "indicator": "z.id", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/z.id", "alexa": "http://www.alexa.com/siteinfo/z.id", "indicator": "z.id", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3155961584, "indicator": "z.id", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "65709632333f37e8de4185e9", "name": "whitelisted angular.js", "description": "", "modified": "2023-12-06T15:41:38.498000", "created": "2023-12-06T15:41:38.498000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 245, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 424, "hostname": 466, "URL": 1805 }, "indicator_count": 3193, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708b83a04606c605361cb6", "name": "Nearly ALL App Store VPNs are a huge vulnerability", "description": "", "modified": "2023-12-06T14:56:03.320000", "created": "2023-12-06T14:56:03.320000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 267, "hostname": 78, "URL": 346, "FileHash-SHA256": 79, "email": 4 }, "indicator_count": 774, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708b72abe90961af1737c9", "name": "reCAPTCHA", "description": "", "modified": "2023-12-06T14:55:46.172000", "created": "2023-12-06T14:55:46.172000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 362, "domain": 330, "URL": 1790, "hostname": 586, "email": 1 }, "indicator_count": 3069, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04d8e7541291b89f4a1", "name": "whitelisted angular.js", "description": "", "modified": "2023-02-18T15:00:23.103000", "created": "2023-01-19T06:16:45.770000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1843, "hostname": 471, "domain": 246, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 444, "CVE": 1 }, "indicator_count": 3257, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04f8962fa3ac0c7eb77", "name": "whitelisted angular.js", "description": "", "modified": "2023-01-19T06:16:47.672000", "created": "2023-01-19T06:16:47.672000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 408, "hostname": 48, "domain": 59, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 518, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1228 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62630579f28f0ade0c9fb8fb", "name": "Cera networks , hive, hurricane electric ..etc\u2026 \u201ccolos\u201d(plural) or \u201ccolocation\u201d", "description": "function lz_jssess, a new type of browser, is a two-way system, which allows the browser to talk to the other side of the screen.. the following:", "modified": "2022-05-22T00:01:01.264000", "created": "2022-04-22T19:43:53.501000", "tags": [ "ovlcwm", "activedocument", "null", "span", "date", "file", "livezilladata", "regexp", "amount", "email", "function", "filereader", "checkbox", "window", "false", "path", "trident", "template", "typeof define", "typeof", "lztextlink", "script", "lzrscr", "scrb64d", "typeof b", "error", "pseudo", "child", "array", "sufeffxa0", "class", "attr", "void", "lzsds", "lzsde", "lzsdeg", "cant load", "gv1023" ], "references": [ "xfe-URL-ceranetworks.com-stix2-2.1-export.json", "https://www.ceranetworks.com/livechat/resource.php?t=js&1=jsglobal.min.js&2=jsbox.min.js&3=jstrack.min.js&v=ahgzixd7&4=jsextern.min.js", "https://www.ceranetworks.com/public/static/js/jquery@1.12.4.min.js", "https://www.ceranetworks.com/livechat/server.php?rqst=track&output=jcrpt&hfk=MQ__&ovlv=djI_&ovltwo=MQ__&ovlc=MQ__&esc=IzJlOGFlNQ__&epc=IzMwOTFmMg__&ovlts=MA__&hfk=MQ__&ovlapo=MQ__&nse=0.7916382809044465", "https://www.ceranetworks.com/livechat/script.php?id=d708615a9293e1bcec892afb03bd2b45", "https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js", "https://www.ceranetworks.com/livechat/geo.php?a=1&gv=1023&method=lz_tracking_geo_result&spanm=lz_tracking_set_geo_span&oak=" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ActiveDocument", "display_name": "ActiveDocument", "target": null }, { "id": "OVLCWM", "display_name": "OVLCWM", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 306, "URL": 753, "FileHash-SHA256": 42, "domain": 114 }, "indicator_count": 1215, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1470 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6253b49ac7891a2ad1ab0d09", "name": "Nearly ALL App Store VPNs are a huge vulnerability", "description": "Zt, Z.Z.r, is a new-found acronym for the word \"zt\", which means \"targuments\" or \"farg\" in the same place as the original.", "modified": "2022-05-11T00:02:13.446000", "created": "2022-04-11T04:54:50.508000", "tags": [ "ratio", "regexp", "apple iphone", "apple ipad", "apple ipod", "xmlhttprequest", "post", "contenttype", "text", "function", "symbol", "typeof", "null", "macintel", "attention", "please", "vpn app", "install details", "\u2019m", "purevpn: fast", "secure & easy", "purevpn", "productivity", "utilities", "ios apps", "app", "appstore", "app store", "iphone", "ipad", "ipod touch", "itouch", "itunes", "fast", "secure", "easy", "subscription", "requires", "global nav", "alwayson", "audit", "vpn connection", "service", "download", "enjoy", "first", "kill", "rest", "italian", "korean", "vpn - ip changer & security id", "energise inc", "data", "app privacy", "data privacy", "learn", "sans", "woff", "fontface", "u1c801c88", "u20b4", "u2de02dff", "ua640a69f", "ufe2efe2f", "u04b004b1", "u2116", "truetype", "start", "webflow css", "policy", "crowd ab", "university", "log data", "conditions", "third party", "1px1px", "sf ui", "sf pro", "helvetica", "arial", "alpha", "opacity", "icons", "misc", "overlays", "opacity35", "foundation", "layout", "opacity0", "spinner", "android", "object", "string", "number", "window", "date", "promise", "array", "error", "this", "void", "screen", "typeerror", "invalid attempt" ], "references": [ "xfe-URL-dk9ctyhidjrvgn.xyz-stix2-2.1-export.json", "https://unphionetor.com/fv.js?t=56193&cb=200694599", "https://ptauxofi.net/pfe/current/micro.tag.min.js?sw=/sw-check-permissions/3683319&var=iUnZZblURYgnN6e&z=3683319", "https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.css", "https://littlecdn.com/apps/templates/video/ytube-player-system-message/css/style.css?v=1.0", "https://saumeechoa.com/?track=aHR0cHM6Ly90cmFja2luZy51bml2ZXJzZXZwbi51cy9jbGljaz9waWQ9NjcxNSZvZmZlcl9pZD0yMTI3NDYmc3ViMT01MzcyMzcxNDM4NjU4ODkwNzImc3ViMj0yNjI3MzI1&meta-id=Nzc0OTkw&brandSafe=0&rsz=2627325&cd_meta_crid=25922&meta-tracking-id=17537694&s=537237143865889072&z=2627325&b=12554414&g=US&svar=1649650835&ssk=bcc25276d94a6fa37bb24c13fd15de7a&oaid=42988e84a84a44628299d1d3d4b64ca7&did=4&campid=5453729", "https://univvpn.page.link/jdF1?utm_medium=paid%20advertising&_branch_referrer=H4sIAAAAAAAAAx3Juw6DIBQA0K%2Bxo8JFQJqQTh2bdOtILo%2BqEZEIDvbrm3Y9Z6o1l2vXxRGGscWc2zinpZPn5yle%2BTEme2ugZ1mjcUep22oooUICp0woNfAegKtLI%2B8luC153E%2BTDxvnMoVdC0n573JEF9aQqgYBksEf0ZvZawGcYaBqcG%2BhLCGEoreesS%2BPLJI5mAAAAA%3D%3D&%243p=a_custom_1016725136998542259&~secondary_publisher=6715&~placement=2627325&~ad_id=6253ae198cf69b0001adbd33&_branch_match_id=1041559436699840584", "https://locationvpn.info/landers/swvpn/p25f_prop/styles.css", "https://fonts.googleapis.com/css?family=Open+Sans:700,300", "https://easyvpn.app.link/Hsj5csEsrob?%243p=a_custom_1032593427266339085&~click_id=b4f8buqlp9zvrbed&~trafficsource=propellerads&~externalid=537238981268836734&~camp=92&~channel=propellerads&~campaign_id=92&~campaign=92", "https://cdrvrs.com/4/1008180?var=2627325&rsz=2627325", "https://app.adjust.com/jt7cgc7?campaign=4969955&adgroup=1008180&creative=12542008&redirect_windows=https://billing.purevpn.com/aff.php?aff=45706&chan=propeller&event_callback_bs7gvg=http%3A%2F%2Fad.propellerads.com%2Fconversion.php%3Faid%3D3414548%26pid%3D%26tid%3D84891%26visitor_id%3D537239929124823177%26payout%3D$%7BPAYOUT%7D%26zoneid%3D$4969955", "https://bestfasttrackservices.com/landers/d/player_default1/?&domain=besttvllc.com&uclick=g6bg8rsc6o&uclickhash=g6bg8rsc6o-g6bg8rsc6o-gha4-0-xra3-4kghfe-4kirbl-015263", "https://bestfasttrackservices.com/landers/d/player_default1/current-device.min.js", "https://bestfasttrackservices.com/landers/d/player_default1/send.js" ], "public": 1, "adversary": "", "targeted_countries": [ "Russian Federation", "Australia", "Romania" ], "malware_families": [ { "id": "\u2019m", "display_name": "\u2019m", "target": null } ], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 267, "URL": 346, "hostname": 78, "FileHash-SHA256": 79, "email": 4 }, "indicator_count": 774, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1481 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6252df03791ceb2df29742fe", "name": "reCAPTCHA", "description": "var a,r, i,o, r, c+(((s>>>16)*c&65535)<<16, as well as the Object, to be used as a decoder.", "modified": "2022-05-10T00:02:48.350000", "created": "2022-04-10T13:43:30.961000", "tags": [ "arial", "roboto", "helvetica neue", "typesubmit", "webkitkeyframes", "typeerror", "typeof t", "string", "object", "typeof e", "symbol", "typeof symbol", "typeof window", "typeof self", "typeof r", "date", "body", "html", "typeof n", "error", "version", "shown", "click", "dataspy", "trident", "window", "lpmlightbox", "messaging1", "chat0", "href", "tabindex", "copyright", "closure library", "info", "smsclientapi", "null", "typeof", "regexp", "debug", "chat", "scraper", "cookie", "stop", "iframe", "explorer", "small", "seppuku", "jsloader", "token", "viewed", "kbcontentclick", "blank", "post", "document", "typeof storage", "unknownerror", "element", "overquerylimit", "requestdenied", "zeroresults", "notfound", "node", "edge", "android", "unknown", "false", "june", "generator", "marker", "hybrid", "month", "azaz09", "hours", "function", "number", "fullyear", "controller", "christ", "sufeffxa0", "class", "attr", "pseudo", "child", "js foundation", "typeof module", "directclick", "x22loansx22", "x221x22", "9o7nxzt", "x22applyx22", "x3dw", "x3dnew", "x22pageloadx22", "x22scriptx22", "x22uetqx22", "viewcontent", "addtocart", "purchase", "array", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "license", "calltrkswap", "typeof s", "xmlhttprequest", "65535", "awindow", "cwm fjordbank", "activexobject", "tfunction", "sfunction", "yfunction", "googlendt" ], "references": [ "xfe-URL-ihagoogle.com-stix2-2.1-export.json", "http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js", "http://sedoparking.com/frmpark/ihagoogle.com/sedopark/park.js", "http://instantfwding.com/px.js?ch=1", "http://pxlgnpgecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=11&customerId=7CUHNT0E1", "https://pxlgnpgecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=11", "https://s.thebrighttag.com/tag?site=9O7NXzt&H=-5nu6gjg&referrer=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%253A%2520Zeal%2520Credit%2520Union%2520-%2520Mortgages%26utm_term%3Dhouse%2520mortgage%26utm_content%3DMortgage%2520General&docReferrer=http%3A%2F%2Finstantfwding.com%2F&mode=v2&cf=7500150%2C7500152&btpdb.9O7NXzt.dGZjLjc1MDAxNTE=UkVRVUVTVFMuMA&btpdb.9O7NXzt.dGZjLjc1MTUyNDU=U0VTU0lPTg&btpdb.9O7N", "https://cdn.callrail.com/companies/448598242/66d5efd6cbf06378ea1f/12/swap.js", "https://bat.bing.com/bat.js", "https://tag.perfectaudience.com/serve/5f59021d1911b61034000d8d.js", "https://s.thebrighttag.com/tag?site=9O7NXzt&referrer=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%253A%2520Zeal%2520Credit%2520Union%2520-%2520Mortgages%26utm_term%3Dhouse%2520mortgage%26utm_content%3DMortgage%2520General&docReferrer=http%3A%2F%2Finstantfwding.com%2F&H=-5nu6gjg", "https://code.jquery.com/jquery-3.4.1.min.js?ver=3.4.1", "https://integration.silvercloudinc.com/js/bundle/vendor.js", "https://maps.googleapis.com/maps/api/js?key=AIzaSyAMbtdeFB5s623T4LwRldWj_Vdy2t4wLkw&libraries=places", "https://lptag.liveperson.net/tag/tag.js?site=22027291", "https://integration.silvercloudinc.com/js/bundle/8.engageware-bundle.js", "https://lptag.liveperson.net/lptag/api/account/22027291/configuration/applications/taglets/.jsonp?v=2.0&df=2&b=2", "https://pixel-geo.prfct.co/tagjs?a_id=131352&source=js_tag", "https://bat.bing.com/p/action/56358236.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/388043112/?random=1649597062436&cv=9&fst=1649597062436&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa3u0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%3A%2520Zeal%2520Credit%2520", "https://lpcdn.lpsnmedia.net/le_re/3.50.0.1-release_5103/jsv2/overlay.js?_v=3.50.0.1-release_5103", "https://www.zealcu.org/app/uploads/cache/js/aggregated_single_eb9d05879e4cb943b965deb3cccf05ee.js", "https://integration.silvercloudinc.com/js/silvercloudjs/silvercloud.js", "https://js.callrail.com/group/0/66d5efd6cbf06378ea1f/02836fdf-c99c-4a90-b31b-373093db654e/poll.js?t=1649597153888&ids%5B%5D=448598242", "https://js.callrail.com/group/0/66d5efd6cbf06378ea1f/02836fdf-c99c-4a90-b31b-373093db654e/poll.js?t=1649598014683&ids%5B%5D=448598242", "https://www.zealcu.org/app/uploads/cache/css/aggregated_cd3154a65f0e94fa98c08398cba54caa.css", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfjFjMaAAAAACpmnf2RfTg2U2m4Cdnku25XccJW&co=aHR0cHM6Ly93d3cuemVhbGN1Lm9yZzo0NDM.&hl=en&v=Y-cOIEkAqcfDdup_qnnmkxIC&theme=light&size=normal&cb=j4msjl4zxy97", "https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1649597064004&loc=https%3A%2F%2Fwww.zealcu.org", "https://bid.g.doubleclick.net/xbbe/pixel?d=KAE" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1790, "hostname": 586, "FileHash-SHA256": 362, "domain": 330, "email": 1 }, "indicator_count": 3069, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1482 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://s.thebrighttag.com/tag?site=9O7NXzt&H=-5nu6gjg&referrer=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%253A%2520Zeal%2520Credit%2520Union%2520-%2520Mortgages%26utm_term%3Dhouse%2520mortgage%26utm_content%3DMortgage%2520General&docReferrer=http%3A%2F%2Finstantfwding.com%2F&mode=v2&cf=7500150%2C7500152&btpdb.9O7NXzt.dGZjLjc1MDAxNTE=UkVRVUVTVFMuMA&btpdb.9O7NXzt.dGZjLjc1MTUyNDU=U0VTU0lPTg&btpdb.9O7N", "https://easyvpn.app.link/Hsj5csEsrob?%243p=a_custom_1032593427266339085&~click_id=b4f8buqlp9zvrbed&~trafficsource=propellerads&~externalid=537238981268836734&~camp=92&~channel=propellerads&~campaign_id=92&~campaign=92", "http://sedoparking.com/frmpark/ihagoogle.com/sedopark/park.js", "https://www.ceranetworks.com/livechat/script.php?id=d708615a9293e1bcec892afb03bd2b45", "https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1649597064004&loc=https%3A%2F%2Fwww.zealcu.org", "https://www.ceranetworks.com/public/static/js/jquery@1.12.4.min.js", "https://littlecdn.com/apps/templates/video/ytube-player-system-message/css/style.css?v=1.0", "https://integration.silvercloudinc.com/js/bundle/8.engageware-bundle.js", "https://bestfasttrackservices.com/landers/d/player_default1/current-device.min.js", "https://bestfasttrackservices.com/landers/d/player_default1/send.js", "http://instantfwding.com/px.js?ch=1", "https://pixel-geo.prfct.co/tagjs?a_id=131352&source=js_tag", "https://js.callrail.com/group/0/66d5efd6cbf06378ea1f/02836fdf-c99c-4a90-b31b-373093db654e/poll.js?t=1649598014683&ids%5B%5D=448598242", "https://unphionetor.com/fv.js?t=56193&cb=200694599", "https://lptag.liveperson.net/tag/tag.js?site=22027291", "https://www.ceranetworks.com/livechat/geo.php?a=1&gv=1023&method=lz_tracking_geo_result&spanm=lz_tracking_set_geo_span&oak=", "https://pxlgnpgecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=11", "https://code.jquery.com/jquery-3.4.1.min.js?ver=3.4.1", "https://www.ceranetworks.com/livechat/server.php?rqst=track&output=jcrpt&hfk=MQ__&ovlv=djI_&ovltwo=MQ__&ovlc=MQ__&esc=IzJlOGFlNQ__&epc=IzMwOTFmMg__&ovlts=MA__&hfk=MQ__&ovlapo=MQ__&nse=0.7916382809044465", "https://www.zealcu.org/app/uploads/cache/css/aggregated_cd3154a65f0e94fa98c08398cba54caa.css", "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "https://integration.silvercloudinc.com/js/bundle/vendor.js", "https://lptag.liveperson.net/lptag/api/account/22027291/configuration/applications/taglets/.jsonp?v=2.0&df=2&b=2", "https://univvpn.page.link/jdF1?utm_medium=paid%20advertising&_branch_referrer=H4sIAAAAAAAAAx3Juw6DIBQA0K%2Bxo8JFQJqQTh2bdOtILo%2BqEZEIDvbrm3Y9Z6o1l2vXxRGGscWc2zinpZPn5yle%2BTEme2ugZ1mjcUep22oooUICp0woNfAegKtLI%2B8luC153E%2BTDxvnMoVdC0n573JEF9aQqgYBksEf0ZvZawGcYaBqcG%2BhLCGEoreesS%2BPLJI5mAAAAA%3D%3D&%243p=a_custom_1016725136998542259&~secondary_publisher=6715&~placement=2627325&~ad_id=6253ae198cf69b0001adbd33&_branch_match_id=1041559436699840584", "https://cdn.callrail.com/companies/448598242/66d5efd6cbf06378ea1f/12/swap.js", "https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.css", "https://maps.googleapis.com/maps/api/js?key=AIzaSyAMbtdeFB5s623T4LwRldWj_Vdy2t4wLkw&libraries=places", "https://locationvpn.info/landers/swvpn/p25f_prop/styles.css", "https://bat.bing.com/bat.js", "https://fonts.googleapis.com/css?family=Open+Sans:700,300", "https://integration.silvercloudinc.com/js/silvercloudjs/silvercloud.js", "https://js.callrail.com/group/0/66d5efd6cbf06378ea1f/02836fdf-c99c-4a90-b31b-373093db654e/poll.js?t=1649597153888&ids%5B%5D=448598242", "https://tag.perfectaudience.com/serve/5f59021d1911b61034000d8d.js", "https://bestfasttrackservices.com/landers/d/player_default1/?&domain=besttvllc.com&uclick=g6bg8rsc6o&uclickhash=g6bg8rsc6o-g6bg8rsc6o-gha4-0-xra3-4kghfe-4kirbl-015263", "http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js", "https://ptauxofi.net/pfe/current/micro.tag.min.js?sw=/sw-check-permissions/3683319&var=iUnZZblURYgnN6e&z=3683319", "https://s.thebrighttag.com/tag?site=9O7NXzt&referrer=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%253A%2520Zeal%2520Credit%2520Union%2520-%2520Mortgages%26utm_term%3Dhouse%2520mortgage%26utm_content%3DMortgage%2520General&docReferrer=http%3A%2F%2Finstantfwding.com%2F&H=-5nu6gjg", "https://cdrvrs.com/4/1008180?var=2627325&rsz=2627325", "https://www.zealcu.org/app/uploads/cache/js/aggregated_single_eb9d05879e4cb943b965deb3cccf05ee.js", "xfe-URL-dk9ctyhidjrvgn.xyz-stix2-2.1-export.json", "https://www.ceranetworks.com/livechat/resource.php?t=js&1=jsglobal.min.js&2=jsbox.min.js&3=jstrack.min.js&v=ahgzixd7&4=jsextern.min.js", "https://bat.bing.com/p/action/56358236.js", "xfe-URL-ihagoogle.com-stix2-2.1-export.json", "http://pxlgnpgecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=11&customerId=7CUHNT0E1", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfjFjMaAAAAACpmnf2RfTg2U2m4Cdnku25XccJW&co=aHR0cHM6Ly93d3cuemVhbGN1Lm9yZzo0NDM.&hl=en&v=Y-cOIEkAqcfDdup_qnnmkxIC&theme=light&size=normal&cb=j4msjl4zxy97", "https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/388043112/?random=1649597062436&cv=9&fst=1649597062436&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa3u0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%3A%2520Zeal%2520Credit%2520", "https://saumeechoa.com/?track=aHR0cHM6Ly90cmFja2luZy51bml2ZXJzZXZwbi51cy9jbGljaz9waWQ9NjcxNSZvZmZlcl9pZD0yMTI3NDYmc3ViMT01MzcyMzcxNDM4NjU4ODkwNzImc3ViMj0yNjI3MzI1&meta-id=Nzc0OTkw&brandSafe=0&rsz=2627325&cd_meta_crid=25922&meta-tracking-id=17537694&s=537237143865889072&z=2627325&b=12554414&g=US&svar=1649650835&ssk=bcc25276d94a6fa37bb24c13fd15de7a&oaid=42988e84a84a44628299d1d3d4b64ca7&did=4&campid=5453729", "xfe-URL-ceranetworks.com-stix2-2.1-export.json", "https://bid.g.doubleclick.net/xbbe/pixel?d=KAE", "bienvenidosnewyork.com/app.php", "https://app.adjust.com/jt7cgc7?campaign=4969955&adgroup=1008180&creative=12542008&redirect_windows=https://billing.purevpn.com/aff.php?aff=45706&chan=propeller&event_callback_bs7gvg=http%3A%2F%2Fad.propellerads.com%2Fconversion.php%3Faid%3D3414548%26pid%3D%26tid%3D84891%26visitor_id%3D537239929124823177%26payout%3D$%7BPAYOUT%7D%26zoneid%3D$4969955", "https://lpcdn.lpsnmedia.net/le_re/3.50.0.1-release_5103/jsv2/overlay.js?_v=3.50.0.1-release_5103" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "\u2019m", "Activedocument", "Ovlcwm" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "65709632333f37e8de4185e9", "name": "whitelisted angular.js", "description": "", "modified": "2023-12-06T15:41:38.498000", "created": "2023-12-06T15:41:38.498000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "domain": 245, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 424, "hostname": 466, "URL": 1805 }, "indicator_count": 3193, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708b83a04606c605361cb6", "name": "Nearly ALL App Store VPNs are a huge vulnerability", "description": "", "modified": "2023-12-06T14:56:03.320000", "created": "2023-12-06T14:56:03.320000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 267, "hostname": 78, "URL": 346, "FileHash-SHA256": 79, "email": 4 }, "indicator_count": 774, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708b72abe90961af1737c9", "name": "reCAPTCHA", "description": "", "modified": "2023-12-06T14:55:46.172000", "created": "2023-12-06T14:55:46.172000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 362, "domain": 330, "URL": 1790, "hostname": 586, "email": 1 }, "indicator_count": 3069, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04d8e7541291b89f4a1", "name": "whitelisted angular.js", "description": "", "modified": "2023-02-18T15:00:23.103000", "created": "2023-01-19T06:16:45.770000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 16, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1843, "hostname": 471, "domain": 246, "FileHash-MD5": 127, "FileHash-SHA1": 125, "FileHash-SHA256": 444, "CVE": 1 }, "indicator_count": 3257, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "1197 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "63c8e04f8962fa3ac0c7eb77", "name": "whitelisted angular.js", "description": "", "modified": "2023-01-19T06:16:47.672000", "created": "2023-01-19T06:16:47.672000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "function", "null", "regexp", "date", "controller", "month", "hours", "fullyear", "this", "error", "path", "window", "cookie", "span", "form", "android", "hybrid", "close", "click", "ransomware", "june", "general", "infinity", "strings", "suspicious" ], "references": [ "https://www.hybrid-analysis.com/sample/91fb6887a7d7b8f298f3ea09abd8284404916b3623679b791a71087a12d65523/5936cfa1aac2ed5e205fb505", "bienvenidosnewyork.com/app.php" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 408, "hostname": 48, "domain": 59, "FileHash-MD5": 1, "FileHash-SHA1": 1, "FileHash-SHA256": 1 }, "indicator_count": 518, "is_author": false, "is_subscribing": null, "subscriber_count": 90, "modified_text": "1228 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62630579f28f0ade0c9fb8fb", "name": "Cera networks , hive, hurricane electric ..etc\u2026 \u201ccolos\u201d(plural) or \u201ccolocation\u201d", "description": "function lz_jssess, a new type of browser, is a two-way system, which allows the browser to talk to the other side of the screen.. the following:", "modified": "2022-05-22T00:01:01.264000", "created": "2022-04-22T19:43:53.501000", "tags": [ "ovlcwm", "activedocument", "null", "span", "date", "file", "livezilladata", "regexp", "amount", "email", "function", "filereader", "checkbox", "window", "false", "path", "trident", "template", "typeof define", "typeof", "lztextlink", "script", "lzrscr", "scrb64d", "typeof b", "error", "pseudo", "child", "array", "sufeffxa0", "class", "attr", "void", "lzsds", "lzsde", "lzsdeg", "cant load", "gv1023" ], "references": [ "xfe-URL-ceranetworks.com-stix2-2.1-export.json", "https://www.ceranetworks.com/livechat/resource.php?t=js&1=jsglobal.min.js&2=jsbox.min.js&3=jstrack.min.js&v=ahgzixd7&4=jsextern.min.js", "https://www.ceranetworks.com/public/static/js/jquery@1.12.4.min.js", "https://www.ceranetworks.com/livechat/server.php?rqst=track&output=jcrpt&hfk=MQ__&ovlv=djI_&ovltwo=MQ__&ovlc=MQ__&esc=IzJlOGFlNQ__&epc=IzMwOTFmMg__&ovlts=MA__&hfk=MQ__&ovlapo=MQ__&nse=0.7916382809044465", "https://www.ceranetworks.com/livechat/script.php?id=d708615a9293e1bcec892afb03bd2b45", "https://cdnjs.cloudflare.com/ajax/libs/jquery-cookie/1.4.1/jquery.cookie.min.js", "https://www.ceranetworks.com/livechat/geo.php?a=1&gv=1023&method=lz_tracking_geo_result&spanm=lz_tracking_set_geo_span&oak=" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ActiveDocument", "display_name": "ActiveDocument", "target": null }, { "id": "OVLCWM", "display_name": "OVLCWM", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 306, "URL": 753, "FileHash-SHA256": 42, "domain": 114 }, "indicator_count": 1215, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1470 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6253b49ac7891a2ad1ab0d09", "name": "Nearly ALL App Store VPNs are a huge vulnerability", "description": "Zt, Z.Z.r, is a new-found acronym for the word \"zt\", which means \"targuments\" or \"farg\" in the same place as the original.", "modified": "2022-05-11T00:02:13.446000", "created": "2022-04-11T04:54:50.508000", "tags": [ "ratio", "regexp", "apple iphone", "apple ipad", "apple ipod", "xmlhttprequest", "post", "contenttype", "text", "function", "symbol", "typeof", "null", "macintel", "attention", "please", "vpn app", "install details", "\u2019m", "purevpn: fast", "secure & easy", "purevpn", "productivity", "utilities", "ios apps", "app", "appstore", "app store", "iphone", "ipad", "ipod touch", "itouch", "itunes", "fast", "secure", "easy", "subscription", "requires", "global nav", "alwayson", "audit", "vpn connection", "service", "download", "enjoy", "first", "kill", "rest", "italian", "korean", "vpn - ip changer & security id", "energise inc", "data", "app privacy", "data privacy", "learn", "sans", "woff", "fontface", "u1c801c88", "u20b4", "u2de02dff", "ua640a69f", "ufe2efe2f", "u04b004b1", "u2116", "truetype", "start", "webflow css", "policy", "crowd ab", "university", "log data", "conditions", "third party", "1px1px", "sf ui", "sf pro", "helvetica", "arial", "alpha", "opacity", "icons", "misc", "overlays", "opacity35", "foundation", "layout", "opacity0", "spinner", "android", "object", "string", "number", "window", "date", "promise", "array", "error", "this", "void", "screen", "typeerror", "invalid attempt" ], "references": [ "xfe-URL-dk9ctyhidjrvgn.xyz-stix2-2.1-export.json", "https://unphionetor.com/fv.js?t=56193&cb=200694599", "https://ptauxofi.net/pfe/current/micro.tag.min.js?sw=/sw-check-permissions/3683319&var=iUnZZblURYgnN6e&z=3683319", "https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.12.1/jquery-ui.css", "https://littlecdn.com/apps/templates/video/ytube-player-system-message/css/style.css?v=1.0", "https://saumeechoa.com/?track=aHR0cHM6Ly90cmFja2luZy51bml2ZXJzZXZwbi51cy9jbGljaz9waWQ9NjcxNSZvZmZlcl9pZD0yMTI3NDYmc3ViMT01MzcyMzcxNDM4NjU4ODkwNzImc3ViMj0yNjI3MzI1&meta-id=Nzc0OTkw&brandSafe=0&rsz=2627325&cd_meta_crid=25922&meta-tracking-id=17537694&s=537237143865889072&z=2627325&b=12554414&g=US&svar=1649650835&ssk=bcc25276d94a6fa37bb24c13fd15de7a&oaid=42988e84a84a44628299d1d3d4b64ca7&did=4&campid=5453729", "https://univvpn.page.link/jdF1?utm_medium=paid%20advertising&_branch_referrer=H4sIAAAAAAAAAx3Juw6DIBQA0K%2Bxo8JFQJqQTh2bdOtILo%2BqEZEIDvbrm3Y9Z6o1l2vXxRGGscWc2zinpZPn5yle%2BTEme2ugZ1mjcUep22oooUICp0woNfAegKtLI%2B8luC153E%2BTDxvnMoVdC0n573JEF9aQqgYBksEf0ZvZawGcYaBqcG%2BhLCGEoreesS%2BPLJI5mAAAAA%3D%3D&%243p=a_custom_1016725136998542259&~secondary_publisher=6715&~placement=2627325&~ad_id=6253ae198cf69b0001adbd33&_branch_match_id=1041559436699840584", "https://locationvpn.info/landers/swvpn/p25f_prop/styles.css", "https://fonts.googleapis.com/css?family=Open+Sans:700,300", "https://easyvpn.app.link/Hsj5csEsrob?%243p=a_custom_1032593427266339085&~click_id=b4f8buqlp9zvrbed&~trafficsource=propellerads&~externalid=537238981268836734&~camp=92&~channel=propellerads&~campaign_id=92&~campaign=92", "https://cdrvrs.com/4/1008180?var=2627325&rsz=2627325", "https://app.adjust.com/jt7cgc7?campaign=4969955&adgroup=1008180&creative=12542008&redirect_windows=https://billing.purevpn.com/aff.php?aff=45706&chan=propeller&event_callback_bs7gvg=http%3A%2F%2Fad.propellerads.com%2Fconversion.php%3Faid%3D3414548%26pid%3D%26tid%3D84891%26visitor_id%3D537239929124823177%26payout%3D$%7BPAYOUT%7D%26zoneid%3D$4969955", "https://bestfasttrackservices.com/landers/d/player_default1/?&domain=besttvllc.com&uclick=g6bg8rsc6o&uclickhash=g6bg8rsc6o-g6bg8rsc6o-gha4-0-xra3-4kghfe-4kirbl-015263", "https://bestfasttrackservices.com/landers/d/player_default1/current-device.min.js", "https://bestfasttrackservices.com/landers/d/player_default1/send.js" ], "public": 1, "adversary": "", "targeted_countries": [ "Russian Federation", "Australia", "Romania" ], "malware_families": [ { "id": "\u2019m", "display_name": "\u2019m", "target": null } ], "attack_ids": [ { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1133", "name": "External Remote Services", "display_name": "T1133 - External Remote Services" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 267, "URL": 346, "hostname": 78, "FileHash-SHA256": 79, "email": 4 }, "indicator_count": 774, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1481 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6252df03791ceb2df29742fe", "name": "reCAPTCHA", "description": "var a,r, i,o, r, c+(((s>>>16)*c&65535)<<16, as well as the Object, to be used as a decoder.", "modified": "2022-05-10T00:02:48.350000", "created": "2022-04-10T13:43:30.961000", "tags": [ "arial", "roboto", "helvetica neue", "typesubmit", "webkitkeyframes", "typeerror", "typeof t", "string", "object", "typeof e", "symbol", "typeof symbol", "typeof window", "typeof self", "typeof r", "date", "body", "html", "typeof n", "error", "version", "shown", "click", "dataspy", "trident", "window", "lpmlightbox", "messaging1", "chat0", "href", "tabindex", "copyright", "closure library", "info", "smsclientapi", "null", "typeof", "regexp", "debug", "chat", "scraper", "cookie", "stop", "iframe", "explorer", "small", "seppuku", "jsloader", "token", "viewed", "kbcontentclick", "blank", "post", "document", "typeof storage", "unknownerror", "element", "overquerylimit", "requestdenied", "zeroresults", "notfound", "node", "edge", "android", "unknown", "false", "june", "generator", "marker", "hybrid", "month", "azaz09", "hours", "function", "number", "fullyear", "controller", "christ", "sufeffxa0", "class", "attr", "pseudo", "child", "js foundation", "typeof module", "directclick", "x22loansx22", "x221x22", "9o7nxzt", "x22applyx22", "x3dw", "x3dnew", "x22pageloadx22", "x22scriptx22", "x22uetqx22", "viewcontent", "addtocart", "purchase", "array", "customevent", "09af", "ver0", "tag0", "extdata0", "ua ch", "invalid", "license", "calltrkswap", "typeof s", "xmlhttprequest", "65535", "awindow", "cwm fjordbank", "activexobject", "tfunction", "sfunction", "yfunction", "googlendt" ], "references": [ "xfe-URL-ihagoogle.com-stix2-2.1-export.json", "http://pagead2.googlesyndication.com/apps/domainpark/show_afd_ads.js", "http://sedoparking.com/frmpark/ihagoogle.com/sedopark/park.js", "http://instantfwding.com/px.js?ch=1", "http://pxlgnpgecom-a.akamaihd.net/javascripts/browserfp.min.js?templateId=11&customerId=7CUHNT0E1", "https://pxlgnpgecom-a.akamaihd.net/javascripts/bfp_ssn.js?templateId=11", "https://s.thebrighttag.com/tag?site=9O7NXzt&H=-5nu6gjg&referrer=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%253A%2520Zeal%2520Credit%2520Union%2520-%2520Mortgages%26utm_term%3Dhouse%2520mortgage%26utm_content%3DMortgage%2520General&docReferrer=http%3A%2F%2Finstantfwding.com%2F&mode=v2&cf=7500150%2C7500152&btpdb.9O7NXzt.dGZjLjc1MDAxNTE=UkVRVUVTVFMuMA&btpdb.9O7NXzt.dGZjLjc1MTUyNDU=U0VTU0lPTg&btpdb.9O7N", "https://cdn.callrail.com/companies/448598242/66d5efd6cbf06378ea1f/12/swap.js", "https://bat.bing.com/bat.js", "https://tag.perfectaudience.com/serve/5f59021d1911b61034000d8d.js", "https://s.thebrighttag.com/tag?site=9O7NXzt&referrer=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%253A%2520Zeal%2520Credit%2520Union%2520-%2520Mortgages%26utm_term%3Dhouse%2520mortgage%26utm_content%3DMortgage%2520General&docReferrer=http%3A%2F%2Finstantfwding.com%2F&H=-5nu6gjg", "https://code.jquery.com/jquery-3.4.1.min.js?ver=3.4.1", "https://integration.silvercloudinc.com/js/bundle/vendor.js", "https://maps.googleapis.com/maps/api/js?key=AIzaSyAMbtdeFB5s623T4LwRldWj_Vdy2t4wLkw&libraries=places", "https://lptag.liveperson.net/tag/tag.js?site=22027291", "https://integration.silvercloudinc.com/js/bundle/8.engageware-bundle.js", "https://lptag.liveperson.net/lptag/api/account/22027291/configuration/applications/taglets/.jsonp?v=2.0&df=2&b=2", "https://pixel-geo.prfct.co/tagjs?a_id=131352&source=js_tag", "https://bat.bing.com/p/action/56358236.js", "https://googleads.g.doubleclick.net/pagead/viewthroughconversion/388043112/?random=1649597062436&cv=9&fst=1649597062436&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=844&u_w=390&u_ah=844&u_aw=390&u_cd=32&u_his=2&u_tz=-240&u_java=false&u_nplug=0&u_nmime=0>m=2oa3u0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fwww.zealcu.org%2Fhome-loans%2F%3Fmsclkid%3D3ef1349815a11e52b0b256cacc0bc952%26utm_source%3Dbing%26utm_medium%3Dcpc%26utm_campaign%3DSearch%3A%2520Zeal%2520Credit%2520", "https://lpcdn.lpsnmedia.net/le_re/3.50.0.1-release_5103/jsv2/overlay.js?_v=3.50.0.1-release_5103", "https://www.zealcu.org/app/uploads/cache/js/aggregated_single_eb9d05879e4cb943b965deb3cccf05ee.js", "https://integration.silvercloudinc.com/js/silvercloudjs/silvercloud.js", "https://js.callrail.com/group/0/66d5efd6cbf06378ea1f/02836fdf-c99c-4a90-b31b-373093db654e/poll.js?t=1649597153888&ids%5B%5D=448598242", "https://js.callrail.com/group/0/66d5efd6cbf06378ea1f/02836fdf-c99c-4a90-b31b-373093db654e/poll.js?t=1649598014683&ids%5B%5D=448598242", "https://www.zealcu.org/app/uploads/cache/css/aggregated_cd3154a65f0e94fa98c08398cba54caa.css", "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LfjFjMaAAAAACpmnf2RfTg2U2m4Cdnku25XccJW&co=aHR0cHM6Ly93d3cuemVhbGN1Lm9yZzo0NDM.&hl=en&v=Y-cOIEkAqcfDdup_qnnmkxIC&theme=light&size=normal&cb=j4msjl4zxy97", "https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1649597064004&loc=https%3A%2F%2Fwww.zealcu.org", "https://bid.g.doubleclick.net/xbbe/pixel?d=KAE" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1790, "hostname": 586, "FileHash-SHA256": 362, "domain": 330, "email": 1 }, "indicator_count": 3069, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1482 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "z.id", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "error": "Expecting value: line 1 column 1 (char 0)", "indicator": "z.id" }, "from_cache": true, "_cached_at": 1780234337.1095283 }