{ "type": "Domain", "indicator": "zohoviewer.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/zohoviewer.com", "alexa": "http://www.alexa.com/siteinfo/zohoviewer.com", "indicator": "zohoviewer.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4106918656, "indicator": "zohoviewer.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 5, "pulses": [ { "id": "69fa4cc388e82992fbdf9413", "name": "Iocs & anti forgery cert", "description": "Leaving this one brief for now. I will note the antigorgery very exp is dangerous and rec exp it from any domain.", "modified": "2026-05-06T08:26:49.994000", "created": "2026-05-05T20:02:11.801000", "tags": [ "kisa", "creation date", "servers", "date", "name servers", "songpagu", "seoul", "security agency", "found date", "gmt server", "url analysis", "title", "cname", "ttl value", "aaaa", "key identifier", "x509v3 subject", "v3 serial", "number", "cus odigicert", "cnthawte tls", "rsa ca", "g1 validity", "lnajusi okorea", "internet", "info", "ip address", "registrant zip", "code", "algorithm", "cus olet", "encrypt cnr13", "validity", "subject public", "key info", "server", "registrar abuse", "domain status", "registrar", "dnssec", "domain name", "status", "in registrant", "email", "contact", "key algorithm", "x509v3 key", "registrant", "ac email", "host name", "read", "new york", "korea", "korea internet", "allen street", "kisa sikdang", "korea stop", "mosaic venues", "turkish", "asylum", "service", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "okorea internet", "iana id", "contact email", "contact phone", "registrar url", "registrar whois", "expiration date", "zoho cares", "tr li", "google", "reply", "overview", "chia s", "onpremise", "language test", "file format", "tom jack", "private limited", "stateprovince", "organization", "registrar iana", "tech country", "krnic person", "kr phone", "ip manager", "database", "bundanggu", "kt head", "office country", "whois", "samsungsds", "refer", "team", "telecom", "hack", "online", "south korea", "survey", "internet usage", "behav" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 9, "URL": 388, "domain": 205, "email": 8, "hostname": 688, "IPv4": 28, "FileHash-SHA256": 466, "IPv6": 1, "FileHash-MD5": 7, "CIDR": 1 }, "indicator_count": 1801, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69fa4cc3743bae4c3ab037b9", "name": "Iocs & anti forgery cert", "description": "Leaving this one brief for now. I will note the antigorgery very exp is dangerous and rec exp it from any domain.", "modified": "2026-05-05T20:02:11.255000", "created": "2026-05-05T20:02:11.255000", "tags": [ "kisa", "creation date", "servers", "date", "name servers", "songpagu", "seoul", "security agency", "found date", "gmt server", "url analysis", "title", "cname", "ttl value", "aaaa", "key identifier", "x509v3 subject", "v3 serial", "number", "cus odigicert", "cnthawte tls", "rsa ca", "g1 validity", "lnajusi okorea", "internet", "info", "ip address", "registrant zip", "code", "algorithm", "cus olet", "encrypt cnr13", "validity", "subject public", "key info", "server", "registrar abuse", "domain status", "registrar", "dnssec", "domain name", "status", "in registrant", "email", "contact", "key algorithm", "x509v3 key", "registrant", "ac email", "host name", "read", "new york", "korea", "korea internet", "allen street", "kisa sikdang", "korea stop", "mosaic venues", "turkish", "asylum", "service", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "okorea internet", "iana id", "contact email", "contact phone", "registrar url", "registrar whois", "expiration date", "zoho cares", "tr li", "google", "reply", "overview", "chia s", "onpremise", "language test", "file format", "tom jack", "private limited", "stateprovince", "organization", "registrar iana", "tech country", "krnic person", "kr phone", "ip manager", "database", "bundanggu", "kt head", "office country", "whois", "samsungsds", "refer", "team", "telecom", "hack", "online", "south korea", "survey", "internet usage", "behav" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 9, "URL": 387, "domain": 205, "email": 8, "hostname": 688, "IPv4": 28, "FileHash-SHA256": 466, "IPv6": 1, "FileHash-MD5": 7, "CIDR": 1 }, "indicator_count": 1800, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69fa4cc26ebab11465ff8916", "name": "Iocs & anti forgery cert", "description": "Leaving this one brief for now. I will note the antigorgery very exp is dangerous and rec exp it from any domain.", "modified": "2026-05-05T20:02:10.709000", "created": "2026-05-05T20:02:10.709000", "tags": [ "kisa", "creation date", "servers", "date", "name servers", "songpagu", "seoul", "security agency", "found date", "gmt server", "url analysis", "title", "cname", "ttl value", "aaaa", "key identifier", "x509v3 subject", "v3 serial", "number", "cus odigicert", "cnthawte tls", "rsa ca", "g1 validity", "lnajusi okorea", "internet", "info", "ip address", "registrant zip", "code", "algorithm", "cus olet", "encrypt cnr13", "validity", "subject public", "key info", "server", "registrar abuse", "domain status", "registrar", "dnssec", "domain name", "status", "in registrant", "email", "contact", "key algorithm", "x509v3 key", "registrant", "ac email", "host name", "read", "new york", "korea", "korea internet", "allen street", "kisa sikdang", "korea stop", "mosaic venues", "turkish", "asylum", "service", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "okorea internet", "iana id", "contact email", "contact phone", "registrar url", "registrar whois", "expiration date", "zoho cares", "tr li", "google", "reply", "overview", "chia s", "onpremise", "language test", "file format", "tom jack", "private limited", "stateprovince", "organization", "registrar iana", "tech country", "krnic person", "kr phone", "ip manager", "database", "bundanggu", "kt head", "office country", "whois", "samsungsds", "refer", "team", "telecom", "hack", "online", "south korea", "survey", "internet usage", "behav" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 9, "URL": 387, "domain": 205, "email": 8, "hostname": 688, "IPv4": 28, "FileHash-SHA256": 466, "IPv6": 1, "FileHash-MD5": 7, "CIDR": 1 }, "indicator_count": 1800, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688865644a38fd5eef407891", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.869000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68886564cdc44059c7b2ef08", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.770000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 5, "pulses": [ { "id": "69fa4cc388e82992fbdf9413", "name": "Iocs & anti forgery cert", "description": "Leaving this one brief for now. I will note the antigorgery very exp is dangerous and rec exp it from any domain.", "modified": "2026-05-06T08:26:49.994000", "created": "2026-05-05T20:02:11.801000", "tags": [ "kisa", "creation date", "servers", "date", "name servers", "songpagu", "seoul", "security agency", "found date", "gmt server", "url analysis", "title", "cname", "ttl value", "aaaa", "key identifier", "x509v3 subject", "v3 serial", "number", "cus odigicert", "cnthawte tls", "rsa ca", "g1 validity", "lnajusi okorea", "internet", "info", "ip address", "registrant zip", "code", "algorithm", "cus olet", "encrypt cnr13", "validity", "subject public", "key info", "server", "registrar abuse", "domain status", "registrar", "dnssec", "domain name", "status", "in registrant", "email", "contact", "key algorithm", "x509v3 key", "registrant", "ac email", "host name", "read", "new york", "korea", "korea internet", "allen street", "kisa sikdang", "korea stop", "mosaic venues", "turkish", "asylum", "service", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "okorea internet", "iana id", "contact email", "contact phone", "registrar url", "registrar whois", "expiration date", "zoho cares", "tr li", "google", "reply", "overview", "chia s", "onpremise", "language test", "file format", "tom jack", "private limited", "stateprovince", "organization", "registrar iana", "tech country", "krnic person", "kr phone", "ip manager", "database", "bundanggu", "kt head", "office country", "whois", "samsungsds", "refer", "team", "telecom", "hack", "online", "south korea", "survey", "internet usage", "behav" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 9, "URL": 388, "domain": 205, "email": 8, "hostname": 688, "IPv4": 28, "FileHash-SHA256": 466, "IPv6": 1, "FileHash-MD5": 7, "CIDR": 1 }, "indicator_count": 1801, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69fa4cc3743bae4c3ab037b9", "name": "Iocs & anti forgery cert", "description": "Leaving this one brief for now. I will note the antigorgery very exp is dangerous and rec exp it from any domain.", "modified": "2026-05-05T20:02:11.255000", "created": "2026-05-05T20:02:11.255000", "tags": [ "kisa", "creation date", "servers", "date", "name servers", "songpagu", "seoul", "security agency", "found date", "gmt server", "url analysis", "title", "cname", "ttl value", "aaaa", "key identifier", "x509v3 subject", "v3 serial", "number", "cus odigicert", "cnthawte tls", "rsa ca", "g1 validity", "lnajusi okorea", "internet", "info", "ip address", "registrant zip", "code", "algorithm", "cus olet", "encrypt cnr13", "validity", "subject public", "key info", "server", "registrar abuse", "domain status", "registrar", "dnssec", "domain name", "status", "in registrant", "email", "contact", "key algorithm", "x509v3 key", "registrant", "ac email", "host name", "read", "new york", "korea", "korea internet", "allen street", "kisa sikdang", "korea stop", "mosaic venues", "turkish", "asylum", "service", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "okorea internet", "iana id", "contact email", "contact phone", "registrar url", "registrar whois", "expiration date", "zoho cares", "tr li", "google", "reply", "overview", "chia s", "onpremise", "language test", "file format", "tom jack", "private limited", "stateprovince", "organization", "registrar iana", "tech country", "krnic person", "kr phone", "ip manager", "database", "bundanggu", "kt head", "office country", "whois", "samsungsds", "refer", "team", "telecom", "hack", "online", "south korea", "survey", "internet usage", "behav" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 9, "URL": 387, "domain": 205, "email": 8, "hostname": 688, "IPv4": 28, "FileHash-SHA256": 466, "IPv6": 1, "FileHash-MD5": 7, "CIDR": 1 }, "indicator_count": 1800, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69fa4cc26ebab11465ff8916", "name": "Iocs & anti forgery cert", "description": "Leaving this one brief for now. I will note the antigorgery very exp is dangerous and rec exp it from any domain.", "modified": "2026-05-05T20:02:10.709000", "created": "2026-05-05T20:02:10.709000", "tags": [ "kisa", "creation date", "servers", "date", "name servers", "songpagu", "seoul", "security agency", "found date", "gmt server", "url analysis", "title", "cname", "ttl value", "aaaa", "key identifier", "x509v3 subject", "v3 serial", "number", "cus odigicert", "cnthawte tls", "rsa ca", "g1 validity", "lnajusi okorea", "internet", "info", "ip address", "registrant zip", "code", "algorithm", "cus olet", "encrypt cnr13", "validity", "subject public", "key info", "server", "registrar abuse", "domain status", "registrar", "dnssec", "domain name", "status", "in registrant", "email", "contact", "key algorithm", "x509v3 key", "registrant", "ac email", "host name", "read", "new york", "korea", "korea internet", "allen street", "kisa sikdang", "korea stop", "mosaic venues", "turkish", "asylum", "service", "cgb stgreater", "cnsectigo rsa", "secure server", "ca validity", "okorea internet", "iana id", "contact email", "contact phone", "registrar url", "registrar whois", "expiration date", "zoho cares", "tr li", "google", "reply", "overview", "chia s", "onpremise", "language test", "file format", "tom jack", "private limited", "stateprovince", "organization", "registrar iana", "tech country", "krnic person", "kr phone", "ip manager", "database", "bundanggu", "kt head", "office country", "whois", "samsungsds", "refer", "team", "telecom", "hack", "online", "south korea", "survey", "internet usage", "behav" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1018", "name": "Remote System Discovery", "display_name": "T1018 - Remote System Discovery" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA1": 9, "URL": 387, "domain": 205, "email": 8, "hostname": 688, "IPv4": 28, "FileHash-SHA256": 466, "IPv6": 1, "FileHash-MD5": 7, "CIDR": 1 }, "indicator_count": 1800, "is_author": false, "is_subscribing": null, "subscriber_count": 67, "modified_text": "25 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688865644a38fd5eef407891", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.869000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68886564cdc44059c7b2ef08", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.770000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "zohoviewer.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "zohoviewer.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780231831.045224 }