{
  "aliases": [
    "matadoor"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 51,
    "url_path": 3
  },
  "first_seen": {
    "domain": {
      "aliveyelp.com": "2023-10-07",
      "bestandgood.com": "2023-10-07",
      "bettertimator.com": "2023-10-07",
      "biowitsg.com": "2023-10-07",
      "cakeduer.com": "2023-10-07",
      "cameoonion.com": "2023-10-07",
      "capetipper.com": "2023-10-07",
      "casgone.com": "2023-10-07",
      "cravefool.com": "2023-10-07",
      "diemonge.com": "2023-10-07",
      "e5afaya.com": "2023-10-07",
      "editngo.com": "2023-10-07",
      "eimvivb.com": "2023-10-07",
      "endlessutie.com": "2023-10-07",
      "fetchbring.com": "2023-10-07",
      "fledscuba.com": "2023-10-07",
      "flowuboy.com": "2023-10-07",
      "futureinv-gp.com": "2023-10-07",
      "ganjabuscoa.com": "2023-10-07",
      "getmyecoin.com": "2023-10-07",
      "iemcvv.com": "2023-10-07",
      "interactive-guides.com": "2023-10-07",
      "investsportss.com": "2023-10-07",
      "ipodlasso.com": "2023-10-07",
      "ismysoulmate.com": "2023-10-07",
      "justlikeahummer.com": "2023-10-07",
      "kixthstage.com": "2023-10-07",
      "merudlement.com": "2023-10-07",
      "metaversalk.com": "2023-10-07",
      "mlaycld.com": "2023-10-07",
      "moveandtry.com": "2023-10-07",
      "myballmecg.com": "2023-10-07",
      "nuttyhumid.com": "2023-10-07",
      "offernewer.com": "2023-10-07",
      "otopitele.com": "2023-10-07",
      "outsidenursery.com": "2023-10-07",
      "primventure.com": "2023-10-07",
      "pursestout.com": "2023-10-07",
      "reasonsalt.com": "2023-10-07",
      "searching4soulmate.com": "2023-10-07",
      "speclaurp.com": "2023-10-07",
      "sureyuare.com": "2023-10-07",
      "tarzoose.com": "2023-10-07",
      "trendparlye.com": "2023-10-07",
      "wemobiledauk.com": "2023-10-07",
      "wharfgold.com": "2023-10-07",
      "ww12.flowuboy.com": "2023-10-07",
      "ww12.merudlement.com": "2023-10-07",
      "ww12.offernewer.com": "2023-10-07",
      "xdinzky.com": "2023-10-07",
      "zeltactib.com": "2023-10-07"
    },
    "url_path": {
      "/chagent?_sid=": "2023-10-07",
      "/chagent_sh?_sid=": "2023-10-07",
      "/fontsupdate?_sid=": "2023-10-07"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2023-10-07",
    "latest": "2023-10-07"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "aliveyelp.com",
      "bestandgood.com",
      "bettertimator.com",
      "biowitsg.com",
      "cakeduer.com",
      "cameoonion.com",
      "capetipper.com",
      "casgone.com",
      "cravefool.com",
      "diemonge.com",
      "e5afaya.com",
      "editngo.com",
      "eimvivb.com",
      "endlessutie.com",
      "fetchbring.com",
      "fledscuba.com",
      "flowuboy.com",
      "futureinv-gp.com",
      "ganjabuscoa.com",
      "getmyecoin.com",
      "iemcvv.com",
      "interactive-guides.com",
      "investsportss.com",
      "ipodlasso.com",
      "ismysoulmate.com",
      "justlikeahummer.com",
      "kixthstage.com",
      "merudlement.com",
      "metaversalk.com",
      "mlaycld.com",
      "moveandtry.com",
      "myballmecg.com",
      "nuttyhumid.com",
      "offernewer.com",
      "otopitele.com",
      "outsidenursery.com",
      "primventure.com",
      "pursestout.com",
      "reasonsalt.com",
      "searching4soulmate.com",
      "speclaurp.com",
      "sureyuare.com",
      "tarzoose.com",
      "trendparlye.com",
      "wemobiledauk.com",
      "wharfgold.com",
      "ww12.flowuboy.com",
      "ww12.merudlement.com",
      "ww12.offernewer.com",
      "xdinzky.com",
      "zeltactib.com"
    ],
    "url_path": [
      "/chagent?_sid=",
      "/chagent_sh?_sid=",
      "/fontsupdate?_sid="
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "DARKRIVER"
  ],
  "references": [
    "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/",
    "https://www.virustotal.com/gui/file/0b06fb7f53bb7963ec2ff89d832b831763706e44d206a4d0a8c813ebee633e22/detection",
    "https://www.virustotal.com/gui/file/4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1/detection",
    "https://www.virustotal.com/gui/file/8c94a3cef4e45a1db05ae9723ce5f5ed66fc57316e9868f66c995ebee55f5117/detection",
    "https://www.virustotal.com/gui/file/a1797d212560de7fd187d0771e8948bd8e0e242bed0ca07665f78076f4e23235/detection",
    "https://www.virustotal.com/gui/file/ad6da02e3a4c98a29993cceb7a10e7af002fb00df0cd2228f83aea4ccfdf94b6/detection",
    "https://www.virustotal.com/gui/ip-address/172.234.26.236/relations",
    "https://www.virustotal.com/gui/ip-address/51.195.29.43/relations"
  ],
  "related": [],
  "slug": "DARKRIVER",
  "timeline": [
    {
      "counts": {
        "domain": 51,
        "url_path": 3
      },
      "first_seen": "2023-10-07",
      "indicators": {
        "domain": [
          "aliveyelp.com",
          "bestandgood.com",
          "bettertimator.com",
          "biowitsg.com",
          "cakeduer.com",
          "cameoonion.com",
          "capetipper.com",
          "casgone.com",
          "cravefool.com",
          "diemonge.com",
          "e5afaya.com",
          "editngo.com",
          "eimvivb.com",
          "endlessutie.com",
          "fetchbring.com",
          "fledscuba.com",
          "flowuboy.com",
          "futureinv-gp.com",
          "ganjabuscoa.com",
          "getmyecoin.com",
          "iemcvv.com",
          "interactive-guides.com",
          "investsportss.com",
          "ipodlasso.com",
          "ismysoulmate.com",
          "justlikeahummer.com",
          "kixthstage.com",
          "merudlement.com",
          "metaversalk.com",
          "mlaycld.com",
          "moveandtry.com",
          "myballmecg.com",
          "nuttyhumid.com",
          "offernewer.com",
          "otopitele.com",
          "outsidenursery.com",
          "primventure.com",
          "pursestout.com",
          "reasonsalt.com",
          "searching4soulmate.com",
          "speclaurp.com",
          "sureyuare.com",
          "tarzoose.com",
          "trendparlye.com",
          "wemobiledauk.com",
          "wharfgold.com",
          "ww12.flowuboy.com",
          "ww12.merudlement.com",
          "ww12.offernewer.com",
          "xdinzky.com",
          "zeltactib.com"
        ],
        "url_path": [
          "/chagent?_sid=",
          "/chagent_sh?_sid=",
          "/fontsupdate?_sid="
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/dark-river-you-can-t-see-them-but-they-re-there/",
        "https://www.virustotal.com/gui/ip-address/172.234.26.236/relations",
        "https://www.virustotal.com/gui/ip-address/51.195.29.43/relations",
        "https://www.virustotal.com/gui/file/ad6da02e3a4c98a29993cceb7a10e7af002fb00df0cd2228f83aea4ccfdf94b6/detection",
        "https://www.virustotal.com/gui/file/a1797d212560de7fd187d0771e8948bd8e0e242bed0ca07665f78076f4e23235/detection",
        "https://www.virustotal.com/gui/file/8c94a3cef4e45a1db05ae9723ce5f5ed66fc57316e9868f66c995ebee55f5117/detection",
        "https://www.virustotal.com/gui/file/4f544e8756373520e98ed12b921ea7e05a93cf0152405ef3ac65133f7c8660a1/detection",
        "https://www.virustotal.com/gui/file/0b06fb7f53bb7963ec2ff89d832b831763706e44d206a4d0a8c813ebee633e22/detection"
      ],
      "total": 54
    }
  ]
}