{
  "aliases": [
    "ta402"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 257,
    "ipv4": 2,
    "url": 4,
    "url_path": 1
  },
  "first_seen": {
    "domain": {
      "0arfx4grailorhvlicbj.servehumour.com": "2019-09-17",
      "0n4tblbdfncaauxioxto.ddns.net": "2019-09-17",
      "3tshhm1nfphiqqrxbi8c.servehumour.com": "2019-09-17",
      "aaas.mefound.com": "2019-09-17",
      "acc.buybit.us": "2019-09-17",
      "accounts-helper.ml": "2019-09-17",
      "adfdafsggdfgdfgsagaer.blogsyte.com": "2019-09-17",
      "adsmartweb9.com": "2020-03-03",
      "ajaxo.zapto.org": "2017-04-14",
      "alasra-paper.duckdns.org": "2019-03-24",
      "aqs.filezellasd.co.vu": "2019-09-17",
      "aracaravan.com": "2023-12-14",
      "backjadwer.bounceme.net": "2017-04-14",
      "backop.mooo.com": "2017-04-14",
      "bandao.publicvm.com": "2017-04-14",
      "baz.downloadcor.xyz": "2019-09-17",
      "beatricewarner.com": "2023-12-14",
      "bulk-smtp.xyz": "2019-09-17",
      "bundanesia.com": "2022-01-25",
      "buy.israel-shipment.xyz": "2019-09-17",
      "bypasstesting.servehalflife.com": "2017-04-14",
      "cbbnews.tk": "2017-04-14",
      "cccam.serveblog.net": "2017-04-14",
      "checktest.www1.biz": "2019-03-24",
      "chromeupdt.tk": "2017-04-14",
      "cl170915.otzo.com": "2019-09-17",
      "claire-conway.com": "2023-12-14",
      "cloudserviceapi.online": "2020-03-03",
      "cnaci8gyolttkgmguzog.ignorelist.com": "2017-04-14",
      "cyaxsnieccunozn0erih.mefound.com": "2019-09-17",
      "cyber-peace.org": "2017-04-14",
      "cyber18.no-ip.net": "2017-04-14",
      "d.nabzerd.co.vu": "2019-09-17",
      "dapoerwedding.com": "2019-09-16",
      "data-server.cloudns.club": "2023-11-12",
      "deapka.sytes.net": "2017-04-14",
      "debka.ga": "2019-09-17",
      "depka.sytes.net": "2017-04-14",
      "dfwsd.co.vu": "2019-09-17",
      "direct-marketing.ml": "2019-09-17",
      "directl.otzo.com": "2019-09-17",
      "dji-msi.2waky.com": "2019-04-11",
      "dnsfor.dnsfor.me": "2017-04-14",
      "dontrplay.tk": "2019-09-17",
      "dorcertg.otzo.com": "2019-11-29",
      "down.downloadcor.xyz": "2019-09-17",
      "down.supportcom.xyz": "2019-09-17",
      "download.data-server.cloudns.club": "2019-03-24",
      "download.likescandy.com": "2017-04-14",
      "downloadlog.linkpc.net": "2017-04-12",
      "downloadmyhost.zapto.org": "2017-04-12",
      "downloadskype.cf": "2017-04-14",
      "drivres-update.info": "2015-12-19",
      "duntat.zapto.org": "2017-04-14",
      "easyuploadservice.com": "2022-02-08",
      "ed3qy5yioryitoturysuiu.otzo.com": "2019-09-17",
      "email-market.ml": "2019-09-17",
      "email-test.ml": "2019-09-17",
      "emailotest.co.vu": "2019-09-17",
      "emobileservices.club": "2020-07-14",
      "facetoo.co.vu": "2019-09-17",
      "fastbingcom.sytes.net": "2017-04-14",
      "fatihah.zapto.org": "2017-04-14",
      "filezellla.otzo.com": "2019-09-17",
      "freshchrysanthemum.com": "2019-09-10",
      "fulltest.yourtrap.com": "2019-03-24",
      "gabro.xxuz.com": "2019-09-17",
      "gamail.goaglesmtp.co.vu": "2019-09-17",
      "games.buybit.us": "2019-09-17",
      "gaonsmom.redirectme.net": "2017-04-14",
      "gfhbgfzfgfgfgdg.otzo.com": "2019-09-17",
      "goldenlines.site": "2020-03-03",
      "goodday.zapto.org": "2017-04-14",
      "goodwebmail.tk": "2019-09-17",
      "google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kim": "2017-04-14",
      "googlecombq6xx.ddns.net": "2017-04-14",
      "googledomain.otzo.com": "2019-09-17",
      "gov.uae.kim": "2017-04-14",
      "gq4bp1baxfiblzqk.mrbasic.com": "2017-04-14",
      "h908926f.beget.tech": "2020-09-06",
      "haartezenglish.redirectme.net": "2017-04-14",
      "haartezenglish.strangled.net": "2017-04-14",
      "hamas-wathaq.duckdns.org": "2019-03-24",
      "hdgshfdgh.co.vu": "2019-09-17",
      "healthcaption.com": "2023-11-15",
      "help2014.linkpc.net": "2017-04-12",
      "helthnews.ga": "2019-09-17",
      "hnoor.newphoneapp.com": "2019-03-24",
      "hostgatr.mrface.com": "2019-09-17",
      "hr.goaglesmtp.co.vu": "2019-09-17",
      "httpo.sytes.net": "2017-04-14",
      "idf.idfcom.co.vu": "2019-09-17",
      "imazing.ga": "2019-09-17",
      "inclusive-economy.com": "2023-11-15",
      "info.intarspace.co.vu": "2019-09-17",
      "infoblusa.tk": "2019-09-17",
      "internetdownloadr.publicvm.com": "2017-04-14",
      "iphonenewsd.co.vu": "2019-09-17",
      "itresolver.online": "2020-03-03",
      "jake.support-sales.tk": "2019-09-17",
      "jane-chapman.com": "2023-12-14",
      "javaupdate.no-ip.info": "2015-03-18",
      "jenneaypreff.linkpc.net": "2019-09-17",
      "justded.justdied.com": "2017-04-14",
      "kaliob.selfip.org": "2017-04-14",
      "kaswer12.strangled.net": "2017-04-14",
      "kolabdown.sytes.net": "2017-04-12",
      "krowd.downloadcor.xyz": "2019-09-17",
      "ksm5sksm5sksm5s.zzux.com": "2017-04-14",
      "laceibagrafica.com": "2020-02-14",
      "laptower.com": "2020-03-03",
      "lastmoon.mooo.com": "2017-04-14",
      "lilian.redirectme.net": "2017-04-14",
      "live.isasecret.com": "2017-04-14",
      "lkvz7bsfuiaidsyynu7bd2owpe.dns05.com": "2019-09-17",
      "lol.mynetav.org": "2019-03-24",
      "mailchat.zapto.org": "2017-04-14",
      "mailweb.otzo.com": "2019-09-17",
      "manual.newphoneapp.com": "2019-03-24",
      "marki.mefound.com": "2019-09-17",
      "markit.mefound.com": "2019-09-17",
      "markting-fac.tk": "2019-09-17",
      "markting.mefound.com": "2019-09-17",
      "marktingvb.ml": "2019-09-17",
      "masterservices.online": "2020-03-03",
      "microsoft10.compress.to": "2019-03-24",
      "minesaxess.net": "2020-03-03",
      "mmh.ns02.us": "2019-04-11",
      "moreoffer.life": "2019-03-24",
      "mossad.mefound.com": "2019-09-17",
      "motoqu.com": "2020-02-14",
      "mp4.servemp3.com": "2017-04-14",
      "ms.suppoit.xyz": "2019-09-17",
      "msexchange13.com": "2020-03-03",
      "msexchanges16.com": "2020-03-03",
      "msupdata.com": "2022-01-25",
      "mythrow.ddns.net": "2022-04-14",
      "natco1.no-ip.net": "2017-04-14",
      "natco2.no-ip.net": "2018-09-23",
      "natco3.no-ip.net": "2017-04-14",
      "natco4.no-ip.net": "2018-09-23",
      "natco5.no-ip.net": "2017-04-14",
      "nazer.zapto.org": "2017-04-14",
      "new.newlan.co.vu": "2019-09-17",
      "newdowr.otzo.com": "2019-09-17",
      "newphoneapp.com": "2017-04-12",
      "news.bulk-smtp.xyz": "2019-09-17",
      "news.buybit.us": "2019-09-17",
      "news.net-freaks.com": "2019-09-17",
      "news015.otzo.com": "2019-09-17",
      "news20158.co.vu": "2019-09-17",
      "newshelpyou.com": "2023-11-12",
      "nextdata.site": "2020-03-03",
      "nicoledotso.icu": "2023-12-16",
      "nicoledotson.icu": "2020-02-13",
      "noredirecto.redirectme.net": "2017-04-12",
      "nrehcnthrtfmyi.strangled.net": "2017-04-14",
      "ns.suppoit.xyz": "2019-09-17",
      "ns2.negociosdesucesso.info": "2017-04-14",
      "nysura.com": "2020-02-14",
      "offeline.webhop.net": "2017-04-14",
      "officemanage.site": "2020-03-03",
      "orango.redirectme.net": "2017-04-14",
      "ping.topsite.life": "2019-03-24",
      "ra.goaglesmtp.co.vu": "2019-09-17",
      "ramliktest.mynetav.org": "2019-04-11",
      "redirectlnk.redirectme.net": "2017-04-14",
      "removalmalware.servecounterstrike.com": "2017-04-14",
      "rgoyfuadvkebxhjm.ddns.net": "2017-04-14",
      "rotter2.publicvm.com": "2017-04-12",
      "rotter2.sytes.net": "2017-04-14",
      "safar.selfip.com": "2017-04-14",
      "safara.sytes.net": "2017-04-12",
      "safari.linkpc.net": "2017-04-14",
      "sales-spy.ml": "2019-09-17",
      "sales.blogsyte.com": "2019-09-17",
      "sales.intarspace.co.vu": "2019-09-17",
      "sales.suppoit.xyz": "2019-09-17",
      "salesmarkting.co.vu": "2019-09-17",
      "saso10.myftp.biz": "2019-04-11",
      "ser.esmtp.biz": "2019-09-17",
      "servicebios.com": "2020-03-03",
      "signup.updatesforme.club": "2019-03-24",
      "singin.loginto.me": "2019-09-17",
      "sip.supportcom.xyz": "2019-09-17",
      "sky.otzo.com": "2019-09-17",
      "skynews1.blogsyte.com": "2019-09-17",
      "smartweb9.com": "2019-02-19",
      "smtp.email-test.ml": "2019-09-17",
      "smtp.gq": "2019-09-17",
      "smtpa.dynamic-dns.net": "2019-09-17",
      "socks.israel-shipment.xyz": "2019-09-17",
      "sognostudio.com": "2022-01-25",
      "spreng.vizvaz.com": "2017-04-14",
      "spynews.otzo.com": "2019-09-17",
      "star.mefound.com": "2019-09-17",
      "star.yaneom.space": "2019-09-17",
      "store-legal.biz": "2017-04-14",
      "su.noip.us": "2017-04-14",
      "sub.submitfda.co.vu": "2019-09-17",
      "submit.mrface.com": "2019-09-17",
      "sup.mefound.com": "2019-09-17",
      "supo.mefound.com": "2019-09-17",
      "support-sales.tk": "2019-09-17",
      "support.bkyane.xyz": "2019-09-17",
      "support.markting-fac.tk": "2019-09-17",
      "support.mypsx.net": "2019-09-17",
      "supports.mefound.com": "2019-04-11",
      "suppot-sales.mefound.com": "2019-09-17",
      "tango.zapto.org": "2017-04-14",
      "test.cable-modem.org": "2017-04-14",
      "test.ns01.info": "2017-04-14",
      "testcom.strangled.net": "2017-04-14",
      "testhoward.mysecondarydns.com": "2019-04-11",
      "testmace.compress.to": "2019-04-11",
      "theconomics.net": "2023-11-15",
      "thenewupdate.chickenkiller.com": "2017-04-14",
      "thenewupdatee.redirectme.net": "2017-04-14",
      "time-loss.dns05.com": "2019-04-11",
      "topsite.life": "2023-11-12",
      "transkf.tk": "2019-09-17",
      "tvnew.otzo.com": "2017-04-14",
      "uae.kim": "2018-09-23",
      "uggboots4sale.com": "2022-02-08",
      "up.uae.kim": "2017-04-14",
      "update.ciscofreak.com": "2017-04-14",
      "update.newshelpyou.com": "2023-11-12",
      "updatee.hopto.org": "2017-04-14",
      "updatee.serveblog.net": "2017-04-14",
      "updatesforme.club": "2023-11-12",
      "updato.ns01.info": "2017-04-14",
      "upgrade.newshelpyou.com": "2019-03-24",
      "uptime.uae.kim": "2017-04-14",
      "us-update.com": "2019-09-17",
      "us.suppoit.xyz": "2019-09-17",
      "use.mooo.com": "2017-04-14",
      "v6.support-sales.tk": "2019-09-17",
      "vbdodo.mefound.com": "2019-09-17",
      "version.downloadcor.xyz": "2019-09-17",
      "vinnysvinyl.com": "2020-06-04",
      "wallanews.publicvm.com": "2017-04-12",
      "wallanews.sytes.net": "2017-04-12",
      "wallnet.zyns.com": "2019-09-17",
      "wayne-lashley.com": "2023-12-14",
      "wcf6f0nqvjtup4un.mooo.com": "2017-04-14",
      "webfile.myq-see.com": "2017-04-12",
      "webtutorialz.com": "2020-02-14",
      "wembail.supportmai.cf": "2019-09-17",
      "wiknet.wikaba.com": "2019-03-24",
      "word.2waky.com": "2019-09-17",
      "xr.downloadcor.xyz": "2019-09-17",
      "yaneom.ml": "2019-09-17",
      "yaneom.space.co": "2019-09-17",
      "ynet.ignorelist.com": "2017-04-14",
      "ynet.sytes.net": "2017-04-14",
      "zapt.zapto.org": "2019-09-17",
      "zmartco.com": "2020-03-03"
    },
    "ipv4": {
      "149.28.137.224:10101": "2022-04-14",
      "79.124.60.40:80": "2019-11-29"
    },
    "url": {
      "http://185.244.39.165": "2022-01-25",
      "http://192.210.151.43": "2021-06-18",
      "http://23.94.218.221": "2022-01-25",
      "http://45.63.49.202": "2022-01-25"
    },
    "url_path": {
      "/rat/startup.rat": "2020-09-06"
    }
  },
  "first_seen_precision": {
    "domain": {},
    "ipv4": {},
    "url": {},
    "url_path": {}
  },
  "first_seen_range": {
    "earliest": "2015-03-18",
    "latest": "2023-12-16"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "0arfx4grailorhvlicbj.servehumour.com",
      "0n4tblbdfncaauxioxto.ddns.net",
      "3tshhm1nfphiqqrxbi8c.servehumour.com",
      "aaas.mefound.com",
      "acc.buybit.us",
      "accounts-helper.ml",
      "adfdafsggdfgdfgsagaer.blogsyte.com",
      "adsmartweb9.com",
      "ajaxo.zapto.org",
      "alasra-paper.duckdns.org",
      "aqs.filezellasd.co.vu",
      "aracaravan.com",
      "backjadwer.bounceme.net",
      "backop.mooo.com",
      "bandao.publicvm.com",
      "baz.downloadcor.xyz",
      "beatricewarner.com",
      "bulk-smtp.xyz",
      "bundanesia.com",
      "buy.israel-shipment.xyz",
      "bypasstesting.servehalflife.com",
      "cbbnews.tk",
      "cccam.serveblog.net",
      "checktest.www1.biz",
      "chromeupdt.tk",
      "cl170915.otzo.com",
      "claire-conway.com",
      "cloudserviceapi.online",
      "cnaci8gyolttkgmguzog.ignorelist.com",
      "cyaxsnieccunozn0erih.mefound.com",
      "cyber-peace.org",
      "cyber18.no-ip.net",
      "d.nabzerd.co.vu",
      "dapoerwedding.com",
      "data-server.cloudns.club",
      "deapka.sytes.net",
      "debka.ga",
      "depka.sytes.net",
      "dfwsd.co.vu",
      "direct-marketing.ml",
      "directl.otzo.com",
      "dji-msi.2waky.com",
      "dnsfor.dnsfor.me",
      "dontrplay.tk",
      "dorcertg.otzo.com",
      "down.downloadcor.xyz",
      "down.supportcom.xyz",
      "download.data-server.cloudns.club",
      "download.likescandy.com",
      "downloadlog.linkpc.net",
      "downloadmyhost.zapto.org",
      "downloadskype.cf",
      "drivres-update.info",
      "duntat.zapto.org",
      "easyuploadservice.com",
      "ed3qy5yioryitoturysuiu.otzo.com",
      "email-market.ml",
      "email-test.ml",
      "emailotest.co.vu",
      "emobileservices.club",
      "facetoo.co.vu",
      "fastbingcom.sytes.net",
      "fatihah.zapto.org",
      "filezellla.otzo.com",
      "freshchrysanthemum.com",
      "fulltest.yourtrap.com",
      "gabro.xxuz.com",
      "gamail.goaglesmtp.co.vu",
      "games.buybit.us",
      "gaonsmom.redirectme.net",
      "gfhbgfzfgfgfgdg.otzo.com",
      "goldenlines.site",
      "goodday.zapto.org",
      "goodwebmail.tk",
      "google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kim",
      "googlecombq6xx.ddns.net",
      "googledomain.otzo.com",
      "gov.uae.kim",
      "gq4bp1baxfiblzqk.mrbasic.com",
      "h908926f.beget.tech",
      "haartezenglish.redirectme.net",
      "haartezenglish.strangled.net",
      "hamas-wathaq.duckdns.org",
      "hdgshfdgh.co.vu",
      "healthcaption.com",
      "help2014.linkpc.net",
      "helthnews.ga",
      "hnoor.newphoneapp.com",
      "hostgatr.mrface.com",
      "hr.goaglesmtp.co.vu",
      "httpo.sytes.net",
      "idf.idfcom.co.vu",
      "imazing.ga",
      "inclusive-economy.com",
      "info.intarspace.co.vu",
      "infoblusa.tk",
      "internetdownloadr.publicvm.com",
      "iphonenewsd.co.vu",
      "itresolver.online",
      "jake.support-sales.tk",
      "jane-chapman.com",
      "javaupdate.no-ip.info",
      "jenneaypreff.linkpc.net",
      "justded.justdied.com",
      "kaliob.selfip.org",
      "kaswer12.strangled.net",
      "kolabdown.sytes.net",
      "krowd.downloadcor.xyz",
      "ksm5sksm5sksm5s.zzux.com",
      "laceibagrafica.com",
      "laptower.com",
      "lastmoon.mooo.com",
      "lilian.redirectme.net",
      "live.isasecret.com",
      "lkvz7bsfuiaidsyynu7bd2owpe.dns05.com",
      "lol.mynetav.org",
      "mailchat.zapto.org",
      "mailweb.otzo.com",
      "manual.newphoneapp.com",
      "marki.mefound.com",
      "markit.mefound.com",
      "markting-fac.tk",
      "markting.mefound.com",
      "marktingvb.ml",
      "masterservices.online",
      "microsoft10.compress.to",
      "minesaxess.net",
      "mmh.ns02.us",
      "moreoffer.life",
      "mossad.mefound.com",
      "motoqu.com",
      "mp4.servemp3.com",
      "ms.suppoit.xyz",
      "msexchange13.com",
      "msexchanges16.com",
      "msupdata.com",
      "mythrow.ddns.net",
      "natco1.no-ip.net",
      "natco2.no-ip.net",
      "natco3.no-ip.net",
      "natco4.no-ip.net",
      "natco5.no-ip.net",
      "nazer.zapto.org",
      "new.newlan.co.vu",
      "newdowr.otzo.com",
      "newphoneapp.com",
      "news.bulk-smtp.xyz",
      "news.buybit.us",
      "news.net-freaks.com",
      "news015.otzo.com",
      "news20158.co.vu",
      "newshelpyou.com",
      "nextdata.site",
      "nicoledotso.icu",
      "nicoledotson.icu",
      "noredirecto.redirectme.net",
      "nrehcnthrtfmyi.strangled.net",
      "ns.suppoit.xyz",
      "ns2.negociosdesucesso.info",
      "nysura.com",
      "offeline.webhop.net",
      "officemanage.site",
      "orango.redirectme.net",
      "ping.topsite.life",
      "ra.goaglesmtp.co.vu",
      "ramliktest.mynetav.org",
      "redirectlnk.redirectme.net",
      "removalmalware.servecounterstrike.com",
      "rgoyfuadvkebxhjm.ddns.net",
      "rotter2.publicvm.com",
      "rotter2.sytes.net",
      "safar.selfip.com",
      "safara.sytes.net",
      "safari.linkpc.net",
      "sales-spy.ml",
      "sales.blogsyte.com",
      "sales.intarspace.co.vu",
      "sales.suppoit.xyz",
      "salesmarkting.co.vu",
      "saso10.myftp.biz",
      "ser.esmtp.biz",
      "servicebios.com",
      "signup.updatesforme.club",
      "singin.loginto.me",
      "sip.supportcom.xyz",
      "sky.otzo.com",
      "skynews1.blogsyte.com",
      "smartweb9.com",
      "smtp.email-test.ml",
      "smtp.gq",
      "smtpa.dynamic-dns.net",
      "socks.israel-shipment.xyz",
      "sognostudio.com",
      "spreng.vizvaz.com",
      "spynews.otzo.com",
      "star.mefound.com",
      "star.yaneom.space",
      "store-legal.biz",
      "su.noip.us",
      "sub.submitfda.co.vu",
      "submit.mrface.com",
      "sup.mefound.com",
      "supo.mefound.com",
      "support-sales.tk",
      "support.bkyane.xyz",
      "support.markting-fac.tk",
      "support.mypsx.net",
      "supports.mefound.com",
      "suppot-sales.mefound.com",
      "tango.zapto.org",
      "test.cable-modem.org",
      "test.ns01.info",
      "testcom.strangled.net",
      "testhoward.mysecondarydns.com",
      "testmace.compress.to",
      "theconomics.net",
      "thenewupdate.chickenkiller.com",
      "thenewupdatee.redirectme.net",
      "time-loss.dns05.com",
      "topsite.life",
      "transkf.tk",
      "tvnew.otzo.com",
      "uae.kim",
      "uggboots4sale.com",
      "up.uae.kim",
      "update.ciscofreak.com",
      "update.newshelpyou.com",
      "updatee.hopto.org",
      "updatee.serveblog.net",
      "updatesforme.club",
      "updato.ns01.info",
      "upgrade.newshelpyou.com",
      "uptime.uae.kim",
      "us-update.com",
      "us.suppoit.xyz",
      "use.mooo.com",
      "v6.support-sales.tk",
      "vbdodo.mefound.com",
      "version.downloadcor.xyz",
      "vinnysvinyl.com",
      "wallanews.publicvm.com",
      "wallanews.sytes.net",
      "wallnet.zyns.com",
      "wayne-lashley.com",
      "wcf6f0nqvjtup4un.mooo.com",
      "webfile.myq-see.com",
      "webtutorialz.com",
      "wembail.supportmai.cf",
      "wiknet.wikaba.com",
      "word.2waky.com",
      "xr.downloadcor.xyz",
      "yaneom.ml",
      "yaneom.space.co",
      "ynet.ignorelist.com",
      "ynet.sytes.net",
      "zapt.zapto.org",
      "zmartco.com"
    ],
    "ipv4": [
      "149.28.137.224:10101",
      "79.124.60.40:80"
    ],
    "url": [
      "http://185.244.39.165",
      "http://192.210.151.43",
      "http://23.94.218.221",
      "http://45.63.49.202"
    ],
    "url_path": [
      "/rat/startup.rat"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "GAZA"
  ],
  "references": [
    "https://app.any.run/tasks/3e9d412a-49c9-48db-8b1f-f6fe55414b17/",
    "https://app.any.run/tasks/648c8a6d-6586-433f-ab65-5f4dd4b92729/",
    "https://app.any.run/tasks/cb96df9e-25f4-4d24-b4f8-c176938e24ec/",
    "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader",
    "https://otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e",
    "https://otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6",
    "https://otx.alienvault.com/pulse/5e46d6556e222319f332ec9a",
    "https://otx.alienvault.com/pulse/5f0dcfcaedaed628a054183d",
    "https://otx.alienvault.com/pulse/60cb37bf5fe8246bb2556969",
    "https://otx.alienvault.com/pulse/6202a3f984b0c0b13f2c88f8",
    "https://otx.alienvault.com/pulse/657b6fc5f21adc5b57300979",
    "https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/",
    "https://securelist.com/gaza-cybergang-updated-2017-activity/82765/",
    "https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east/",
    "https://twitter.com/BaoshengbinCumt/status/1352845385891373056",
    "https://twitter.com/JAMESWT_MHT/status/1268471328320913410",
    "https://twitter.com/James_inthe_box/status/1171510993857347585",
    "https://twitter.com/Timele9527/status/1200235223595618304",
    "https://twitter.com/h2jazi/status/1486094915872473096",
    "https://twitter.com/jeFF0Falltrades/status/1173300902242988032",
    "https://twitter.com/silv0123/status/1075047190819717122",
    "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor",
    "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf",
    "https://www.cybereason.com/blog/new-cyber-espionage-campaigns-targeting-palestinians-part-one",
    "https://www.proofpoint.com/us/blog/threat-insight/new-ta402-molerats-malware-targets-governments-middle-east",
    "https://www.proofpoint.com/us/blog/threat-insight/ta402-uses-complex-ironwind-infection-chains-target-middle-east-based-government",
    "https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage",
    "https://www.sentinelone.com/labs/gaza-cybergang-unified-front-targeting-hamas-opposition/",
    "https://www.virustotal.com/gui/file/2a9857f5b247488166e25d42f819459e685b3556e4f9ba0a052ba6b3c6c2fa4f/detection",
    "https://www.virustotal.com/gui/file/46e09a0d320f63deb6b13ce6986188d5224b93757484af768bdafc360a7733ff/detection",
    "https://www.virustotal.com/gui/file/973b2140bdba4f08306ab39a2245d6f200db1654d98a245c8020591788cb48f5/detection",
    "https://www.virustotal.com/gui/file/b2260d530f51b2289e2c64579eb53c4c9ce0c9ee3c850e57e90296968fd9625e/detection",
    "https://www.virustotal.com/gui/file/d48fe4b28ef4e5fb666d4f03247b31bc5bccb602d26e1cd6fc965cce25da9944/detection",
    "https://www.virustotal.com/gui/file/df3cf22649e723b82bab789e12055f29928fd3ffbab1d6701b6439163c98e12c/detection",
    "https://www.virustotal.com/gui/file/fa02e02e3db4076fd03fb54cd38bd6b04b07d7eaf2b4924fdd53eb5f2697134c/detection",
    "https://www.welivesecurity.com/2020/07/14/welcome-chat-secure-messaging-app-nothing-further-truth/",
    "https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "11 shared indicators",
          "kind": "infrastructure",
          "weight": 11.0
        }
      ],
      "slug": "QUASAR"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G0081"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G1028"
    },
    {
      "evidence": [
        {
          "detail": "1 shared indicator",
          "kind": "infrastructure",
          "weight": 1.0
        }
      ],
      "slug": "G0007"
    }
  ],
  "slug": "GAZA",
  "timeline": [
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2023-12-16",
      "indicators": {
        "domain": [
          "nicoledotso.icu"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/gaza-cybergang-unified-front-targeting-hamas-opposition/",
        "https://otx.alienvault.com/pulse/657b6fc5f21adc5b57300979",
        "https://app.any.run/tasks/3e9d412a-49c9-48db-8b1f-f6fe55414b17/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-12-14",
      "indicators": {
        "domain": [
          "aracaravan.com",
          "beatricewarner.com",
          "claire-conway.com",
          "jane-chapman.com",
          "wayne-lashley.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/gaza-cybergang-unified-front-targeting-hamas-opposition/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2023-11-15",
      "indicators": {
        "domain": [
          "healthcaption.com",
          "inclusive-economy.com",
          "theconomics.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/ta402-uses-complex-ironwind-infection-chains-target-middle-east-based-government"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 5
      },
      "first_seen": "2023-11-12",
      "indicators": {
        "domain": [
          "data-server.cloudns.club",
          "newshelpyou.com",
          "topsite.life",
          "update.newshelpyou.com",
          "updatesforme.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/gaza-cybergang-updated-2017-activity/82765/"
      ],
      "total": 5
    },
    {
      "counts": {
        "domain": 1,
        "ipv4": 1
      },
      "first_seen": "2022-04-14",
      "indicators": {
        "domain": [
          "mythrow.ddns.net"
        ],
        "ipv4": [
          "149.28.137.224:10101"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/46e09a0d320f63deb6b13ce6986188d5224b93757484af768bdafc360a7733ff/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-02-08",
      "indicators": {
        "domain": [
          "easyuploadservice.com",
          "uggboots4sale.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/ugg-boots-4-sale-tale-palestinian-aligned-espionage",
        "https://otx.alienvault.com/pulse/6202a3f984b0c0b13f2c88f8"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2,
        "url": 2
      },
      "first_seen": "2022-01-25",
      "indicators": {
        "domain": [
          "bundanesia.com",
          "msupdata.com"
        ],
        "url": [
          "http://23.94.218.221",
          "http://45.63.49.202"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1486094915872473096",
        "https://www.zscaler.com/blogs/security-research/new-espionage-attack-molerats-apt-targeting-users-middle-east",
        "https://www.virustotal.com/gui/file/2a9857f5b247488166e25d42f819459e685b3556e4f9ba0a052ba6b3c6c2fa4f/detection",
        "https://www.virustotal.com/gui/file/b2260d530f51b2289e2c64579eb53c4c9ce0c9ee3c850e57e90296968fd9625e/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1,
        "url": 1
      },
      "first_seen": "2022-01-25",
      "indicators": {
        "domain": [
          "sognostudio.com"
        ],
        "url": [
          "http://185.244.39.165"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.virustotal.com/gui/file/973b2140bdba4f08306ab39a2245d6f200db1654d98a245c8020591788cb48f5/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "url": 1
      },
      "first_seen": "2021-06-18",
      "indicators": {
        "url": [
          "http://192.210.151.43"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.proofpoint.com/us/blog/threat-insight/new-ta402-molerats-malware-targets-governments-middle-east",
        "https://otx.alienvault.com/pulse/60cb37bf5fe8246bb2556969"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1,
        "url_path": 1
      },
      "first_seen": "2020-09-06",
      "indicators": {
        "domain": [
          "h908926f.beget.tech"
        ],
        "url_path": [
          "/rat/startup.rat"
        ]
      },
      "precision": "exact",
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader",
        "https://www.virustotal.com/gui/file/df3cf22649e723b82bab789e12055f29928fd3ffbab1d6701b6439163c98e12c/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-07-14",
      "indicators": {
        "domain": [
          "emobileservices.club"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.welivesecurity.com/2020/07/14/welcome-chat-secure-messaging-app-nothing-further-truth/",
        "https://otx.alienvault.com/pulse/5f0dcfcaedaed628a054183d"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-06-04",
      "indicators": {
        "domain": [
          "vinnysvinyl.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JAMESWT_MHT/status/1268471328320913410",
        "https://app.any.run/tasks/648c8a6d-6586-433f-ab65-5f4dd4b92729/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 13
      },
      "first_seen": "2020-03-03",
      "indicators": {
        "domain": [
          "adsmartweb9.com",
          "cloudserviceapi.online",
          "goldenlines.site",
          "itresolver.online",
          "laptower.com",
          "masterservices.online",
          "minesaxess.net",
          "msexchange13.com",
          "msexchanges16.com",
          "nextdata.site",
          "officemanage.site",
          "servicebios.com",
          "zmartco.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor",
        "https://twitter.com/jeFF0Falltrades/status/1173300902242988032",
        "https://otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6"
      ],
      "total": 13
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2020-02-14",
      "indicators": {
        "domain": [
          "laceibagrafica.com",
          "motoqu.com",
          "nysura.com",
          "webtutorialz.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.cybereason.com/blog/new-cyber-espionage-campaigns-targeting-palestinians-part-one",
        "https://otx.alienvault.com/pulse/5e46d6556e222319f332ec9a",
        "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor",
        "https://twitter.com/jeFF0Falltrades/status/1173300902242988032",
        "https://otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2020-02-13",
      "indicators": {
        "domain": [
          "nicoledotson.icu"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.sentinelone.com/labs/gaza-cybergang-unified-front-targeting-hamas-opposition/",
        "https://otx.alienvault.com/pulse/657b6fc5f21adc5b57300979",
        "https://app.any.run/tasks/3e9d412a-49c9-48db-8b1f-f6fe55414b17/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-11-29",
      "indicators": {
        "domain": [
          "dorcertg.otzo.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
      ],
      "total": 1
    },
    {
      "counts": {
        "ipv4": 1
      },
      "first_seen": "2019-11-29",
      "indicators": {
        "ipv4": [
          "79.124.60.40:80"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/Timele9527/status/1200235223595618304"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 102
      },
      "first_seen": "2019-09-17",
      "indicators": {
        "domain": [
          "0arfx4grailorhvlicbj.servehumour.com",
          "0n4tblbdfncaauxioxto.ddns.net",
          "3tshhm1nfphiqqrxbi8c.servehumour.com",
          "aaas.mefound.com",
          "acc.buybit.us",
          "accounts-helper.ml",
          "adfdafsggdfgdfgsagaer.blogsyte.com",
          "aqs.filezellasd.co.vu",
          "baz.downloadcor.xyz",
          "bulk-smtp.xyz",
          "buy.israel-shipment.xyz",
          "cl170915.otzo.com",
          "cyaxsnieccunozn0erih.mefound.com",
          "d.nabzerd.co.vu",
          "debka.ga",
          "dfwsd.co.vu",
          "direct-marketing.ml",
          "directl.otzo.com",
          "dontrplay.tk",
          "down.downloadcor.xyz",
          "down.supportcom.xyz",
          "ed3qy5yioryitoturysuiu.otzo.com",
          "email-market.ml",
          "email-test.ml",
          "emailotest.co.vu",
          "facetoo.co.vu",
          "filezellla.otzo.com",
          "gabro.xxuz.com",
          "gamail.goaglesmtp.co.vu",
          "games.buybit.us",
          "gfhbgfzfgfgfgdg.otzo.com",
          "goodwebmail.tk",
          "googledomain.otzo.com",
          "hdgshfdgh.co.vu",
          "helthnews.ga",
          "hostgatr.mrface.com",
          "hr.goaglesmtp.co.vu",
          "idf.idfcom.co.vu",
          "imazing.ga",
          "info.intarspace.co.vu",
          "infoblusa.tk",
          "iphonenewsd.co.vu",
          "jake.support-sales.tk",
          "jenneaypreff.linkpc.net",
          "krowd.downloadcor.xyz",
          "lkvz7bsfuiaidsyynu7bd2owpe.dns05.com",
          "mailweb.otzo.com",
          "marki.mefound.com",
          "markit.mefound.com",
          "markting-fac.tk",
          "markting.mefound.com",
          "marktingvb.ml",
          "mossad.mefound.com",
          "ms.suppoit.xyz",
          "new.newlan.co.vu",
          "newdowr.otzo.com",
          "news.bulk-smtp.xyz",
          "news.buybit.us",
          "news.net-freaks.com",
          "news015.otzo.com",
          "news20158.co.vu",
          "ns.suppoit.xyz",
          "ra.goaglesmtp.co.vu",
          "sales-spy.ml",
          "sales.blogsyte.com",
          "sales.intarspace.co.vu",
          "sales.suppoit.xyz",
          "salesmarkting.co.vu",
          "ser.esmtp.biz",
          "singin.loginto.me",
          "sip.supportcom.xyz",
          "sky.otzo.com",
          "skynews1.blogsyte.com",
          "smtp.email-test.ml",
          "smtp.gq",
          "smtpa.dynamic-dns.net",
          "socks.israel-shipment.xyz",
          "spynews.otzo.com",
          "star.mefound.com",
          "star.yaneom.space",
          "sub.submitfda.co.vu",
          "submit.mrface.com",
          "sup.mefound.com",
          "supo.mefound.com",
          "support-sales.tk",
          "support.bkyane.xyz",
          "support.markting-fac.tk",
          "support.mypsx.net",
          "suppot-sales.mefound.com",
          "transkf.tk",
          "us-update.com",
          "us.suppoit.xyz",
          "v6.support-sales.tk",
          "vbdodo.mefound.com",
          "version.downloadcor.xyz",
          "wallnet.zyns.com",
          "wembail.supportmai.cf",
          "word.2waky.com",
          "xr.downloadcor.xyz",
          "yaneom.ml",
          "yaneom.space.co",
          "zapt.zapto.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
      ],
      "total": 102
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-09-16",
      "indicators": {
        "domain": [
          "dapoerwedding.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor",
        "https://twitter.com/jeFF0Falltrades/status/1173300902242988032",
        "https://otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-09-10",
      "indicators": {
        "domain": [
          "freshchrysanthemum.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/James_inthe_box/status/1171510993857347585",
        "https://app.any.run/tasks/cb96df9e-25f4-4d24-b4f8-c176938e24ec/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 7
      },
      "first_seen": "2019-04-11",
      "indicators": {
        "domain": [
          "dji-msi.2waky.com",
          "mmh.ns02.us",
          "ramliktest.mynetav.org",
          "saso10.myftp.biz",
          "testhoward.mysecondarydns.com",
          "testmace.compress.to",
          "time-loss.dns05.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e"
      ],
      "total": 7
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-04-11",
      "indicators": {
        "domain": [
          "supports.mefound.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e",
        "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2019-03-24",
      "indicators": {
        "domain": [
          "alasra-paper.duckdns.org",
          "download.data-server.cloudns.club",
          "hamas-wathaq.duckdns.org",
          "hnoor.newphoneapp.com",
          "lol.mynetav.org",
          "manual.newphoneapp.com",
          "moreoffer.life",
          "ping.topsite.life",
          "signup.updatesforme.club",
          "upgrade.newshelpyou.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/gaza-cybergang-updated-2017-activity/82765/"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2019-03-24",
      "indicators": {
        "domain": [
          "checktest.www1.biz",
          "fulltest.yourtrap.com",
          "microsoft10.compress.to",
          "wiknet.wikaba.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/silv0123/status/1075047190819717122",
        "https://otx.alienvault.com/pulse/5cae20f3a01b640c6da1441e"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2019-02-19",
      "indicators": {
        "domain": [
          "smartweb9.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://ti.360.net/blog/articles/suspected-molerats-new-attack-in-the-middle-east/",
        "https://twitter.com/Timele9527/status/1200235223595618304",
        "https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor",
        "https://twitter.com/jeFF0Falltrades/status/1173300902242988032",
        "https://otx.alienvault.com/pulse/5d7f50c9b115a641c04aacd6"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 3
      },
      "first_seen": "2018-09-23",
      "indicators": {
        "domain": [
          "natco2.no-ip.net",
          "natco4.no-ip.net",
          "uae.kim"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/"
      ],
      "total": 3
    },
    {
      "counts": {
        "domain": 68
      },
      "first_seen": "2017-04-14",
      "indicators": {
        "domain": [
          "ajaxo.zapto.org",
          "backjadwer.bounceme.net",
          "backop.mooo.com",
          "bandao.publicvm.com",
          "bypasstesting.servehalflife.com",
          "cbbnews.tk",
          "cccam.serveblog.net",
          "chromeupdt.tk",
          "cyber-peace.org",
          "cyber18.no-ip.net",
          "deapka.sytes.net",
          "depka.sytes.net",
          "download.likescandy.com",
          "downloadskype.cf",
          "duntat.zapto.org",
          "fastbingcom.sytes.net",
          "fatihah.zapto.org",
          "gaonsmom.redirectme.net",
          "goodday.zapto.org",
          "google.com.r3irv2ykn0qnd7vr7sqv7kg2qho3ab5tngl5avxi5iimz1jxw9pa9.uae.kim",
          "googlecombq6xx.ddns.net",
          "gov.uae.kim",
          "gq4bp1baxfiblzqk.mrbasic.com",
          "haartezenglish.redirectme.net",
          "haartezenglish.strangled.net",
          "httpo.sytes.net",
          "internetdownloadr.publicvm.com",
          "justded.justdied.com",
          "kaliob.selfip.org",
          "kaswer12.strangled.net",
          "lastmoon.mooo.com",
          "lilian.redirectme.net",
          "live.isasecret.com",
          "mailchat.zapto.org",
          "mp4.servemp3.com",
          "natco1.no-ip.net",
          "natco3.no-ip.net",
          "natco5.no-ip.net",
          "nazer.zapto.org",
          "nrehcnthrtfmyi.strangled.net",
          "ns2.negociosdesucesso.info",
          "offeline.webhop.net",
          "orango.redirectme.net",
          "redirectlnk.redirectme.net",
          "removalmalware.servecounterstrike.com",
          "rgoyfuadvkebxhjm.ddns.net",
          "rotter2.sytes.net",
          "safar.selfip.com",
          "safari.linkpc.net",
          "spreng.vizvaz.com",
          "store-legal.biz",
          "su.noip.us",
          "tango.zapto.org",
          "test.cable-modem.org",
          "test.ns01.info",
          "testcom.strangled.net",
          "thenewupdate.chickenkiller.com",
          "thenewupdatee.redirectme.net",
          "tvnew.otzo.com",
          "up.uae.kim",
          "updatee.hopto.org",
          "updatee.serveblog.net",
          "updato.ns01.info",
          "uptime.uae.kim",
          "use.mooo.com",
          "wcf6f0nqvjtup4un.mooo.com",
          "ynet.ignorelist.com",
          "ynet.sytes.net"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/"
      ],
      "total": 68
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2017-04-14",
      "indicators": {
        "domain": [
          "cnaci8gyolttkgmguzog.ignorelist.com",
          "dnsfor.dnsfor.me",
          "ksm5sksm5sksm5s.zzux.com",
          "update.ciscofreak.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/",
        "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 10
      },
      "first_seen": "2017-04-12",
      "indicators": {
        "domain": [
          "downloadlog.linkpc.net",
          "downloadmyhost.zapto.org",
          "help2014.linkpc.net",
          "kolabdown.sytes.net",
          "noredirecto.redirectme.net",
          "rotter2.publicvm.com",
          "safara.sytes.net",
          "wallanews.publicvm.com",
          "wallanews.sytes.net",
          "webfile.myq-see.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/"
      ],
      "total": 10
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2017-04-12",
      "indicators": {
        "domain": [
          "newphoneapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://securelist.com/gaza-cybergang-updated-2017-activity/82765/"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2015-12-19",
      "indicators": {
        "domain": [
          "drivres-update.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2015-03-18",
      "indicators": {
        "domain": [
          "javaupdate.no-ip.info"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/BaoshengbinCumt/status/1352845385891373056",
        "https://www.virustotal.com/gui/file/d48fe4b28ef4e5fb666d4f03247b31bc5bccb602d26e1cd6fc965cce25da9944/detection",
        "https://www.virustotal.com/gui/file/fa02e02e3db4076fd03fb54cd38bd6b04b07d7eaf2b4924fdd53eb5f2697134c/detection"
      ],
      "total": 1
    }
  ]
}