{
  "aliases": [
    "AUDITUNNEL",
    "IHS Back-Connect backdoor"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "ipv4": 7,
    "url": 5
  },
  "first_seen": {
    "ipv4": {
      "149.28.193.216:443": "2023-01-24",
      "149.28.200.140:443": "2022-03-30",
      "149.28.207.120:443": "2023-10-14",
      "195.123.240.183:443": "2023-10-14",
      "40.76.20.11:21": "2023-10-14",
      "64.190.113.185:443": "2023-10-14",
      "67.205.135.147:53": "2023-10-14"
    },
    "url": {
      "http://149.28.193.216": "2023-01-24",
      "http://149.28.200.140": "2022-03-30",
      "http://149.28.207.120": "2023-10-14",
      "http://195.123.240.183": "2023-10-14",
      "http://64.190.113.185": "2023-10-14"
    }
  },
  "first_seen_precision": {
    "ipv4": {},
    "url": {}
  },
  "first_seen_range": {
    "earliest": "2022-03-30",
    "latest": "2023-10-14"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "ipv4": [
      "149.28.193.216:443",
      "149.28.200.140:443",
      "149.28.207.120:443",
      "195.123.240.183:443",
      "40.76.20.11:21",
      "64.190.113.185:443",
      "67.205.135.147:53"
    ],
    "url": [
      "http://149.28.193.216",
      "http://149.28.200.140",
      "http://149.28.207.120",
      "http://195.123.240.183",
      "http://64.190.113.185"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "GOLDMELODY"
  ],
  "references": [
    "https://otx.alienvault.com/pulse/6511e50028c3953453406132",
    "https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker"
  ],
  "related": [
    {
      "evidence": [
        {
          "detail": "2 shared indicators",
          "kind": "infrastructure",
          "weight": 2.0
        }
      ],
      "slug": "UNC961"
    }
  ],
  "slug": "GOLDMELODY",
  "timeline": [
    {
      "counts": {
        "ipv4": 5,
        "url": 3
      },
      "first_seen": "2023-10-14",
      "indicators": {
        "ipv4": [
          "149.28.207.120:443",
          "195.123.240.183:443",
          "40.76.20.11:21",
          "64.190.113.185:443",
          "67.205.135.147:53"
        ],
        "url": [
          "http://149.28.207.120",
          "http://195.123.240.183",
          "http://64.190.113.185"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker",
        "https://otx.alienvault.com/pulse/6511e50028c3953453406132"
      ],
      "total": 8
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2023-01-24",
      "indicators": {
        "ipv4": [
          "149.28.193.216:443"
        ],
        "url": [
          "http://149.28.193.216"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker",
        "https://otx.alienvault.com/pulse/6511e50028c3953453406132"
      ],
      "total": 2
    },
    {
      "counts": {
        "ipv4": 1,
        "url": 1
      },
      "first_seen": "2022-03-30",
      "indicators": {
        "ipv4": [
          "149.28.200.140:443"
        ],
        "url": [
          "http://149.28.200.140"
        ]
      },
      "precision": "exact",
      "references": [
        "https://www.secureworks.com/research/gold-melody-profile-of-an-initial-access-broker",
        "https://otx.alienvault.com/pulse/6511e50028c3953453406132"
      ],
      "total": 2
    }
  ]
}