{
  "aliases": [
    "apt-c-61",
    "apt-q-122"
  ],
  "attack_id": null,
  "attack_name": null,
  "attack_url": null,
  "counts": {
    "domain": 18
  },
  "first_seen": {
    "domain": {
      "a0w.herokuapp.com": "2023-03-02",
      "a0x.herokuapp.com": "2021-07-16",
      "en-db.herokuapp.com": "2022-12-14",
      "en-docs.herokuapp.com": "2022-12-17",
      "en-localhost.herokuapp.com": "2023-03-05",
      "en-office365updatescente.herokuapp.com": "2023-03-05",
      "fcdn.pythonanywhere.com": "2021-07-16",
      "il1.000webhostapp.com": "2023-03-02",
      "jl3.000webhostapp.com": "2021-12-13",
      "media.randreports.org": "2022-12-17",
      "o-s.herokuapp.com": "2021-07-16",
      "os.herokuapp.com": "2021-12-13",
      "p-v.herokuapp.com": "2021-12-14",
      "p92.herokuapp.com": "2021-07-16",
      "pn0.herokuapp.com": "2021-12-13",
      "ps9.000webhostapp.com": "2021-12-13",
      "sysupdate.pythonanywhere.com": "2021-07-16",
      "w0m.herokuapp.com": "2021-07-16"
    }
  },
  "first_seen_precision": {
    "domain": {}
  },
  "first_seen_range": {
    "earliest": "2021-07-16",
    "latest": "2023-03-05"
  },
  "generated_at": "2026-08-08T03:26:30+00:00",
  "indicators": {
    "domain": [
      "a0w.herokuapp.com",
      "a0x.herokuapp.com",
      "en-db.herokuapp.com",
      "en-docs.herokuapp.com",
      "en-localhost.herokuapp.com",
      "en-office365updatescente.herokuapp.com",
      "fcdn.pythonanywhere.com",
      "il1.000webhostapp.com",
      "jl3.000webhostapp.com",
      "media.randreports.org",
      "o-s.herokuapp.com",
      "os.herokuapp.com",
      "p-v.herokuapp.com",
      "p92.herokuapp.com",
      "pn0.herokuapp.com",
      "ps9.000webhostapp.com",
      "sysupdate.pythonanywhere.com",
      "w0m.herokuapp.com"
    ]
  },
  "last_modified": "2026-01-02T23:10:15+00:00",
  "maltrail_groups": [
    "TENGYUNSNAKE"
  ],
  "references": [
    "https://mp.weixin.qq.com/s/Jpw7TqyPzOy57RAZDQdlWA (Chinese)",
    "https://mp.weixin.qq.com/s/s740Y3HaXBXkS5RJi9LaHQ",
    "https://otx.alienvault.com/pulse/60f1832853d980c86f70a513",
    "https://otx.alienvault.com/pulse/63ff7b6b6584638eea652256",
    "https://twitter.com/GGGGh0st/status/1470349494323580928",
    "https://twitter.com/HONKONE_K/status/1470581158635520000",
    "https://twitter.com/JVPv5sIM3eFmGyi/status/1603224777044676609",
    "https://twitter.com/RexorVc0/status/1631197867476938752",
    "https://twitter.com/blackorbird/status/1416008782962855936",
    "https://twitter.com/h2jazi/status/1603076130499690498",
    "https://twitter.com/h2jazi/status/1603076133020483584",
    "https://twitter.com/h2jazi/status/1603403975499317250",
    "https://twitter.com/k3yp0d/status/1470333776295247872",
    "https://twitter.com/s1ckb017/status/1470315624102600712",
    "https://www.virustotal.com/gui/file/0aeda32f977c98c8160491358491d0ad0898dcaa3366bde60c0a3bf8541e7b3f/detection",
    "https://www.virustotal.com/gui/file/193c921f7ab12c0066014ffad37a98ee57ecd5101dae2ddeb5e39200eb704431/detection",
    "https://www.virustotal.com/gui/file/2cc0f8a85df2b2b0dd4c6942125bf82e647e9ac7bb91467ac5c480cf5e1dd4ff/detection",
    "https://www.virustotal.com/gui/file/4ec021cc3dbb2b0de7313e41063026e3ef4777baf4dec2bdad7cd2d515bf0fe2/detection",
    "https://www.virustotal.com/gui/file/5e565fe047d24cb879cd051992073bb0e22588543c3511502b0d7745b8c048fd/detection",
    "https://www.virustotal.com/gui/file/a7b70acfb198410e39f94c9797241458be53fe965124d38c60a3294d6d84b3b4/detection",
    "https://www.virustotal.com/gui/file/dd2937ddf4f01bff1c5c46abef61a762a4e3dfb109d13fd38a98e9a7f82ac5c5/detection"
  ],
  "related": [],
  "slug": "TENGYUNSNAKE",
  "timeline": [
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-05",
      "indicators": {
        "domain": [
          "en-localhost.herokuapp.com",
          "en-office365updatescente.herokuapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://mp.weixin.qq.com/s/s740Y3HaXBXkS5RJi9LaHQ",
        "https://otx.alienvault.com/pulse/63ff7b6b6584638eea652256"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2023-03-02",
      "indicators": {
        "domain": [
          "a0w.herokuapp.com",
          "il1.000webhostapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/RexorVc0/status/1631197867476938752"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 2
      },
      "first_seen": "2022-12-17",
      "indicators": {
        "domain": [
          "en-docs.herokuapp.com",
          "media.randreports.org"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/JVPv5sIM3eFmGyi/status/1603224777044676609",
        "https://www.virustotal.com/gui/file/a7b70acfb198410e39f94c9797241458be53fe965124d38c60a3294d6d84b3b4/detection",
        "https://www.virustotal.com/gui/file/0aeda32f977c98c8160491358491d0ad0898dcaa3366bde60c0a3bf8541e7b3f/detection"
      ],
      "total": 2
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2022-12-14",
      "indicators": {
        "domain": [
          "en-db.herokuapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/h2jazi/status/1603076130499690498",
        "https://twitter.com/h2jazi/status/1603076133020483584",
        "https://twitter.com/h2jazi/status/1603403975499317250",
        "https://www.virustotal.com/gui/file/dd2937ddf4f01bff1c5c46abef61a762a4e3dfb109d13fd38a98e9a7f82ac5c5/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 1
      },
      "first_seen": "2021-12-14",
      "indicators": {
        "domain": [
          "p-v.herokuapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1470315624102600712",
        "https://twitter.com/GGGGh0st/status/1470349494323580928",
        "https://twitter.com/k3yp0d/status/1470333776295247872",
        "https://twitter.com/HONKONE_K/status/1470581158635520000",
        "https://mp.weixin.qq.com/s/Jpw7TqyPzOy57RAZDQdlWA (Chinese)",
        "https://www.virustotal.com/gui/file/4ec021cc3dbb2b0de7313e41063026e3ef4777baf4dec2bdad7cd2d515bf0fe2/detection",
        "https://www.virustotal.com/gui/file/2cc0f8a85df2b2b0dd4c6942125bf82e647e9ac7bb91467ac5c480cf5e1dd4ff/detection",
        "https://www.virustotal.com/gui/file/193c921f7ab12c0066014ffad37a98ee57ecd5101dae2ddeb5e39200eb704431/detection",
        "https://www.virustotal.com/gui/file/5e565fe047d24cb879cd051992073bb0e22588543c3511502b0d7745b8c048fd/detection"
      ],
      "total": 1
    },
    {
      "counts": {
        "domain": 4
      },
      "first_seen": "2021-12-13",
      "indicators": {
        "domain": [
          "jl3.000webhostapp.com",
          "os.herokuapp.com",
          "pn0.herokuapp.com",
          "ps9.000webhostapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/s1ckb017/status/1470315624102600712",
        "https://twitter.com/GGGGh0st/status/1470349494323580928",
        "https://twitter.com/k3yp0d/status/1470333776295247872",
        "https://twitter.com/HONKONE_K/status/1470581158635520000",
        "https://mp.weixin.qq.com/s/Jpw7TqyPzOy57RAZDQdlWA (Chinese)",
        "https://www.virustotal.com/gui/file/4ec021cc3dbb2b0de7313e41063026e3ef4777baf4dec2bdad7cd2d515bf0fe2/detection",
        "https://www.virustotal.com/gui/file/2cc0f8a85df2b2b0dd4c6942125bf82e647e9ac7bb91467ac5c480cf5e1dd4ff/detection",
        "https://www.virustotal.com/gui/file/193c921f7ab12c0066014ffad37a98ee57ecd5101dae2ddeb5e39200eb704431/detection",
        "https://www.virustotal.com/gui/file/5e565fe047d24cb879cd051992073bb0e22588543c3511502b0d7745b8c048fd/detection"
      ],
      "total": 4
    },
    {
      "counts": {
        "domain": 6
      },
      "first_seen": "2021-07-16",
      "indicators": {
        "domain": [
          "a0x.herokuapp.com",
          "fcdn.pythonanywhere.com",
          "o-s.herokuapp.com",
          "p92.herokuapp.com",
          "sysupdate.pythonanywhere.com",
          "w0m.herokuapp.com"
        ]
      },
      "precision": "exact",
      "references": [
        "https://twitter.com/blackorbird/status/1416008782962855936",
        "https://mp.weixin.qq.com/s/Jpw7TqyPzOy57RAZDQdlWA (Chinese)",
        "https://otx.alienvault.com/pulse/60f1832853d980c86f70a513"
      ],
      "total": 6
    }
  ]
}