{
  "website": "*.ngrok.io",
  "tags": [
    "Phishing",
    "C&C",
    "Exfiltration",
    "Download"
  ],
  "service_provider": "Ngrok",
  "phishing": "Attackers can use a subdomain hosted on *.ngrok.io to host their phishing website.",
  "command_and_control": "Attackers can use *.ngrok.io for C&C purposes.",
  "exfiltration": "Attackers can upload files on websites hosted on *.ngrok.io.",
  "download": "Malicious tools can be stored on an attacker's domain and then have it hidden behind *.ngrok.io and used to download files when needed.",
  "sample_url": "https://www.joesandbox.com/analysis/308696/0/html",
  "created": "2021-11-21",
  "last_update": "2021-11-21",
  "credits": "umairq_",
  "detail_path": "/site/2a2e6e67726f6b2e696f",
  "detail_slug": "2a2e6e67726f6b2e696f",
  "detail_url": "https://lots-project.com/site/2a2e6e67726f6b2e696f",
  "scraped_at": "2026-06-16T11:58:11Z"
}