{
  "type": "Domain",
  "indicator": "56ds.net",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/56ds.net",
    "alexa": "http://www.alexa.com/siteinfo/56ds.net",
    "indicator": "56ds.net",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2932872878,
      "indicator": "56ds.net",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6a0a0e71af8047801da346a8",
          "name": "Credit: Skocherhan \"gh0st shadows\" clone [ty sk]",
          "description": "",
          "modified": "2026-05-20T08:57:02.834000",
          "created": "2026-05-17T18:52:33.147000",
          "tags": [],
          "references": [
            "114.114.114.114"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6a09f8a35ce1c4ed81629523",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 520,
            "hostname": 534,
            "URL": 487,
            "IPv4": 17,
            "FileHash-MD5": 4,
            "FileHash-SHA1": 4,
            "FileHash-SHA256": 16,
            "CIDR": 2,
            "email": 2
          },
          "indicator_count": 1586,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "12 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a09f8a35ce1c4ed81629523",
          "name": "gh0st shadows",
          "description": "msudosos, have a look",
          "modified": "2026-05-17T17:19:31.602000",
          "created": "2026-05-17T17:19:31.602000",
          "tags": [],
          "references": [
            "114.114.114.114"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 342,
            "hostname": 405,
            "URL": 437
          },
          "indicator_count": 1184,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 186,
          "modified_text": "15 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a09f17097a702a842737b52",
          "name": "China",
          "description": "",
          "modified": "2026-05-17T16:48:48.825000",
          "created": "2026-05-17T16:48:48.825000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 307,
            "hostname": 192
          },
          "indicator_count": 499,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 186,
          "modified_text": "15 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d40c9a87988555c2e23626",
          "name": "Described as \u2018Haunted\u2019 - Ransom & espionage continues to plague  residential communities | HighMark Residential",
          "description": "A national apartment apartment and townhome community that describes itself as luxury has developed such a poor reputation for poor conditions, communication, discrimination, a belief legal entities are running communities some which have been converted hospitals has a terrible spyware , ransom  problem they seem unwilling to address. Compromised to the hilt & famously known to have its own Reddit thread dedicated to a haunted\u2019 Denver community our team has  researched in the past. Denver community  had a compromise that likely brought attention to or spearheaded the AT&T outage. whitesky.us or the outage was a coincidence.\n\nConcerns about espionage, passwords, outages, ransomware. \ntips from former residents from Phoenix, Texas and Utah in on weekend. Broad research required.\nThailand live?",
          "modified": "2025-10-24T14:04:50.784000",
          "created": "2025-09-24T15:22:02.262000",
          "tags": [
            "encrypt",
            "residential",
            "benefits",
            "contact us",
            "email",
            "denver highmark",
            "windows nt",
            "dynamicloader",
            "generic http",
            "exe upload",
            "medium",
            "host",
            "inbound",
            "trojan",
            "write",
            "markus",
            "malware",
            "checkin",
            "trojandropper",
            "mtb sep",
            "united",
            "passive dns",
            "win32upatre sep",
            "ipv4",
            "reverse dns",
            "alerts",
            "av detections",
            "ids detections",
            "yara detections",
            "high",
            "dynamic",
            "reads",
            "pe file",
            "checks system",
            "write c",
            "a domains",
            "gmt server",
            "certificate",
            "hostname add",
            "url analysis",
            "title",
            "apache",
            "name servers",
            "ip address",
            "emails",
            "servers",
            "users",
            "recycle bin",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "defense evasion",
            "t1480 execution",
            "windir",
            "openurl c",
            "eregec4",
            "kl0hsy",
            "pattern match",
            "ascii text",
            "mitre att",
            "ck matrix",
            "t1057",
            "prefetch2",
            "yara signature",
            "general",
            "local",
            "path",
            "click",
            "ipv4 add",
            "urls",
            "files",
            "outbound",
            "cname",
            "apache x",
            "powered",
            "modified",
            "moved",
            "body doctype",
            "content type",
            "accept",
            "script script",
            "script urls",
            "queue security",
            "script begin",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "related tags",
            "dominet",
            "record value",
            "domain",
            "meta",
            "gmt etag",
            "pulse submit",
            "alive thailand",
            "xml title",
            "x tec",
            "html public",
            "show",
            "copy",
            "pe section",
            "contacted",
            "md5 add",
            "pulse pulses",
            "analysis date",
            "file score",
            "search",
            "win64",
            "khtml",
            "gecko",
            "json",
            "themida",
            "download",
            "next",
            "public folder",
            "windows",
            "highest",
            "a file",
            "checks adapter",
            "mpgph131 hr",
            "hourly rl",
            "mpgph131 lg",
            "onlogon rl",
            "entries",
            "checks",
            "high automated",
            "ollydbg",
            "gbdyllo",
            "file monitor",
            "process monitor",
            "cape",
            "related nids",
            "files location",
            "flag united",
            "pulses none",
            "next associated",
            "hosting",
            "33",
            "customercare"
          ],
          "references": [
            "IDS Detections: Win32/Vflooder.B Checkin | Virus Total vtapi DOS"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/Vflooder",
              "display_name": "Trojan:Win32/Vflooder",
              "target": "/malware/Trojan:Win32/Vflooder"
            },
            {
              "id": "Trojandownloader:Win32/Upatre",
              "display_name": "Trojandownloader:Win32/Upatre",
              "target": "/malware/Trojandownloader:Win32/Upatre"
            },
            {
              "id": "Win.Trojan.Agent",
              "display_name": "Win.Trojan.Agent",
              "target": null
            },
            {
              "id": "ALF:Trojan:Win32/G3nasom!imp",
              "display_name": "ALF:Trojan:Win32/G3nasom!imp",
              "target": null
            },
            {
              "id": "Trojandropper:Win32/Muldrop.V!MTB",
              "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
              "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
            },
            {
              "id": "Themida",
              "display_name": "Themida",
              "target": null
            },
            {
              "id": "TEL:CreateScheduledTask.A!Sigattr",
              "display_name": "TEL:CreateScheduledTask.A!Sigattr",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1211",
              "name": "Exploitation for Defense Evasion",
              "display_name": "T1211 - Exploitation for Defense Evasion"
            },
            {
              "id": "T1048.001",
              "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1595.001",
              "name": "Scanning IP Blocks",
              "display_name": "T1595.001 - Scanning IP Blocks"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3081,
            "FileHash-MD5": 756,
            "FileHash-SHA1": 724,
            "FileHash-SHA256": 3089,
            "domain": 1476,
            "email": 8,
            "hostname": 1198,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 10335,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "114.114.114.114",
        "IDS Detections: Win32/Vflooder.B Checkin | Virus Total vtapi DOS"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Alf:trojan:win32/g3nasom!imp",
            "Trojan:win32/vflooder",
            "Themida",
            "Trojandropper:win32/muldrop.v!mtb",
            "Win.trojan.agent",
            "Trojandownloader:win32/upatre",
            "Tel:createscheduledtask.a!sigattr"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6a0a0e71af8047801da346a8",
      "name": "Credit: Skocherhan \"gh0st shadows\" clone [ty sk]",
      "description": "",
      "modified": "2026-05-20T08:57:02.834000",
      "created": "2026-05-17T18:52:33.147000",
      "tags": [],
      "references": [
        "114.114.114.114"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6a09f8a35ce1c4ed81629523",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 520,
        "hostname": 534,
        "URL": 487,
        "IPv4": 17,
        "FileHash-MD5": 4,
        "FileHash-SHA1": 4,
        "FileHash-SHA256": 16,
        "CIDR": 2,
        "email": 2
      },
      "indicator_count": 1586,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "12 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a09f8a35ce1c4ed81629523",
      "name": "gh0st shadows",
      "description": "msudosos, have a look",
      "modified": "2026-05-17T17:19:31.602000",
      "created": "2026-05-17T17:19:31.602000",
      "tags": [],
      "references": [
        "114.114.114.114"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 342,
        "hostname": 405,
        "URL": 437
      },
      "indicator_count": 1184,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 186,
      "modified_text": "15 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a09f17097a702a842737b52",
      "name": "China",
      "description": "",
      "modified": "2026-05-17T16:48:48.825000",
      "created": "2026-05-17T16:48:48.825000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 307,
        "hostname": 192
      },
      "indicator_count": 499,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 186,
      "modified_text": "15 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d40c9a87988555c2e23626",
      "name": "Described as \u2018Haunted\u2019 - Ransom & espionage continues to plague  residential communities | HighMark Residential",
      "description": "A national apartment apartment and townhome community that describes itself as luxury has developed such a poor reputation for poor conditions, communication, discrimination, a belief legal entities are running communities some which have been converted hospitals has a terrible spyware , ransom  problem they seem unwilling to address. Compromised to the hilt & famously known to have its own Reddit thread dedicated to a haunted\u2019 Denver community our team has  researched in the past. Denver community  had a compromise that likely brought attention to or spearheaded the AT&T outage. whitesky.us or the outage was a coincidence.\n\nConcerns about espionage, passwords, outages, ransomware. \ntips from former residents from Phoenix, Texas and Utah in on weekend. Broad research required.\nThailand live?",
      "modified": "2025-10-24T14:04:50.784000",
      "created": "2025-09-24T15:22:02.262000",
      "tags": [
        "encrypt",
        "residential",
        "benefits",
        "contact us",
        "email",
        "denver highmark",
        "windows nt",
        "dynamicloader",
        "generic http",
        "exe upload",
        "medium",
        "host",
        "inbound",
        "trojan",
        "write",
        "markus",
        "malware",
        "checkin",
        "trojandropper",
        "mtb sep",
        "united",
        "passive dns",
        "win32upatre sep",
        "ipv4",
        "reverse dns",
        "alerts",
        "av detections",
        "ids detections",
        "yara detections",
        "high",
        "dynamic",
        "reads",
        "pe file",
        "checks system",
        "write c",
        "a domains",
        "gmt server",
        "certificate",
        "hostname add",
        "url analysis",
        "title",
        "apache",
        "name servers",
        "ip address",
        "emails",
        "servers",
        "users",
        "recycle bin",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "defense evasion",
        "t1480 execution",
        "windir",
        "openurl c",
        "eregec4",
        "kl0hsy",
        "pattern match",
        "ascii text",
        "mitre att",
        "ck matrix",
        "t1057",
        "prefetch2",
        "yara signature",
        "general",
        "local",
        "path",
        "click",
        "ipv4 add",
        "urls",
        "files",
        "outbound",
        "cname",
        "apache x",
        "powered",
        "modified",
        "moved",
        "body doctype",
        "content type",
        "accept",
        "script script",
        "script urls",
        "queue security",
        "script begin",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "related tags",
        "dominet",
        "record value",
        "domain",
        "meta",
        "gmt etag",
        "pulse submit",
        "alive thailand",
        "xml title",
        "x tec",
        "html public",
        "show",
        "copy",
        "pe section",
        "contacted",
        "md5 add",
        "pulse pulses",
        "analysis date",
        "file score",
        "search",
        "win64",
        "khtml",
        "gecko",
        "json",
        "themida",
        "download",
        "next",
        "public folder",
        "windows",
        "highest",
        "a file",
        "checks adapter",
        "mpgph131 hr",
        "hourly rl",
        "mpgph131 lg",
        "onlogon rl",
        "entries",
        "checks",
        "high automated",
        "ollydbg",
        "gbdyllo",
        "file monitor",
        "process monitor",
        "cape",
        "related nids",
        "files location",
        "flag united",
        "pulses none",
        "next associated",
        "hosting",
        "33",
        "customercare"
      ],
      "references": [
        "IDS Detections: Win32/Vflooder.B Checkin | Virus Total vtapi DOS"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/Vflooder",
          "display_name": "Trojan:Win32/Vflooder",
          "target": "/malware/Trojan:Win32/Vflooder"
        },
        {
          "id": "Trojandownloader:Win32/Upatre",
          "display_name": "Trojandownloader:Win32/Upatre",
          "target": "/malware/Trojandownloader:Win32/Upatre"
        },
        {
          "id": "Win.Trojan.Agent",
          "display_name": "Win.Trojan.Agent",
          "target": null
        },
        {
          "id": "ALF:Trojan:Win32/G3nasom!imp",
          "display_name": "ALF:Trojan:Win32/G3nasom!imp",
          "target": null
        },
        {
          "id": "Trojandropper:Win32/Muldrop.V!MTB",
          "display_name": "Trojandropper:Win32/Muldrop.V!MTB",
          "target": "/malware/Trojandropper:Win32/Muldrop.V!MTB"
        },
        {
          "id": "Themida",
          "display_name": "Themida",
          "target": null
        },
        {
          "id": "TEL:CreateScheduledTask.A!Sigattr",
          "display_name": "TEL:CreateScheduledTask.A!Sigattr",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1211",
          "name": "Exploitation for Defense Evasion",
          "display_name": "T1211 - Exploitation for Defense Evasion"
        },
        {
          "id": "T1048.001",
          "name": "Exfiltration Over Symmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.001 - Exfiltration Over Symmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1595.001",
          "name": "Scanning IP Blocks",
          "display_name": "T1595.001 - Scanning IP Blocks"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3081,
        "FileHash-MD5": 756,
        "FileHash-SHA1": 724,
        "FileHash-SHA256": 3089,
        "domain": 1476,
        "email": 8,
        "hostname": 1198,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 10335,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "56ds.net",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "56ds.net",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780365362.7294955
}