{
  "type": "Domain",
  "indicator": "abc.py",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/abc.py",
    "alexa": "http://www.alexa.com/siteinfo/abc.py",
    "indicator": "abc.py",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3390783349,
      "indicator": "abc.py",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69fdc02bea1e4ec923b01688",
          "name": "ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.",
          "description": "interesting. 2000-06-05T14:09:35Z\nDNSSEC: unsigned\nDomain Name: GOTOCFR.COM\nDomain Status:  https://icann.org/epp#clientTransferProhibited\nName Server: NS37.WORLDNIC.COM\nName Server: NS38.WORLDNIC.COM\nRegistrant City: 3f16518cc21288a8\nRegistrant Country: US\nRegistrant Email: a07a5df6ca9e975bs@gotocfr.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: b3c25287c0f8ed51\nRegistrant Name: 3432650ec337c945\nRegistrant Organization: 3432650ec337c945\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: a8108981ed146828\nRegistrant Postal Code: 22ba98fa33e9a7d1\nRegistrant State/Province: 2f0a6dc5401e8a9a\nRegistrant Street: c4d735c293d4e708\nRegistrar Abuse Contact Email: domain.operations@web.com\nRegistrar Abuse Contact Phone: +1.8777228662\nRegistrar IANA ID: 2\nRegistrar URL: http://networksolutions.com\nRegistrar WHOIS Server: whois.networksolutions.com\nRegistrar: Network Solutions, LLC\nRegistry Domain ID: 28566423_DOMAIN_COM-VRSN\nUpdated Date: 2026-04-06T06:20:14Z",
          "modified": "2026-05-09T03:07:39.308000",
          "created": "2026-05-08T10:51:23.184000",
          "tags": [
            "msie",
            "chrome",
            "passive dns",
            "date",
            "urls",
            "fabricating and",
            "type",
            "media type",
            "gmt content",
            "certificate",
            "title",
            "body",
            "encrypt",
            "graph summary",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "code",
            "email",
            "server",
            "admin country",
            "registrant name",
            "and repair",
            "expiration date",
            "registry domain",
            "registrar iana",
            "creation date",
            "admin city",
            "key algorithm",
            "registrar abuse",
            "dnssec",
            "domain name",
            "status",
            "city",
            "us registrant",
            "registrant fax",
            "marshfield ssl",
            "common name",
            "issued",
            "supporte",
            "charter",
            "llc united",
            "statesunited",
            "new london",
            "i20100 may",
            "diesel",
            "ripe ncc",
            "ripe network",
            "abuse contact",
            "orgid",
            "orgtechhandle",
            "address",
            "orgabuseref",
            "postalcode",
            "ripe",
            "cidr",
            "ripe database",
            "orgabuseemail",
            "orgabusehandle",
            "nethandle",
            "thumbprint",
            "handle",
            "address range",
            "network name",
            "allocation type",
            "allocated pa",
            "whois server",
            "organization",
            "please note",
            "ip address",
            "google",
            "redacted for",
            "privacy admin",
            "privacy",
            "privacy tech",
            "street",
            "stateprovince",
            "form",
            "tech"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 236,
            "IPv4": 315,
            "URL": 932,
            "domain": 1040,
            "email": 65,
            "hostname": 1049,
            "FileHash-SHA256": 960,
            "FileHash-MD5": 301,
            "CIDR": 39,
            "IPv6": 68,
            "CVE": 890,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 5911,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "24 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b94ddfec797954b95d67c1",
          "name": "CAPE Sandbox",
          "description": "Checks available memory\nQueries the username/Connects to crypto currency mining pool\n/A possible heap spray exploit has been detected/Queries the keyboard layout/Queries the computer locale (possible geofencing)\nSetUnhandledExceptionFilter detected (possible anti-debug)/Accessed credential storage registry keys\nPossible date expiration check, exits too soon after checking local time/Checks system language via registry key (possible geofencing)\nAnomalous file deletion behavior detected (10+)\nAttempts to connect to a dead IP:Port (5 unique times)\nPerforms HTTP requests potentially not found in PCAP.\nCreates a process in a suspended state, likely for injection\nResumed a thread in another process\nReads from the memory of another process\nrest in references",
          "modified": "2026-04-16T13:37:13.951000",
          "created": "2026-03-17T12:49:35.769000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1485",
              "name": "Data Destruction",
              "display_name": "T1485 - Data Destruction"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1542",
              "name": "Pre-OS Boot",
              "display_name": "T1542 - Pre-OS Boot"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 337,
            "FileHash-SHA1": 356,
            "FileHash-SHA256": 324,
            "hostname": 315,
            "URL": 320,
            "domain": 24,
            "email": 7
          },
          "indicator_count": 1683,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "47 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62221d71474b323d486dc3f2",
          "name": "WTF 2022",
          "description": "",
          "modified": "2022-04-03T00:00:55.161000",
          "created": "2022-03-04T14:08:49.518000",
          "tags": [],
          "references": [
            "WTF.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 587,
            "URL": 668,
            "hostname": 613,
            "domain": 1320,
            "FileHash-MD5": 59,
            "FileHash-SHA1": 2
          },
          "indicator_count": 3249,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1521 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "WTF.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69fdc02bea1e4ec923b01688",
      "name": "ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.",
      "description": "interesting. 2000-06-05T14:09:35Z\nDNSSEC: unsigned\nDomain Name: GOTOCFR.COM\nDomain Status:  https://icann.org/epp#clientTransferProhibited\nName Server: NS37.WORLDNIC.COM\nName Server: NS38.WORLDNIC.COM\nRegistrant City: 3f16518cc21288a8\nRegistrant Country: US\nRegistrant Email: a07a5df6ca9e975bs@gotocfr.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: b3c25287c0f8ed51\nRegistrant Name: 3432650ec337c945\nRegistrant Organization: 3432650ec337c945\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: a8108981ed146828\nRegistrant Postal Code: 22ba98fa33e9a7d1\nRegistrant State/Province: 2f0a6dc5401e8a9a\nRegistrant Street: c4d735c293d4e708\nRegistrar Abuse Contact Email: domain.operations@web.com\nRegistrar Abuse Contact Phone: +1.8777228662\nRegistrar IANA ID: 2\nRegistrar URL: http://networksolutions.com\nRegistrar WHOIS Server: whois.networksolutions.com\nRegistrar: Network Solutions, LLC\nRegistry Domain ID: 28566423_DOMAIN_COM-VRSN\nUpdated Date: 2026-04-06T06:20:14Z",
      "modified": "2026-05-09T03:07:39.308000",
      "created": "2026-05-08T10:51:23.184000",
      "tags": [
        "msie",
        "chrome",
        "passive dns",
        "date",
        "urls",
        "fabricating and",
        "type",
        "media type",
        "gmt content",
        "certificate",
        "title",
        "body",
        "encrypt",
        "graph summary",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "code",
        "email",
        "server",
        "admin country",
        "registrant name",
        "and repair",
        "expiration date",
        "registry domain",
        "registrar iana",
        "creation date",
        "admin city",
        "key algorithm",
        "registrar abuse",
        "dnssec",
        "domain name",
        "status",
        "city",
        "us registrant",
        "registrant fax",
        "marshfield ssl",
        "common name",
        "issued",
        "supporte",
        "charter",
        "llc united",
        "statesunited",
        "new london",
        "i20100 may",
        "diesel",
        "ripe ncc",
        "ripe network",
        "abuse contact",
        "orgid",
        "orgtechhandle",
        "address",
        "orgabuseref",
        "postalcode",
        "ripe",
        "cidr",
        "ripe database",
        "orgabuseemail",
        "orgabusehandle",
        "nethandle",
        "thumbprint",
        "handle",
        "address range",
        "network name",
        "allocation type",
        "allocated pa",
        "whois server",
        "organization",
        "please note",
        "ip address",
        "google",
        "redacted for",
        "privacy admin",
        "privacy",
        "privacy tech",
        "street",
        "stateprovince",
        "form",
        "tech"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 236,
        "IPv4": 315,
        "URL": 932,
        "domain": 1040,
        "email": 65,
        "hostname": 1049,
        "FileHash-SHA256": 960,
        "FileHash-MD5": 301,
        "CIDR": 39,
        "IPv6": 68,
        "CVE": 890,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 5911,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "24 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b94ddfec797954b95d67c1",
      "name": "CAPE Sandbox",
      "description": "Checks available memory\nQueries the username/Connects to crypto currency mining pool\n/A possible heap spray exploit has been detected/Queries the keyboard layout/Queries the computer locale (possible geofencing)\nSetUnhandledExceptionFilter detected (possible anti-debug)/Accessed credential storage registry keys\nPossible date expiration check, exits too soon after checking local time/Checks system language via registry key (possible geofencing)\nAnomalous file deletion behavior detected (10+)\nAttempts to connect to a dead IP:Port (5 unique times)\nPerforms HTTP requests potentially not found in PCAP.\nCreates a process in a suspended state, likely for injection\nResumed a thread in another process\nReads from the memory of another process\nrest in references",
      "modified": "2026-04-16T13:37:13.951000",
      "created": "2026-03-17T12:49:35.769000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1485",
          "name": "Data Destruction",
          "display_name": "T1485 - Data Destruction"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1542",
          "name": "Pre-OS Boot",
          "display_name": "T1542 - Pre-OS Boot"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 337,
        "FileHash-SHA1": 356,
        "FileHash-SHA256": 324,
        "hostname": 315,
        "URL": 320,
        "domain": 24,
        "email": 7
      },
      "indicator_count": 1683,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "47 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62221d71474b323d486dc3f2",
      "name": "WTF 2022",
      "description": "",
      "modified": "2022-04-03T00:00:55.161000",
      "created": "2022-03-04T14:08:49.518000",
      "tags": [],
      "references": [
        "WTF.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 587,
        "URL": 668,
        "hostname": 613,
        "domain": 1320,
        "FileHash-MD5": 59,
        "FileHash-SHA1": 2
      },
      "indicator_count": 3249,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 406,
      "modified_text": "1521 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "abc.py",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "abc.py",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780415459.2041478
}