{
  "type": "Domain",
  "indicator": "activemetering.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/activemetering.com",
    "alexa": "http://www.alexa.com/siteinfo/activemetering.com",
    "indicator": "activemetering.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #6346",
        "name": "Akamai Popular Domain"
      }
    ],
    "base_indicator": {
      "id": 3591960502,
      "indicator": "activemetering.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6561581c55aacc7f571968af",
          "name": "Mirai | Inmortal | Loki | SpyEye",
          "description": "attack, cyber threat, network, vehicle tracking, cnc, athena cyber stalking, betabot, social engineering, Cisco umbrella, bambernek simda, active threat, ongoing spreader, spyware, redline stealer, qakbot, anilise, milemighmedia, sweetheart videos botnetwork, targeting ,  redirects, network, targeted toyota tracking",
          "modified": "2023-12-25T01:00:05.300000",
          "created": "2023-11-25T02:12:44.278000",
          "tags": [
            "replication",
            "date",
            "graph summary",
            "ssl certificate",
            "contacted",
            "whois record",
            "historical ssl",
            "threat roundup",
            "august",
            "tsara brashears",
            "whois whois",
            "execution",
            "dropped",
            "february",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "team",
            "malicious site",
            "malware",
            "phishing",
            "union",
            "bank",
            "unsafe",
            "united",
            "bambernek simda",
            "commerce",
            "pykspa",
            "bambernek",
            "ip reputation",
            "database",
            "vawtrak",
            "blacklist http",
            "search live",
            "api blog",
            "docs pricing",
            "login",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "reverse dns",
            "software",
            "general full",
            "resource",
            "hash",
            "get h2",
            "protocol h2",
            "security tls",
            "url http",
            "main",
            "attention",
            "please",
            "adblock pro",
            "loki",
            "mon jul",
            "first",
            "linkid252669",
            "pjp3sltkz",
            "heur",
            "malware site",
            "phishing site",
            "artemis",
            "iframe",
            "riskware",
            "exploit",
            "fakealert",
            "nircmd",
            "swrort",
            "downldr",
            "crack",
            "filetour",
            "cleaner",
            "wacatac",
            "xtrat",
            "genkryptik",
            "opencandy",
            "tiggre",
            "presenoker",
            "agent",
            "conduit",
            "xrat",
            "coinminer",
            "dropper",
            "alexa",
            "acint",
            "systweak",
            "behav",
            "download",
            "zbot",
            "xtreme",
            "installcore",
            "unruy",
            "patcher",
            "adload",
            "win64",
            "applicunwnt",
            "trojanspy",
            "webtoolbar",
            "cyber threat",
            "engineering",
            "firehol",
            "phishtank",
            "emotet",
            "ransomware",
            "malicious",
            "cobalt strike",
            "suppobox",
            "bradesco",
            "facebook",
            "banco",
            "nymaim",
            "smsspy",
            "stealer",
            "service",
            "mirai",
            "pony",
            "nanocore",
            "asyncrat",
            "downloader",
            "deepscan",
            "virut",
            "qakbot",
            "name verdict",
            "falcon sandbox",
            "blacklist https",
            "malicious url",
            "filerepmetagen",
            "et cins",
            "active threat",
            "reputation ip",
            "threats et",
            "cins active",
            "poor reputation",
            "ip tcp",
            "C2",
            "command_and_control",
            "spyware",
            "tracking",
            "targeting",
            "cyber stalking",
            "hostname",
            "simda",
            "kraken",
            "betabot",
            "zeus",
            "ramnit",
            "plasma",
            "citadel",
            "athena",
            "neutrino",
            "alina",
            "andromeda",
            "dexter",
            "unknown",
            "keylogger",
            "hawkeye",
            "phase",
            "jackpos",
            "spyeye",
            "vskimmer",
            "spitmo",
            "slingshot",
            "warbot",
            "redline stealer",
            "steam",
            "bandoo",
            "matsnu",
            "maltiverse",
            "bambernek gen",
            "internet storm",
            "infy",
            "inmortal",
            "addtopayload",
            "attack",
            "malvertizing"
          ],
          "references": [
            "https://networkpccontrol.com/video-player-1/?clickid=4030fe2twwhgxaa9&domain=standardtrackerchain.com&uclick=e2twwhgx&uclickhash=e2twwhgx-e2twwhgx-xoq53y-0-3zvc3y-oj1m9r-oj1m1n-5da44a",
            "https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45/65609b66e63f64cae305c749",
            "https://www.hybrid-analysis.com/sample/347314196559e7fbc75fc532daa774727b897d3a2156ea1328861f3b66f677a5/656146284d68f73e2306b6ad",
            "http://dev.findatoyota.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "Domains",
              "display_name": "Domains",
              "target": null
            },
            {
              "id": "SpyEye",
              "display_name": "SpyEye",
              "target": null
            },
            {
              "id": "Citadel",
              "display_name": "Citadel",
              "target": null
            },
            {
              "id": "MilesMX",
              "display_name": "MilesMX",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 81,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2450,
            "FileHash-SHA256": 2684,
            "domain": 1254,
            "URL": 9244,
            "CVE": 13,
            "FileHash-MD5": 931,
            "FileHash-SHA1": 487
          },
          "indicator_count": 17063,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "890 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "637c19a61643cabf92405aa6",
          "name": "meow.com.cn rsms.me cookies/website data",
          "description": "",
          "modified": "2022-12-22T00:03:52.810000",
          "created": "2022-11-22T00:36:54.647000",
          "tags": [
            "rsms.me",
            "meow.com.cn"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 648,
            "hostname": 198,
            "domain": 256,
            "FileHash-SHA256": 565
          },
          "indicator_count": 1667,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 393,
          "modified_text": "1258 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://networkpccontrol.com/video-player-1/?clickid=4030fe2twwhgxaa9&domain=standardtrackerchain.com&uclick=e2twwhgx&uclickhash=e2twwhgx-e2twwhgx-xoq53y-0-3zvc3y-oj1m9r-oj1m1n-5da44a",
        "https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45/65609b66e63f64cae305c749",
        "http://dev.findatoyota.com/",
        "https://www.hybrid-analysis.com/sample/347314196559e7fbc75fc532daa774727b897d3a2156ea1328861f3b66f677a5/656146284d68f73e2306b6ad"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Citadel",
            "Webtoolbar",
            "Milesmx",
            "Spyeye",
            "Inmortal",
            "Domains"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6561581c55aacc7f571968af",
      "name": "Mirai | Inmortal | Loki | SpyEye",
      "description": "attack, cyber threat, network, vehicle tracking, cnc, athena cyber stalking, betabot, social engineering, Cisco umbrella, bambernek simda, active threat, ongoing spreader, spyware, redline stealer, qakbot, anilise, milemighmedia, sweetheart videos botnetwork, targeting ,  redirects, network, targeted toyota tracking",
      "modified": "2023-12-25T01:00:05.300000",
      "created": "2023-11-25T02:12:44.278000",
      "tags": [
        "replication",
        "date",
        "graph summary",
        "ssl certificate",
        "contacted",
        "whois record",
        "historical ssl",
        "threat roundup",
        "august",
        "tsara brashears",
        "whois whois",
        "execution",
        "dropped",
        "february",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "cisco umbrella",
        "site",
        "safe site",
        "million",
        "alexa top",
        "team",
        "malicious site",
        "malware",
        "phishing",
        "union",
        "bank",
        "unsafe",
        "united",
        "bambernek simda",
        "commerce",
        "pykspa",
        "bambernek",
        "ip reputation",
        "database",
        "vawtrak",
        "blacklist http",
        "search live",
        "api blog",
        "docs pricing",
        "login",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "reverse dns",
        "software",
        "general full",
        "resource",
        "hash",
        "get h2",
        "protocol h2",
        "security tls",
        "url http",
        "main",
        "attention",
        "please",
        "adblock pro",
        "loki",
        "mon jul",
        "first",
        "linkid252669",
        "pjp3sltkz",
        "heur",
        "malware site",
        "phishing site",
        "artemis",
        "iframe",
        "riskware",
        "exploit",
        "fakealert",
        "nircmd",
        "swrort",
        "downldr",
        "crack",
        "filetour",
        "cleaner",
        "wacatac",
        "xtrat",
        "genkryptik",
        "opencandy",
        "tiggre",
        "presenoker",
        "agent",
        "conduit",
        "xrat",
        "coinminer",
        "dropper",
        "alexa",
        "acint",
        "systweak",
        "behav",
        "download",
        "zbot",
        "xtreme",
        "installcore",
        "unruy",
        "patcher",
        "adload",
        "win64",
        "applicunwnt",
        "trojanspy",
        "webtoolbar",
        "cyber threat",
        "engineering",
        "firehol",
        "phishtank",
        "emotet",
        "ransomware",
        "malicious",
        "cobalt strike",
        "suppobox",
        "bradesco",
        "facebook",
        "banco",
        "nymaim",
        "smsspy",
        "stealer",
        "service",
        "mirai",
        "pony",
        "nanocore",
        "asyncrat",
        "downloader",
        "deepscan",
        "virut",
        "qakbot",
        "name verdict",
        "falcon sandbox",
        "blacklist https",
        "malicious url",
        "filerepmetagen",
        "et cins",
        "active threat",
        "reputation ip",
        "threats et",
        "cins active",
        "poor reputation",
        "ip tcp",
        "C2",
        "command_and_control",
        "spyware",
        "tracking",
        "targeting",
        "cyber stalking",
        "hostname",
        "simda",
        "kraken",
        "betabot",
        "zeus",
        "ramnit",
        "plasma",
        "citadel",
        "athena",
        "neutrino",
        "alina",
        "andromeda",
        "dexter",
        "unknown",
        "keylogger",
        "hawkeye",
        "phase",
        "jackpos",
        "spyeye",
        "vskimmer",
        "spitmo",
        "slingshot",
        "warbot",
        "redline stealer",
        "steam",
        "bandoo",
        "matsnu",
        "maltiverse",
        "bambernek gen",
        "internet storm",
        "infy",
        "inmortal",
        "addtopayload",
        "attack",
        "malvertizing"
      ],
      "references": [
        "https://networkpccontrol.com/video-player-1/?clickid=4030fe2twwhgxaa9&domain=standardtrackerchain.com&uclick=e2twwhgx&uclickhash=e2twwhgx-e2twwhgx-xoq53y-0-3zvc3y-oj1m9r-oj1m1n-5da44a",
        "https://www.hybrid-analysis.com/sample/ea8a341cbd3666af7bfce260d86b465844314d86faba75c80eab3ce4d3bc3b45/65609b66e63f64cae305c749",
        "https://www.hybrid-analysis.com/sample/347314196559e7fbc75fc532daa774727b897d3a2156ea1328861f3b66f677a5/656146284d68f73e2306b6ad",
        "http://dev.findatoyota.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "Domains",
          "display_name": "Domains",
          "target": null
        },
        {
          "id": "SpyEye",
          "display_name": "SpyEye",
          "target": null
        },
        {
          "id": "Citadel",
          "display_name": "Citadel",
          "target": null
        },
        {
          "id": "MilesMX",
          "display_name": "MilesMX",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 81,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2450,
        "FileHash-SHA256": 2684,
        "domain": 1254,
        "URL": 9244,
        "CVE": 13,
        "FileHash-MD5": 931,
        "FileHash-SHA1": 487
      },
      "indicator_count": 17063,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "890 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "637c19a61643cabf92405aa6",
      "name": "meow.com.cn rsms.me cookies/website data",
      "description": "",
      "modified": "2022-12-22T00:03:52.810000",
      "created": "2022-11-22T00:36:54.647000",
      "tags": [
        "rsms.me",
        "meow.com.cn"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 648,
        "hostname": 198,
        "domain": 256,
        "FileHash-SHA256": 565
      },
      "indicator_count": 1667,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 393,
      "modified_text": "1258 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "activemetering.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "activemetering.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780398632.7825289
}