{ "type": "Domain", "indicator": "activeterroristwarningcompany.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/activeterroristwarningcompany.com", "alexa": "http://www.alexa.com/siteinfo/activeterroristwarningcompany.com", "indicator": "activeterroristwarningcompany.com", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 2116516268, "indicator": "activeterroristwarningcompany.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "65709c1a3462dae3a7d8714b", "name": "IOC202306052234", "description": "", "modified": "2023-12-06T16:06:50.890000", "created": "2023-12-06T16:06:50.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1096, "FileHash-MD5": 307, "FileHash-SHA1": 268, "domain": 265, "CVE": 6, "hostname": 246, "URL": 29 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570994901b8a87d7eb31aa7", "name": "IOCS202304091516", "description": "", "modified": "2023-12-06T15:54:49.341000", "created": "2023-12-06T15:54:49.341000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 980, "FileHash-MD5": 196, "FileHash-SHA1": 196, "domain": 182, "hostname": 279, "URL": 3 }, "indicator_count": 1836, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647e46cde36f3b047c03f8db", "name": "IOC202306052234", "description": "", "modified": "2023-07-05T20:01:39.023000", "created": "2023-06-05T20:34:21.028000", "tags": [ "june", "seen", "track them", "all at", "chatgpt", "april", "march", "recent blog", "february", "lockbit", "smoke loader", "qbot", "predator", "emotet", "danabot", "gandcrab", "orcus rat", "icedid", "sodinokibi", "agent tesla", "ave maria", "gootkit", "cobalt strike", "dharma", "hawkeye", "trojan", "zloader", "formbook", "crimson rat", "trickbot", "nemty", "netwalker", "pony", "glupteba", "azorult", "dridex", "hancitor", "raccoon", "maze", "vidar", "ryuk ransomware", "guloader", "amadey", "adwind", "quasar rat", "troldesh", "rats", "remcos", "revenge", "ursnif", "cryptbot", "flawedammyy", "phobos", "august", "snake", "ryuk", "quasar", "netwire", "darkside", "redline", "asyncrat", "ransomware", "darkcomet", "wannacry", "nanocore", "lokibot", "orcus", "thief", "malware", "systembc", "powershell", "adwind rat", "squirrelwaffle", "redline stealer", "bitcoin", "open", "copy", "ukraine", "nanocore rat", "houdini", "revenge rat", "dyre", "first", "eternalblue", "fallout", "smokeloader", "dofoil", "macos", "predator pain", "revil", "wcry ransomware", "bladabindi", "teamviewer", "agenttesla", "belarus", "cobaltstrike", "hermes", "execution", "crimson", "crysis", "shadow", "njrat", "next", "loader", "malspam", "ransom", "mimikatz", "cloudeye", "hworm", "friendly", "napoleon", "qakbot", "click", "ammyy admin", "flawedammy", "andromut", "vawtrak", "windigo", "mailto", "kill", "desktop", "discord", "loki bot", "mars", "apart", "smokeldr", "racealer", "hunter", "psexec", "mega", "cve201711882", "maldoc", "dunihi", "jenxcus", "xtremerat", "poisonivy", "fareit", "siplog", "gozi", "egregor", "browserpassview", "mailpassview", "aggah", "virustotal", "pinkslipbot", "path", "chacha", "spelevo", "killswitch", "sockrat", "mexico", "alienspy", "chthonic", "aurora", "winrar", "bokbot", "ammyy", "servhelper", "neutrino", "angler", "chanitor", "teamspy", "axpergle", "nuclear", "cridex", "service", "scarimson", "sticky", "terdot", "zbot", "panda banker", "screen", "polish" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1220", "name": "XSL Script Processing", "display_name": "T1220 - XSL Script Processing" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 29, "FileHash-MD5": 307, "FileHash-SHA1": 268, "FileHash-SHA256": 1096, "CVE": 6, "domain": 265, "hostname": 246 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "1060 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6432bac1eb5fb65376156579", "name": "IOCS202304091516", "description": "Hashes for the first time have been shared by users using the same IP address as those on Facebook, Twitter and other social media sites, as well as the BBC News Channel and BBC iPlayer.", "modified": "2023-05-09T13:02:06.153000", "created": "2023-04-09T13:16:49.795000", "tags": [ "emotet", "wannacry", "wannycry", "trickbot", "qbot", "cobalt strike", "flawedammyy", "systembc", "domains", "hashes", "wcry", "microsoft", "iocs ip", "emotet malware", "fake net", "cobaltstrike", "first", "eternalblue", "desktop", "trojan", "agent tesla", "malware", "fallout" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "SystemBC", "display_name": "SystemBC", "target": null }, { "id": "FlawedAmmyy", "display_name": "FlawedAmmyy", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Qbot", "display_name": "Qbot", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "WannyCry", "display_name": "WannyCry", "target": null }, { "id": "WannaCry", "display_name": "WannaCry", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 196, "FileHash-SHA1": 196, "FileHash-SHA256": 980, "URL": 3, "domain": 182, "hostname": 279 }, "indicator_count": 1836, "is_author": false, "is_subscribing": null, "subscriber_count": 418, "modified_text": "1117 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6223da75bbe1c28fe8f00628", "name": "+20 urls", "description": "Ejercicio OTX Urosario Ciberseguridad", "modified": "2022-03-05T21:47:33.259000", "created": "2022-03-05T21:47:33.259000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "A.F.D\u00edaz", "id": "183708", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 24, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 7, "modified_text": "1547 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621fda41d10c4b26bcd6c7af", "name": "OTX - Threat Intelligence - GL", "description": "", "modified": "2022-03-02T20:57:37.896000", "created": "2022-03-02T20:57:37.896000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "currrsiva", "id": "183341", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 26 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 5, "modified_text": "1550 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621fd4c1be7e76f7aab76706", "name": "OTX - Threat Intelligence 2", "description": "bad urls", "modified": "2022-03-02T20:34:09.389000", "created": "2022-03-02T20:34:09.389000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tejcamil", "id": "166775", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 208, "hostname": 2 }, "indicator_count": 210, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "1550 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f2d17cf78b5b74a5cd493c", "name": "REvil Ransomware IoCs: 2022 Learnings", "description": "Access to a comprehensive web-based solution to monitor and monitor all domain events, including the latest registrations, changes to DNS records, and the discovery of domain availability. \u00c2\u00a31.5m", "modified": "2022-02-26T00:02:44.767000", "created": "2022-01-27T17:08:12.941000", "tags": [ "ip addresses", "malicious", "iocs", "revil", "whois", "whois api", "whois record", "whois domain name", "whois ip address", "whois email address", "cyber threat intelligence", "domain & ip intelligence data feeds", "state", "alienvault", "isps", "download" ], "references": [ "https://main.whoisxmlapi.com/threat-reports/revil-ransomware-what-can-we-learn-from-published-iocs-in-2022" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "REvil", "display_name": "REvil", "target": null } ], "attack_ids": [ { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 91, "hostname": 4 }, "indicator_count": 95, "is_author": false, "is_subscribing": null, "subscriber_count": 58, "modified_text": "1555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://main.whoisxmlapi.com/threat-reports/revil-ransomware-what-can-we-learn-from-published-iocs-in-2022" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [ "Revil", "Systembc", "Wannacry", "Wannycry", "Flawedammyy", "Cobalt strike", "Agent tesla", "Trickbot", "Emotet", "Qbot" ], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "65709c1a3462dae3a7d8714b", "name": "IOC202306052234", "description": "", "modified": "2023-12-06T16:06:50.890000", "created": "2023-12-06T16:06:50.890000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1096, "FileHash-MD5": 307, "FileHash-SHA1": 268, "domain": 265, "CVE": 6, "hostname": 246, "URL": 29 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570994901b8a87d7eb31aa7", "name": "IOCS202304091516", "description": "", "modified": "2023-12-06T15:54:49.341000", "created": "2023-12-06T15:54:49.341000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 980, "FileHash-MD5": 196, "FileHash-SHA1": 196, "domain": 182, "hostname": 279, "URL": 3 }, "indicator_count": 1836, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "906 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "647e46cde36f3b047c03f8db", "name": "IOC202306052234", "description": "", "modified": "2023-07-05T20:01:39.023000", "created": "2023-06-05T20:34:21.028000", "tags": [ "june", "seen", "track them", "all at", "chatgpt", "april", "march", "recent blog", "february", "lockbit", "smoke loader", "qbot", "predator", "emotet", "danabot", "gandcrab", "orcus rat", "icedid", "sodinokibi", "agent tesla", "ave maria", "gootkit", "cobalt strike", "dharma", "hawkeye", "trojan", "zloader", "formbook", "crimson rat", "trickbot", "nemty", "netwalker", "pony", "glupteba", "azorult", "dridex", "hancitor", "raccoon", "maze", "vidar", "ryuk ransomware", "guloader", "amadey", "adwind", "quasar rat", "troldesh", "rats", "remcos", "revenge", "ursnif", "cryptbot", "flawedammyy", "phobos", "august", "snake", "ryuk", "quasar", "netwire", "darkside", "redline", "asyncrat", "ransomware", "darkcomet", "wannacry", "nanocore", "lokibot", "orcus", "thief", "malware", "systembc", "powershell", "adwind rat", "squirrelwaffle", "redline stealer", "bitcoin", "open", "copy", "ukraine", "nanocore rat", "houdini", "revenge rat", "dyre", "first", "eternalblue", "fallout", "smokeloader", "dofoil", "macos", "predator pain", "revil", "wcry ransomware", "bladabindi", "teamviewer", "agenttesla", "belarus", "cobaltstrike", "hermes", "execution", "crimson", "crysis", "shadow", "njrat", "next", "loader", "malspam", "ransom", "mimikatz", "cloudeye", "hworm", "friendly", "napoleon", "qakbot", "click", "ammyy admin", "flawedammy", "andromut", "vawtrak", "windigo", "mailto", "kill", "desktop", "discord", "loki bot", "mars", "apart", "smokeldr", "racealer", "hunter", "psexec", "mega", "cve201711882", "maldoc", "dunihi", "jenxcus", "xtremerat", "poisonivy", "fareit", "siplog", "gozi", "egregor", "browserpassview", "mailpassview", "aggah", "virustotal", "pinkslipbot", "path", "chacha", "spelevo", "killswitch", "sockrat", "mexico", "alienspy", "chthonic", "aurora", "winrar", "bokbot", "ammyy", "servhelper", "neutrino", "angler", "chanitor", "teamspy", "axpergle", "nuclear", "cridex", "service", "scarimson", "sticky", "terdot", "zbot", "panda banker", "screen", "polish" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1218", "name": "Signed Binary Proxy Execution", "display_name": "T1218 - Signed Binary Proxy Execution" }, { "id": "T1220", "name": "XSL Script Processing", "display_name": "T1220 - XSL Script Processing" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 29, "FileHash-MD5": 307, "FileHash-SHA1": 268, "FileHash-SHA256": 1096, "CVE": 6, "domain": 265, "hostname": 246 }, "indicator_count": 2217, "is_author": false, "is_subscribing": null, "subscriber_count": 424, "modified_text": "1060 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6432bac1eb5fb65376156579", "name": "IOCS202304091516", "description": "Hashes for the first time have been shared by users using the same IP address as those on Facebook, Twitter and other social media sites, as well as the BBC News Channel and BBC iPlayer.", "modified": "2023-05-09T13:02:06.153000", "created": "2023-04-09T13:16:49.795000", "tags": [ "emotet", "wannacry", "wannycry", "trickbot", "qbot", "cobalt strike", "flawedammyy", "systembc", "domains", "hashes", "wcry", "microsoft", "iocs ip", "emotet malware", "fake net", "cobaltstrike", "first", "eternalblue", "desktop", "trojan", "agent tesla", "malware", "fallout" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "SystemBC", "display_name": "SystemBC", "target": null }, { "id": "FlawedAmmyy", "display_name": "FlawedAmmyy", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Qbot", "display_name": "Qbot", "target": null }, { "id": "Trickbot", "display_name": "Trickbot", "target": null }, { "id": "WannyCry", "display_name": "WannyCry", "target": null }, { "id": "WannaCry", "display_name": "WannaCry", "target": null }, { "id": "Emotet", "display_name": "Emotet", "target": null }, { "id": "Agent Tesla", "display_name": "Agent Tesla", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1080", "name": "Taint Shared Content", "display_name": "T1080 - Taint Shared Content" }, { "id": "T1102", "name": "Web Service", "display_name": "T1102 - Web Service" }, { "id": "T1210", "name": "Exploitation of Remote Services", "display_name": "T1210 - Exploitation of Remote Services" }, { "id": "T1486", "name": "Data Encrypted for Impact", "display_name": "T1486 - Data Encrypted for Impact" }, { "id": "T1490", "name": "Inhibit System Recovery", "display_name": "T1490 - Inhibit System Recovery" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "AlessandroFiori", "id": "91912", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_91912/resized/80/avatar_2b1b2b88b6.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 196, "FileHash-SHA1": 196, "FileHash-SHA256": 980, "URL": 3, "domain": 182, "hostname": 279 }, "indicator_count": 1836, "is_author": false, "is_subscribing": null, "subscriber_count": 418, "modified_text": "1117 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6223da75bbe1c28fe8f00628", "name": "+20 urls", "description": "Ejercicio OTX Urosario Ciberseguridad", "modified": "2022-03-05T21:47:33.259000", "created": "2022-03-05T21:47:33.259000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "A.F.D\u00edaz", "id": "183708", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 24, "hostname": 1 }, "indicator_count": 25, "is_author": false, "is_subscribing": null, "subscriber_count": 7, "modified_text": "1547 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621fda41d10c4b26bcd6c7af", "name": "OTX - Threat Intelligence - GL", "description": "", "modified": "2022-03-02T20:57:37.896000", "created": "2022-03-02T20:57:37.896000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "currrsiva", "id": "183341", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 26 }, "indicator_count": 26, "is_author": false, "is_subscribing": null, "subscriber_count": 5, "modified_text": "1550 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "621fd4c1be7e76f7aab76706", "name": "OTX - Threat Intelligence 2", "description": "bad urls", "modified": "2022-03-02T20:34:09.389000", "created": "2022-03-02T20:34:09.389000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "tejcamil", "id": "166775", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 208, "hostname": 2 }, "indicator_count": 210, "is_author": false, "is_subscribing": null, "subscriber_count": 15, "modified_text": "1550 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "61f2d17cf78b5b74a5cd493c", "name": "REvil Ransomware IoCs: 2022 Learnings", "description": "Access to a comprehensive web-based solution to monitor and monitor all domain events, including the latest registrations, changes to DNS records, and the discovery of domain availability. \u00c2\u00a31.5m", "modified": "2022-02-26T00:02:44.767000", "created": "2022-01-27T17:08:12.941000", "tags": [ "ip addresses", "malicious", "iocs", "revil", "whois", "whois api", "whois record", "whois domain name", "whois ip address", "whois email address", "cyber threat intelligence", "domain & ip intelligence data feeds", "state", "alienvault", "isps", "download" ], "references": [ "https://main.whoisxmlapi.com/threat-reports/revil-ransomware-what-can-we-learn-from-published-iocs-in-2022" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "REvil", "display_name": "REvil", "target": null } ], "attack_ids": [ { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ElastZris", "id": "176027", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 91, "hostname": 4 }, "indicator_count": 95, "is_author": false, "is_subscribing": null, "subscriber_count": 58, "modified_text": "1555 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "activeterroristwarningcompany.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "activeterroristwarningcompany.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780192704.6562111 }