{
  "type": "Domain",
  "indicator": "ajfnee.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/ajfnee.com",
    "alexa": "http://www.alexa.com/siteinfo/ajfnee.com",
    "indicator": "ajfnee.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3290216612,
      "indicator": "ajfnee.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69fd98fba834ab33f7cfe50f",
          "name": "Telus Communications (Canadian ISP) clone Disable_Duck - relevant Ip shadows",
          "description": "",
          "modified": "2026-05-08T08:04:11.769000",
          "created": "2026-05-08T08:04:11.769000",
          "tags": [
            "Telus"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/graph",
            "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/iocs",
            "https://tria.ge/240428-tjsmrsbf4t",
            "https://www.virustotal.com/graph/embed/ga06a03c71a1848adb8e47517af7d1803f6bc8aa5dd4a480f921a7e9528da34df?theme=dark",
            "https://intelx.io/?s=telus.com",
            "https://lab.dynamite.ai/pcaps/319ab9c1-044c-4791-98b8-a134918cae63",
            "https://lab.dynamite.ai/pcaps/8c720f26-cf1b-4aed-bad5-da87f7f17977",
            "https://lab.dynamite.ai/pcaps/5beb5211-b3ce-4c11-8fa7-44eee039113a",
            "https://www.virustotal.com/graph/embed/ga408d14b97e346d788613eab3a11c80af28a15dda5334f9a93221e82d25545bb?theme=dark",
            "https://urlhaus.abuse.ch/feeds/asn/852/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [
            "Government",
            "Technology",
            "Telecommunications",
            "Education"
          ],
          "TLP": "green",
          "cloned_from": "662e72197adff2cced4acab5",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 283,
            "FileHash-SHA1": 283,
            "FileHash-SHA256": 366,
            "URL": 726,
            "domain": 564,
            "hostname": 523
          },
          "indicator_count": 2745,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "24 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f235b9a7a94a6a61acd651",
          "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
          "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
          "modified": "2025-03-07T08:38:08.584000",
          "created": "2024-09-24T03:44:57.902000",
          "tags": [
            "geoip",
            "public url",
            "as16509",
            "amazon02",
            "as20940",
            "akamaiasn1",
            "as8075",
            "as15169",
            "google",
            "akamaias",
            "facebook",
            "telecom",
            "twitter",
            "media",
            "win64",
            "level3",
            "mini",
            "ukraine",
            "proton",
            "ghost",
            "win32",
            "cuba",
            "mexico",
            "indonesia",
            "seznam",
            "as3359",
            "as852"
          ],
          "references": [
            "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
            "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
            "https://n0paste.eu/UH6n5pD/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Anguilla",
            "Poland",
            "Aruba",
            "Australia",
            "Barbados",
            "Costa Rica",
            "Guatemala",
            "Philippines",
            "Panama",
            "Sint Maarten (Dutch part)",
            "Saint Martin (French part)",
            "Cayman Islands",
            "Cura\u00e7ao",
            "Mexico",
            "Saint Vincent and the Grenadines",
            "Saint Kitts and Nevis",
            "Tanzania, United Republic of",
            "Netherlands",
            "Ukraine",
            "Trinidad and Tobago",
            "Japan",
            "Bahamas",
            "United Kingdom of Great Britain and Northern Ireland",
            "Georgia"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government",
            "Telecommunications",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1,
            "CIDR": 1186,
            "CVE": 4,
            "FileHash-MD5": 29,
            "FileHash-SHA1": 3,
            "URL": 25493,
            "domain": 5396,
            "email": 10,
            "hostname": 10770
          },
          "indicator_count": 42892,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 149,
          "modified_text": "451 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "662e72197adff2cced4acab5",
          "name": "Telus Communications (Canadian ISP)",
          "description": "IOCs associated with and/or collected from Telus Communications ISP\nAlso, please refer to other collections (Relevant Pulses in Group Pulse)",
          "modified": "2024-09-03T00:02:13.980000",
          "created": "2024-04-28T15:58:17.777000",
          "tags": [
            "Telus"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/graph",
            "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/iocs",
            "https://tria.ge/240428-tjsmrsbf4t",
            "https://www.virustotal.com/graph/embed/ga06a03c71a1848adb8e47517af7d1803f6bc8aa5dd4a480f921a7e9528da34df?theme=dark",
            "https://intelx.io/?s=telus.com",
            "https://lab.dynamite.ai/pcaps/319ab9c1-044c-4791-98b8-a134918cae63",
            "https://lab.dynamite.ai/pcaps/8c720f26-cf1b-4aed-bad5-da87f7f17977",
            "https://lab.dynamite.ai/pcaps/5beb5211-b3ce-4c11-8fa7-44eee039113a",
            "https://www.virustotal.com/graph/embed/ga408d14b97e346d788613eab3a11c80af28a15dda5334f9a93221e82d25545bb?theme=dark",
            "https://urlhaus.abuse.ch/feeds/asn/852/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [
            "Government",
            "Technology",
            "Telecommunications",
            "Education"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 283,
            "FileHash-SHA1": 283,
            "FileHash-SHA256": 366,
            "URL": 726,
            "domain": 564,
            "hostname": 523
          },
          "indicator_count": 2745,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 132,
          "modified_text": "636 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://urlhaus.abuse.ch/feeds/asn/852/",
        "https://tria.ge/240428-tjsmrsbf4t",
        "https://lab.dynamite.ai/pcaps/319ab9c1-044c-4791-98b8-a134918cae63",
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/graph",
        "https://lab.dynamite.ai/pcaps/8c720f26-cf1b-4aed-bad5-da87f7f17977",
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/iocs",
        "https://n0paste.eu/UH6n5pD/",
        "https://lab.dynamite.ai/pcaps/5beb5211-b3ce-4c11-8fa7-44eee039113a",
        "https://intelx.io/?s=telus.com",
        "https://www.virustotal.com/graph/embed/ga06a03c71a1848adb8e47517af7d1803f6bc8aa5dd4a480f921a7e9528da34df?theme=dark",
        "https://www.virustotal.com/graph/embed/ga408d14b97e346d788613eab3a11c80af28a15dda5334f9a93221e82d25545bb?theme=dark",
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69fd98fba834ab33f7cfe50f",
      "name": "Telus Communications (Canadian ISP) clone Disable_Duck - relevant Ip shadows",
      "description": "",
      "modified": "2026-05-08T08:04:11.769000",
      "created": "2026-05-08T08:04:11.769000",
      "tags": [
        "Telus"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/graph",
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/iocs",
        "https://tria.ge/240428-tjsmrsbf4t",
        "https://www.virustotal.com/graph/embed/ga06a03c71a1848adb8e47517af7d1803f6bc8aa5dd4a480f921a7e9528da34df?theme=dark",
        "https://intelx.io/?s=telus.com",
        "https://lab.dynamite.ai/pcaps/319ab9c1-044c-4791-98b8-a134918cae63",
        "https://lab.dynamite.ai/pcaps/8c720f26-cf1b-4aed-bad5-da87f7f17977",
        "https://lab.dynamite.ai/pcaps/5beb5211-b3ce-4c11-8fa7-44eee039113a",
        "https://www.virustotal.com/graph/embed/ga408d14b97e346d788613eab3a11c80af28a15dda5334f9a93221e82d25545bb?theme=dark",
        "https://urlhaus.abuse.ch/feeds/asn/852/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [
        "Government",
        "Technology",
        "Telecommunications",
        "Education"
      ],
      "TLP": "green",
      "cloned_from": "662e72197adff2cced4acab5",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 283,
        "FileHash-SHA1": 283,
        "FileHash-SHA256": 366,
        "URL": 726,
        "domain": 564,
        "hostname": 523
      },
      "indicator_count": 2745,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "24 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f235b9a7a94a6a61acd651",
      "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
      "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
      "modified": "2025-03-07T08:38:08.584000",
      "created": "2024-09-24T03:44:57.902000",
      "tags": [
        "geoip",
        "public url",
        "as16509",
        "amazon02",
        "as20940",
        "akamaiasn1",
        "as8075",
        "as15169",
        "google",
        "akamaias",
        "facebook",
        "telecom",
        "twitter",
        "media",
        "win64",
        "level3",
        "mini",
        "ukraine",
        "proton",
        "ghost",
        "win32",
        "cuba",
        "mexico",
        "indonesia",
        "seznam",
        "as3359",
        "as852"
      ],
      "references": [
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
        "https://n0paste.eu/UH6n5pD/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Anguilla",
        "Poland",
        "Aruba",
        "Australia",
        "Barbados",
        "Costa Rica",
        "Guatemala",
        "Philippines",
        "Panama",
        "Sint Maarten (Dutch part)",
        "Saint Martin (French part)",
        "Cayman Islands",
        "Cura\u00e7ao",
        "Mexico",
        "Saint Vincent and the Grenadines",
        "Saint Kitts and Nevis",
        "Tanzania, United Republic of",
        "Netherlands",
        "Ukraine",
        "Trinidad and Tobago",
        "Japan",
        "Bahamas",
        "United Kingdom of Great Britain and Northern Ireland",
        "Georgia"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government",
        "Telecommunications",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1,
        "CIDR": 1186,
        "CVE": 4,
        "FileHash-MD5": 29,
        "FileHash-SHA1": 3,
        "URL": 25493,
        "domain": 5396,
        "email": 10,
        "hostname": 10770
      },
      "indicator_count": 42892,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 149,
      "modified_text": "451 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "662e72197adff2cced4acab5",
      "name": "Telus Communications (Canadian ISP)",
      "description": "IOCs associated with and/or collected from Telus Communications ISP\nAlso, please refer to other collections (Relevant Pulses in Group Pulse)",
      "modified": "2024-09-03T00:02:13.980000",
      "created": "2024-04-28T15:58:17.777000",
      "tags": [
        "Telus"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/graph",
        "https://www.virustotal.com/gui/collection/9220d9375ebb4289fdbc4a7aac232b75a5c1b01e5e27edd965982bc6fe28f0e2/iocs",
        "https://tria.ge/240428-tjsmrsbf4t",
        "https://www.virustotal.com/graph/embed/ga06a03c71a1848adb8e47517af7d1803f6bc8aa5dd4a480f921a7e9528da34df?theme=dark",
        "https://intelx.io/?s=telus.com",
        "https://lab.dynamite.ai/pcaps/319ab9c1-044c-4791-98b8-a134918cae63",
        "https://lab.dynamite.ai/pcaps/8c720f26-cf1b-4aed-bad5-da87f7f17977",
        "https://lab.dynamite.ai/pcaps/5beb5211-b3ce-4c11-8fa7-44eee039113a",
        "https://www.virustotal.com/graph/embed/ga408d14b97e346d788613eab3a11c80af28a15dda5334f9a93221e82d25545bb?theme=dark",
        "https://urlhaus.abuse.ch/feeds/asn/852/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [
        "Government",
        "Technology",
        "Telecommunications",
        "Education"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 283,
        "FileHash-SHA1": 283,
        "FileHash-SHA256": 366,
        "URL": 726,
        "domain": 564,
        "hostname": 523
      },
      "indicator_count": 2745,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 132,
      "modified_text": "636 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "ajfnee.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "ajfnee.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780331916.9990923
}