{
  "type": "Domain",
  "indicator": "appdevtechnology.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/appdevtechnology.com",
    "alexa": "http://www.alexa.com/siteinfo/appdevtechnology.com",
    "indicator": "appdevtechnology.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3624285898,
      "indicator": "appdevtechnology.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 24,
      "pulses": [
        {
          "id": "628dff37032808c7c9e014dc",
          "name": "Sauron - Malware Domain Feed V2",
          "description": "Command and Control domains for Sauron. These domains are extracted from a number of sources, and are suspicious.",
          "modified": "2026-06-01T10:42:10.680000",
          "created": "2022-05-25T10:04:39.623000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 160873,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "otxrobottwo",
            "id": "78495",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 49125,
            "domain": 83978
          },
          "indicator_count": 133103,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1576,
          "modified_text": "22 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68427c0a165a609d28ed52b0",
          "name": "cobalt",
          "description": "",
          "modified": "2026-02-03T02:41:03.267000",
          "created": "2025-06-06T05:26:34.964000",
          "tags": [],
          "references": [
            "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2,
            "domain": 598,
            "email": 1,
            "hostname": 215
          },
          "indicator_count": 816,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 184,
          "modified_text": "119 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "691b8869e00b107fa20d9482",
          "name": "ThreatFix",
          "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
          "modified": "2026-01-23T11:01:07.175000",
          "created": "2025-11-17T20:41:11.797000",
          "tags": [
            "",
            "ransomware",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "",
              "display_name": "",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "zlepos384",
            "id": "103244",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 8010,
            "FileHash-SHA1": 7922,
            "FileHash-SHA256": 8893,
            "URL": 57004,
            "domain": 36018,
            "hostname": 96473
          },
          "indicator_count": 214320,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 44,
          "modified_text": "129 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "676eecd99a3f9ed2923aa4c1",
          "name": "CobaltStrike C2",
          "description": "",
          "modified": "2025-01-26T18:03:37.147000",
          "created": "2024-12-27T18:07:21.839000",
          "tags": [],
          "references": [
            "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2,
            "domain": 596,
            "email": 1,
            "hostname": 173
          },
          "indicator_count": 772,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 189,
          "modified_text": "491 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d8c227297b4ee9c73fd788",
          "name": "[ADMIN] AlienVault Federation",
          "description": "",
          "modified": "2024-02-23T16:04:55.751000",
          "created": "2024-02-23T16:04:55.751000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "628dff37032808c7c9e014dc",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Enqrypted",
            "id": "272105",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 46692,
            "domain": 77419
          },
          "indicator_count": 124111,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 72,
          "modified_text": "829 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d8c2278fc7d3a32db22cda",
          "name": "[ADMIN] AlienVault Federation",
          "description": "",
          "modified": "2024-02-23T16:04:55.687000",
          "created": "2024-02-23T16:04:55.687000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "628dff37032808c7c9e014dc",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Enqrypted",
            "id": "272105",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 46692,
            "domain": 77419
          },
          "indicator_count": 124111,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 62,
          "modified_text": "829 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d8c22181dedbe91a1010aa",
          "name": "[ADMIN] AlienVault Federation",
          "description": "",
          "modified": "2024-02-23T16:04:49.646000",
          "created": "2024-02-23T16:04:49.646000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "628dff37032808c7c9e014dc",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Enqrypted",
            "id": "272105",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 46692,
            "domain": 77419
          },
          "indicator_count": 124111,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 62,
          "modified_text": "829 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "657096ebb2fc1f8ac75901ab",
          "name": "InQuest - 11-02-2023",
          "description": "",
          "modified": "2023-12-06T15:44:43.150000",
          "created": "2023-12-06T15:44:43.150000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 384,
            "hostname": 215,
            "domain": 848,
            "URL": 1347,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 3
          },
          "indicator_count": 2811,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64c3a09af58f85f39cb9fdd0",
          "name": "Threatview.io C2 Hunt Feed",
          "description": "Infrastructure hosting Command & Control Servers found during Proactive Hunt by Threatview.io",
          "modified": "2023-08-27T11:04:21.859000",
          "created": "2023-07-28T11:03:54.265000",
          "tags": [
            "hunter",
            "pm utc",
            "am utc",
            "september",
            "august",
            "february",
            "january",
            "june",
            "april",
            "october",
            "media",
            "date",
            "comment"
          ],
          "references": [
            "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "hitman",
            "id": "195",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/hitman/resized/80/MtDewBot.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1,
            "domain": 543,
            "hostname": 120
          },
          "indicator_count": 664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 186,
          "modified_text": "1009 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "640f10dc46136baabbef5f74",
          "name": "Cobalt Strike C2 | 03/06/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 03/06/2023.",
          "modified": "2023-04-12T00:01:36.873000",
          "created": "2023-03-13T12:02:36.653000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "1147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "640f10d20e92995ab6bf9ca9",
          "name": "Cobalt Strike Servers & C2 | 03/06/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 03/06/2023.",
          "modified": "2023-04-12T00:01:36.873000",
          "created": "2023-03-13T12:02:26.363000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "1147 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "6405d677a5b545c271b3f34a",
          "name": "Cobalt Strike Servers & C2 | 02/27/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 02/27/2023.",
          "modified": "2023-04-05T00:03:03.287000",
          "created": "2023-03-06T12:02:57.913000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "1154 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "6405d688d1ca2f14a821da3b",
          "name": "Cobalt Strike C2 | 02/27/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 02/27/2023.",
          "modified": "2023-04-05T00:03:03.287000",
          "created": "2023-03-06T12:03:20.759000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "1154 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "63fc9c26ea7b3b42cc69bca2",
          "name": "Cobalt Strike C2 | 02/20/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 02/20/2023.",
          "modified": "2023-03-29T00:03:42.396000",
          "created": "2023-02-27T12:03:49.599000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "1161 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "63fc9c23800ddc03e10e24ad",
          "name": "Cobalt Strike Servers & C2 | 02/20/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 02/20/2023.",
          "modified": "2023-03-29T00:03:42.396000",
          "created": "2023-02-27T12:03:47.121000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "1161 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "63e83047a336bb945cf51ff1",
          "name": "InQuest - 11-02-2023",
          "description": "",
          "modified": "2023-03-23T09:38:35.312000",
          "created": "2023-02-12T00:18:15.765000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 14,
            "domain": 848,
            "URL": 1347,
            "hostname": 215,
            "FileHash-SHA256": 384,
            "FileHash-SHA1": 3
          },
          "indicator_count": 2811,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "1166 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63e9803c53ad89914b925e39",
          "name": "InQuest - 12-02-2023",
          "description": "",
          "modified": "2023-03-23T09:38:24.364000",
          "created": "2023-02-13T00:11:40.973000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 899,
            "URL": 1523,
            "FileHash-SHA256": 102,
            "FileHash-MD5": 16,
            "hostname": 221,
            "FileHash-SHA1": 9
          },
          "indicator_count": 2770,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1625,
          "modified_text": "1166 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63f3627987f6357cf96916db",
          "name": "Cobalt Strike C2 | 02/13/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 02/13/2023.",
          "modified": "2023-03-22T00:05:18.598000",
          "created": "2023-02-20T12:07:21.688000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "1168 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "63f3627812c4277491a14318",
          "name": "Cobalt Strike Servers | 02/13/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These servers were scanned the week of 02/13/2023.",
          "modified": "2023-03-22T00:05:18.598000",
          "created": "2023-02-20T12:07:20.644000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "1168 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "63f36277e9e75c8da78c0b72",
          "name": "Cobalt Strike Servers & C2 | 02/13/2023",
          "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. These indicators are hosting Cobalt Strike payloads and are the C2 according to their configs. These servers were scanned the week of 02/13/2023.",
          "modified": "2023-03-22T00:05:18.598000",
          "created": "2023-02-20T12:07:18.232000",
          "tags": [
            "Cobalt Strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IronNetTR",
            "id": "135317",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {},
          "indicator_count": 0,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "1168 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 0
        },
        {
          "id": "63dc4ea5edaf87cb0506c16a",
          "name": "Twitter Feed - drb_ra - 02-02-2023",
          "description": "",
          "modified": "2023-03-05T00:00:28.462000",
          "created": "2023-02-03T00:00:37.849000",
          "tags": [
            "CobaltStrike"
          ],
          "references": [
            "https://twitter.com/drb_ra/status/1620964806772637698",
            "https://twitter.com/drb_ra/status/1620964849957101571",
            "https://twitter.com/drb_ra/status/1620964864632971264",
            "https://twitter.com/drb_ra/status/1620964948523319298",
            "https://twitter.com/drb_ra/status/1620965086121656322",
            "https://twitter.com/drb_ra/status/1620965270213869570",
            "https://twitter.com/drb_ra/status/1620965322823028736",
            "https://twitter.com/drb_ra/status/1620965383896178692",
            "https://twitter.com/drb_ra/status/1620965445929943040",
            "https://twitter.com/drb_ra/status/1620965484572147712",
            "https://twitter.com/drb_ra/status/1620965692190199808",
            "https://twitter.com/drb_ra/status/1620965724498935810",
            "https://twitter.com/drb_ra/status/1620965994553376769",
            "https://twitter.com/drb_ra/status/1621150247178346499",
            "https://twitter.com/drb_ra/status/1621150620857278464",
            "https://twitter.com/drb_ra/status/1621150926412320773",
            "https://twitter.com/drb_ra/status/1621150975422758917",
            "https://twitter.com/drb_ra/status/1621151884689154048",
            "https://twitter.com/drb_ra/status/1621231789283893257",
            "https://twitter.com/drb_ra/status/1621231870275887106",
            "https://twitter.com/drb_ra/status/1621231944104124417",
            "https://twitter.com/drb_ra/status/1621231974282153989",
            "https://twitter.com/drb_ra/status/1621232007119241216",
            "https://twitter.com/drb_ra/status/1621232075398434816",
            "https://twitter.com/drb_ra/status/1621232263710085122",
            "https://twitter.com/drb_ra/status/1621232350557257728",
            "https://twitter.com/drb_ra/status/1621232450776055812",
            "https://twitter.com/drb_ra/status/1621232521210896386",
            "https://twitter.com/drb_ra/status/1621232637904920578",
            "https://twitter.com/drb_ra/status/1621232817341435906",
            "https://twitter.com/drb_ra/status/1621233038431502336",
            "https://twitter.com/drb_ra/status/1621233126033719301",
            "https://twitter.com/drb_ra/status/1621233156287352832",
            "https://twitter.com/drb_ra/status/1621261650371268610"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 9,
            "hostname": 8
          },
          "indicator_count": 17,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "1185 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63daffa5321fd87a4d2b82c7",
          "name": "Twitter Feed - drb_ra - 01-02-2023",
          "description": "",
          "modified": "2023-03-04T00:03:25.234000",
          "created": "2023-02-02T00:11:17.264000",
          "tags": [
            "CobaltStrike"
          ],
          "references": [
            "https://twitter.com/drb_ra/status/1620607685681975299",
            "https://twitter.com/drb_ra/status/1620607788844998656",
            "https://twitter.com/drb_ra/status/1620607819694149633",
            "https://twitter.com/drb_ra/status/1620608191099801602",
            "https://twitter.com/drb_ra/status/1620608243943735296",
            "https://twitter.com/drb_ra/status/1620608420515663873",
            "https://twitter.com/drb_ra/status/1620608625214459904",
            "https://twitter.com/drb_ra/status/1620744651421384704",
            "https://twitter.com/drb_ra/status/1620786989262934017",
            "https://twitter.com/drb_ra/status/1620787903742808064",
            "https://twitter.com/drb_ra/status/1620787972818837505",
            "https://twitter.com/drb_ra/status/1620788029433561095",
            "https://twitter.com/drb_ra/status/1620788184643682305",
            "https://twitter.com/drb_ra/status/1620788389740937225",
            "https://twitter.com/drb_ra/status/1620789146405969921",
            "https://twitter.com/drb_ra/status/1620789400245338112",
            "https://twitter.com/drb_ra/status/1620789439571034117",
            "https://twitter.com/drb_ra/status/1620789710074306562",
            "https://twitter.com/drb_ra/status/1620790295599136771",
            "https://twitter.com/drb_ra/status/1620790385344741384",
            "https://twitter.com/drb_ra/status/1620790451287498755",
            "https://twitter.com/drb_ra/status/1620790514244063235",
            "https://twitter.com/drb_ra/status/1620869534855880704",
            "https://twitter.com/drb_ra/status/1620870171240894487"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 5,
            "domain": 6
          },
          "indicator_count": 11,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "1186 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63df6409d6fa5666f3940d4b",
          "name": "sauron",
          "description": "",
          "modified": "2023-02-05T08:08:41.941000",
          "created": "2023-02-05T08:08:41.941000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "628dff37032808c7c9e014dc",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "gooseismad",
            "id": "224328",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 42121,
            "domain": 63445
          },
          "indicator_count": 105566,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 15,
          "modified_text": "1213 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63df64009daa232c0e0dd4a6",
          "name": "sauron",
          "description": "",
          "modified": "2023-02-05T08:08:32.380000",
          "created": "2023-02-05T08:08:32.380000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "628dff37032808c7c9e014dc",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "gooseismad",
            "id": "224328",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 42121,
            "domain": 63445
          },
          "indicator_count": 105566,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 14,
          "modified_text": "1213 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://twitter.com/drb_ra/status/1621232075398434816",
        "https://twitter.com/drb_ra/status/1620790295599136771",
        "https://twitter.com/drb_ra/status/1621232817341435906",
        "https://twitter.com/drb_ra/status/1621151884689154048",
        "https://twitter.com/drb_ra/status/1621232007119241216",
        "https://labs.inquest.net/iocdb",
        "https://twitter.com/drb_ra/status/1621232263710085122",
        "https://twitter.com/drb_ra/status/1620786989262934017",
        "https://twitter.com/drb_ra/status/1620789146405969921",
        "https://twitter.com/drb_ra/status/1621233156287352832",
        "https://twitter.com/drb_ra/status/1620607685681975299",
        "https://twitter.com/drb_ra/status/1620608625214459904",
        "https://twitter.com/drb_ra/status/1620790385344741384",
        "https://twitter.com/drb_ra/status/1620965692190199808",
        "https://twitter.com/drb_ra/status/1620788029433561095",
        "https://twitter.com/drb_ra/status/1620870171240894487",
        "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt",
        "https://twitter.com/drb_ra/status/1620965994553376769",
        "https://twitter.com/drb_ra/status/1620964864632971264",
        "https://twitter.com/drb_ra/status/1621232637904920578",
        "https://twitter.com/drb_ra/status/1621233038431502336",
        "https://twitter.com/drb_ra/status/1620964849957101571",
        "https://twitter.com/drb_ra/status/1621232450776055812",
        "https://twitter.com/drb_ra/status/1620965484572147712",
        "https://twitter.com/drb_ra/status/1621233126033719301",
        "https://twitter.com/drb_ra/status/1620744651421384704",
        "https://twitter.com/drb_ra/status/1620788389740937225",
        "https://twitter.com/drb_ra/status/1620787903742808064",
        "https://twitter.com/drb_ra/status/1620789710074306562",
        "https://twitter.com/drb_ra/status/1620965086121656322",
        "https://twitter.com/drb_ra/status/1620965724498935810",
        "https://twitter.com/drb_ra/status/1621231974282153989",
        "https://twitter.com/drb_ra/status/1620965322823028736",
        "https://twitter.com/drb_ra/status/1621150247178346499",
        "https://twitter.com/drb_ra/status/1620965270213869570",
        "https://twitter.com/drb_ra/status/1620788184643682305",
        "https://twitter.com/drb_ra/status/1621232350557257728",
        "https://twitter.com/drb_ra/status/1620869534855880704",
        "https://twitter.com/drb_ra/status/1620965445929943040",
        "https://twitter.com/drb_ra/status/1621150975422758917",
        "https://twitter.com/drb_ra/status/1620607788844998656",
        "https://twitter.com/drb_ra/status/1620964806772637698",
        "https://twitter.com/drb_ra/status/1620608191099801602",
        "https://twitter.com/drb_ra/status/1620608243943735296",
        "https://twitter.com/drb_ra/status/1620789439571034117",
        "https://twitter.com/drb_ra/status/1620790514244063235",
        "https://twitter.com/drb_ra/status/1620787972818837505",
        "https://twitter.com/drb_ra/status/1621261650371268610",
        "https://twitter.com/drb_ra/status/1620964948523319298",
        "https://twitter.com/drb_ra/status/1620790451287498755",
        "https://twitter.com/drb_ra/status/1620965383896178692",
        "https://twitter.com/drb_ra/status/1621231870275887106",
        "https://twitter.com/drb_ra/status/1620607819694149633",
        "https://twitter.com/drb_ra/status/1621231789283893257",
        "https://twitter.com/drb_ra/status/1621150620857278464",
        "https://twitter.com/drb_ra/status/1620608420515663873",
        "https://twitter.com/drb_ra/status/1621150926412320773",
        "https://twitter.com/drb_ra/status/1621232521210896386",
        "https://twitter.com/drb_ra/status/1621231944104124417",
        "https://twitter.com/drb_ra/status/1620789400245338112"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "",
            "Cobalt strike - s0154"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 24,
  "pulses": [
    {
      "id": "628dff37032808c7c9e014dc",
      "name": "Sauron - Malware Domain Feed V2",
      "description": "Command and Control domains for Sauron. These domains are extracted from a number of sources, and are suspicious.",
      "modified": "2026-06-01T10:42:10.680000",
      "created": "2022-05-25T10:04:39.623000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 160873,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "otxrobottwo",
        "id": "78495",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_78495/resized/80/avatar_ba5a8acdbd.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 49125,
        "domain": 83978
      },
      "indicator_count": 133103,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1576,
      "modified_text": "22 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68427c0a165a609d28ed52b0",
      "name": "cobalt",
      "description": "",
      "modified": "2026-02-03T02:41:03.267000",
      "created": "2025-06-06T05:26:34.964000",
      "tags": [],
      "references": [
        "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2,
        "domain": 598,
        "email": 1,
        "hostname": 215
      },
      "indicator_count": 816,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 184,
      "modified_text": "119 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "691b8869e00b107fa20d9482",
      "name": "ThreatFix",
      "description": "ThreatFix is an effort to publish various details about ransomware variants and ransomware threat actors. ThreatFix advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware.",
      "modified": "2026-01-23T11:01:07.175000",
      "created": "2025-11-17T20:41:11.797000",
      "tags": [
        "",
        "ransomware",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "",
          "display_name": "",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "zlepos384",
        "id": "103244",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 8010,
        "FileHash-SHA1": 7922,
        "FileHash-SHA256": 8893,
        "URL": 57004,
        "domain": 36018,
        "hostname": 96473
      },
      "indicator_count": 214320,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 44,
      "modified_text": "129 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "676eecd99a3f9ed2923aa4c1",
      "name": "CobaltStrike C2",
      "description": "",
      "modified": "2025-01-26T18:03:37.147000",
      "created": "2024-12-27T18:07:21.839000",
      "tags": [],
      "references": [
        "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2,
        "domain": 596,
        "email": 1,
        "hostname": 173
      },
      "indicator_count": 772,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 189,
      "modified_text": "491 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d8c227297b4ee9c73fd788",
      "name": "[ADMIN] AlienVault Federation",
      "description": "",
      "modified": "2024-02-23T16:04:55.751000",
      "created": "2024-02-23T16:04:55.751000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "628dff37032808c7c9e014dc",
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Enqrypted",
        "id": "272105",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 46692,
        "domain": 77419
      },
      "indicator_count": 124111,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 72,
      "modified_text": "829 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d8c2278fc7d3a32db22cda",
      "name": "[ADMIN] AlienVault Federation",
      "description": "",
      "modified": "2024-02-23T16:04:55.687000",
      "created": "2024-02-23T16:04:55.687000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "628dff37032808c7c9e014dc",
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Enqrypted",
        "id": "272105",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 46692,
        "domain": 77419
      },
      "indicator_count": 124111,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 62,
      "modified_text": "829 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d8c22181dedbe91a1010aa",
      "name": "[ADMIN] AlienVault Federation",
      "description": "",
      "modified": "2024-02-23T16:04:49.646000",
      "created": "2024-02-23T16:04:49.646000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "628dff37032808c7c9e014dc",
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Enqrypted",
        "id": "272105",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_272105/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 46692,
        "domain": 77419
      },
      "indicator_count": 124111,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 62,
      "modified_text": "829 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "657096ebb2fc1f8ac75901ab",
      "name": "InQuest - 11-02-2023",
      "description": "",
      "modified": "2023-12-06T15:44:43.150000",
      "created": "2023-12-06T15:44:43.150000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 384,
        "hostname": 215,
        "domain": 848,
        "URL": 1347,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 3
      },
      "indicator_count": 2811,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64c3a09af58f85f39cb9fdd0",
      "name": "Threatview.io C2 Hunt Feed",
      "description": "Infrastructure hosting Command & Control Servers found during Proactive Hunt by Threatview.io",
      "modified": "2023-08-27T11:04:21.859000",
      "created": "2023-07-28T11:03:54.265000",
      "tags": [
        "hunter",
        "pm utc",
        "am utc",
        "september",
        "august",
        "february",
        "january",
        "june",
        "april",
        "october",
        "media",
        "date",
        "comment"
      ],
      "references": [
        "https://threatview.io/Downloads/High-Confidence-CobaltStrike-C2%20-Feeds.txt"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "hitman",
        "id": "195",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/hitman/resized/80/MtDewBot.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1,
        "domain": 543,
        "hostname": 120
      },
      "indicator_count": 664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 186,
      "modified_text": "1009 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "640f10dc46136baabbef5f74",
      "name": "Cobalt Strike C2 | 03/06/2023",
      "description": "IronNet Threat Analysts scan the web searching for hosts that are serving Cobalt Strike beacons. We then pull them down and extract the beacon config for analysis. The IPs and domains in this pulse are the C2 hosts extracted from those configs. These servers were scanned the week of 03/06/2023.",
      "modified": "2023-04-12T00:01:36.873000",
      "created": "2023-03-13T12:02:36.653000",
      "tags": [
        "Cobalt Strike"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Cobalt Strike - S0154",
          "display_name": "Cobalt Strike - S0154",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IronNetTR",
        "id": "135317",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_135317/resized/80/avatar_3be4d4773d.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {},
      "indicator_count": 0,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "1147 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 0
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "appdevtechnology.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "appdevtechnology.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780391363.8370214
}