{
  "type": "Domain",
  "indicator": "descriptionscripts.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/descriptionscripts.com",
    "alexa": "http://www.alexa.com/siteinfo/descriptionscripts.com",
    "indicator": "descriptionscripts.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3736814046,
      "indicator": "descriptionscripts.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "686d28ec9208b0424e0ccad2",
          "name": "Remote Keylogger | Foundry",
          "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
          "modified": "2025-09-19T03:02:22.742000",
          "created": "2025-07-08T14:19:24.211000",
          "tags": [
            "delete",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "delete c",
            "intel",
            "write",
            "malware",
            "dynamicloader",
            "yara rule",
            "high",
            "vmware",
            "phishing",
            "remote",
            "keylogger",
            "remote keylogger",
            "type indicator",
            "related pulses",
            "no expiration",
            "url https",
            "showing",
            "reputation",
            "foundry",
            "apple",
            "downloader",
            "trojan"
          ],
          "references": [
            "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
            "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
            "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
            "\u2022  199.59.243.226",
            "\u2022 ww25.vpn.steamcommunity-site.info",
            "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
            "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
            "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
            "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
            "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unruy",
              "display_name": "Unruy",
              "target": null
            },
            {
              "id": "Reputation.1",
              "display_name": "Reputation.1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1110.002",
              "name": "Password Cracking",
              "display_name": "T1110.002 - Password Cracking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1133",
              "name": "External Remote Services",
              "display_name": "T1133 - External Remote Services"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 260,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 4406,
            "URL": 9684,
            "domain": 3164,
            "hostname": 3370,
            "CVE": 1
          },
          "indicator_count": 21129,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "212 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d86e0d76778bf1bcb47e5d",
          "name": "AS140227 enriched",
          "description": "",
          "modified": "2025-06-07T15:40:37.476000",
          "created": "2024-09-04T14:26:21.356000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/g883116b41ba0417e98c7d99988fd2464797fb1fe54054692a35fe49c03255297"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 15,
            "FileHash-SHA1": 15,
            "FileHash-SHA256": 1331,
            "domain": 4165,
            "hostname": 3720,
            "URL": 11188,
            "CVE": 1
          },
          "indicator_count": 20435,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 181,
          "modified_text": "316 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "660bf7ffaf79e0c08f7ea2be",
          "name": "State of WordPress Security In 2024 \u2013\u00a0Patchstack",
          "description": "The State of WordPress Security in 2024 is published by the Open Source Security Foundation (OSF) and the Patchstack vulnerability database, which provides a comprehensive database of vulnerabilities in the WordPress ecosystem..",
          "modified": "2024-04-02T12:20:15.310000",
          "created": "2024-04-02T12:20:15.310000",
          "tags": [
            "snicco",
            "wordpress",
            "wordpress admin",
            "elementor",
            "sitecheck"
          ],
          "references": [
            "https://patchstack.com/whitepaper/state-of-wordpress-security-in-2024/#headline-904-17052"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Elementor",
              "display_name": "Elementor",
              "target": null
            },
            {
              "id": "SiteCheck",
              "display_name": "SiteCheck",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunter_NL",
            "id": "171283",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2,
            "domain": 6,
            "hostname": 6,
            "email": 2
          },
          "indicator_count": 16,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 845,
          "modified_text": "747 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6510a2dd9c7acab85a26f978",
          "name": "Phishing sites 2023-09-24",
          "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains",
          "modified": "2023-10-24T20:02:37.137000",
          "created": "2023-09-24T20:58:05.025000",
          "tags": [
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "France"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 10,
            "URL": 5,
            "domain": 37579,
            "hostname": 3238
          },
          "indicator_count": 40832,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 190,
          "modified_text": "908 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64d5b7d03bdda919a4d1fce4",
          "name": "New Hack Waves Targeting WordPress, Balada Injector",
          "description": "",
          "modified": "2023-09-10T04:02:25.707000",
          "created": "2023-08-11T04:23:44.365000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "cryptocti",
            "id": "110256",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9,
            "domain": 3,
            "hostname": 9
          },
          "indicator_count": 21,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 485,
          "modified_text": "952 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "https://patchstack.com/whitepaper/state-of-wordpress-security-in-2024/#headline-904-17052",
        "https://www.virustotal.com/graph/g883116b41ba0417e98c7d99988fd2464797fb1fe54054692a35fe49c03255297",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
        "\u2022  199.59.243.226"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Reputation.1",
            "Elementor",
            "Sitecheck",
            "Unruy"
          ],
          "industries": [
            "Media",
            "Technology",
            "Telecommunications"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "686d28ec9208b0424e0ccad2",
      "name": "Remote Keylogger | Foundry",
      "description": "Keylogger Remotely installed on all of targets devices. Up until\u2026 target had to purchase and return more than 50\ndevices minus service plans. Apple\nengineers have been involved many times. Mercenary attacks also confirmed: A kind phone store owner gave her a free phone that was hacked within seconds. \nUnless someone has been \u2018framing Palantir / Foundry Tech Mafia is portrayed a playing a  significant involvement of SA victim potentially since  day of coerced disclosure in 2013.\nThe first clue was a YouTube follower with a menacing name and picture began to follow, change login,  network, dumped adult content, utilized web content scrapers,. stole\nPasswords,etc., Anyway .. Unruy  & remotely installed keylogger. \n#foundry #apple #soc #keylogger \n\nThis is risky to say but very wrong to do. She was a multi generational (MGM) American.",
      "modified": "2025-09-19T03:02:22.742000",
      "created": "2025-07-08T14:19:24.211000",
      "tags": [
        "delete",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "delete c",
        "intel",
        "write",
        "malware",
        "dynamicloader",
        "yara rule",
        "high",
        "vmware",
        "phishing",
        "remote",
        "keylogger",
        "remote keylogger",
        "type indicator",
        "related pulses",
        "no expiration",
        "url https",
        "showing",
        "reputation",
        "foundry",
        "apple",
        "downloader",
        "trojan"
      ],
      "references": [
        "http://www.download-servers.com/SysInfo/Validate.exe||random.exe||/S||access your PC from anywhere!||Remote Access to your Home or Office PC remotely. Work on your PC from any internet computer or mobile. Access All files and transfer them between computers. Invite friends to view your LiveScreen and share presentations.||",
        "\u2022 engine.remote-keylogger.net \u2022 logout-superset2.remote-keylogger.net \u2022 mail.remote-keylogger.net",
        "\u2022 http://appleid.apple.com-cgi-bin-wets-myapleid.woa-wa-direct.yimucentral.com/apple/cgibin/confirm/processing/cmd=/95d9e0a26d38b5f248bb389e1a4d14c0/webobjects",
        "\u2022  199.59.243.226",
        "\u2022 ww25.vpn.steamcommunity-site.info",
        "\u2022 apple-mac.us \u2022 zpwi8.itunes-apple-jp.xyz \u2022 applefanatic.org \u2022 appleemailaccounts.com \u2022 http://appleemailaccounts.com/",
        "\u2022 zgcdfoundry.com \u2022 https://zgcdfoundry.com/",
        "\u2022 ww25.vpn.twitte5r.com | http://paypal-online.5flix.net/ | court-supreme.us",
        "\u2022 https://animal64u.com/bestiality-animal-porn/dog \u2022 \thttp://xxnxporntube.com",
        "\u2022 starbucksmobilepay.5flix.net | https://mobilemobster.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unruy",
          "display_name": "Unruy",
          "target": null
        },
        {
          "id": "Reputation.1",
          "display_name": "Reputation.1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1056.001",
          "name": "Keylogging",
          "display_name": "T1056.001 - Keylogging"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1110.002",
          "name": "Password Cracking",
          "display_name": "T1110.002 - Password Cracking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1133",
          "name": "External Remote Services",
          "display_name": "T1133 - External Remote Services"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 260,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 4406,
        "URL": 9684,
        "domain": 3164,
        "hostname": 3370,
        "CVE": 1
      },
      "indicator_count": 21129,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "212 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d86e0d76778bf1bcb47e5d",
      "name": "AS140227 enriched",
      "description": "",
      "modified": "2025-06-07T15:40:37.476000",
      "created": "2024-09-04T14:26:21.356000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/g883116b41ba0417e98c7d99988fd2464797fb1fe54054692a35fe49c03255297"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 15,
        "FileHash-SHA1": 15,
        "FileHash-SHA256": 1331,
        "domain": 4165,
        "hostname": 3720,
        "URL": 11188,
        "CVE": 1
      },
      "indicator_count": 20435,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 181,
      "modified_text": "316 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "660bf7ffaf79e0c08f7ea2be",
      "name": "State of WordPress Security In 2024 \u2013\u00a0Patchstack",
      "description": "The State of WordPress Security in 2024 is published by the Open Source Security Foundation (OSF) and the Patchstack vulnerability database, which provides a comprehensive database of vulnerabilities in the WordPress ecosystem..",
      "modified": "2024-04-02T12:20:15.310000",
      "created": "2024-04-02T12:20:15.310000",
      "tags": [
        "snicco",
        "wordpress",
        "wordpress admin",
        "elementor",
        "sitecheck"
      ],
      "references": [
        "https://patchstack.com/whitepaper/state-of-wordpress-security-in-2024/#headline-904-17052"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Elementor",
          "display_name": "Elementor",
          "target": null
        },
        {
          "id": "SiteCheck",
          "display_name": "SiteCheck",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunter_NL",
        "id": "171283",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_171283/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2,
        "domain": 6,
        "hostname": 6,
        "email": 2
      },
      "indicator_count": 16,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 845,
      "modified_text": "747 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6510a2dd9c7acab85a26f978",
      "name": "Phishing sites 2023-09-24",
      "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains",
      "modified": "2023-10-24T20:02:37.137000",
      "created": "2023-09-24T20:58:05.025000",
      "tags": [
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "France"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 10,
        "URL": 5,
        "domain": 37579,
        "hostname": 3238
      },
      "indicator_count": 40832,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 190,
      "modified_text": "908 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64d5b7d03bdda919a4d1fce4",
      "name": "New Hack Waves Targeting WordPress, Balada Injector",
      "description": "",
      "modified": "2023-09-10T04:02:25.707000",
      "created": "2023-08-11T04:23:44.365000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "cryptocti",
        "id": "110256",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_110256/resized/80/avatar_e237a4257c.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9,
        "domain": 3,
        "hostname": 9
      },
      "indicator_count": 21,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 485,
      "modified_text": "952 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "descriptionscripts.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "descriptionscripts.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776645789.9071853
}