{
  "type": "Domain",
  "indicator": "downlevel.mobile",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/downlevel.mobile",
    "alexa": "http://www.alexa.com/siteinfo/downlevel.mobile",
    "indicator": "downlevel.mobile",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2678424897,
      "indicator": "downlevel.mobile",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "692f04e9fa3d782118e94aac",
          "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
          "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
          "modified": "2026-01-01T15:04:20.907000",
          "created": "2025-12-02T15:25:29.158000",
          "tags": [
            "levelblue",
            "open threat",
            "dynamicloader",
            "tlsv1",
            "high",
            "msie",
            "windows nt",
            "delete c",
            "fwlink",
            "stream",
            "powershell",
            "write",
            "malware",
            "local",
            "united",
            "flag",
            "date",
            "server",
            "crazy egg",
            "name server",
            "gmt flag",
            "domain address",
            "markmonitor",
            "enom",
            "sugges",
            "onv incude",
            "data upload",
            "find s",
            "extraction",
            "types",
            "type",
            "indicator",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "contacted hosts",
            "search",
            "entries",
            "read c",
            "medium",
            "memcommit",
            "tls handshake",
            "failure",
            "module load",
            "next",
            "execution",
            "dock",
            "capture",
            "persistence",
            "copy",
            "unknown",
            "suricata alert",
            "et info",
            "bad traffic",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "t1480 execution",
            "file defense",
            "write c",
            "x02x82",
            "xe6x15c6",
            "x16f",
            "xc0xc0xc0",
            "revengerat",
            "guard",
            "service",
            "encrypt",
            "entries yara",
            "delphi",
            "win32",
            "jordan",
            "delete app"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
            "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
            "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
            "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Vmprotect-9880726-0",
              "display_name": "Win.Malware.Vmprotect-9880726-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4624,
            "FileHash-SHA256": 2021,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 20,
            "SSLCertFingerprint": 10,
            "hostname": 1433,
            "domain": 728
          },
          "indicator_count": 8887,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6893032410060f658d862c60",
          "name": "Hosting App - Partial research | Emotet Worm",
          "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:24:20.645000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68930449988277cd29c25cb7",
          "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
          "description": "",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:29:13.136000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6893032410060f658d862c60",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "226 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68732864356c4353e0b1efe2",
          "name": "Denver Post - Custom Malware | Xord",
          "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
          "modified": "2025-08-12T03:05:26.037000",
          "created": "2025-07-13T03:30:44.589000",
          "tags": [
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "entries",
            "url http",
            "domain",
            "ipv4",
            "filehashsha256",
            "hostname",
            "types of",
            "united kingdom",
            "united",
            "germany",
            "france",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "extraction",
            "data upload",
            "failed",
            "se extraction",
            "enter sc",
            "type",
            "extra data",
            "please",
            "include review",
            "exclude sugges",
            "type ol",
            "please sub",
            "langes",
            "include",
            "review data",
            "extrad",
            "manually add",
            "indicator",
            "sc type",
            "included iocs",
            "se extr",
            "review exclude",
            "sugges",
            "extract data",
            "add indicator",
            "domain related",
            "showing",
            "tewdida data",
            "present jul",
            "script urls",
            "a domains",
            "present jun",
            "search",
            "accept encoding",
            "unknown aaaa",
            "present may",
            "date",
            "meta",
            "body",
            "ipv6",
            "role",
            "present jan",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "regexp",
            "typeof e",
            "typeof t",
            "function",
            "width",
            "error",
            "object",
            "x20trnf",
            "pseudo",
            "child",
            "form",
            "class",
            "null",
            "write",
            "this",
            "void",
            "accept",
            "copy",
            "extr please",
            "typ data",
            "indicalok no",
            "gmt max",
            "reverse dns",
            "location united",
            "america flag",
            "ashburn",
            "america asn",
            "dns resolutions",
            "domains top",
            "extri please",
            "review",
            "sugges data",
            "find suxesteu",
            "typ indical",
            "on hos",
            "dynamicloader",
            "medium",
            "show",
            "high",
            "windows",
            "cmd c",
            "delete",
            "next",
            "unknown",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "as15169",
            "execution",
            "dock",
            "persistence",
            "malware",
            "roboto",
            "fwlink",
            "powershell",
            "delete c",
            "guard",
            "win32",
            "passive dns",
            "ransom",
            "trojan",
            "gmt cache",
            "sameorigin",
            "443 ma2592000",
            "pulse",
            "trojandropper",
            "worm",
            "ur extraction",
            "find",
            "types",
            "seard data",
            "source se",
            "url toi",
            "ela fer",
            "iocs",
            "search otx",
            "extr",
            "indicators h",
            "weall",
            "indica",
            "sc data",
            "data u",
            "extre",
            "find s",
            "onv incmde",
            "exclude data",
            "suggested",
            "typ no"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3107,
            "domain": 526,
            "hostname": 940,
            "FileHash-SHA256": 2209,
            "email": 2,
            "FileHash-MD5": 80,
            "FileHash-SHA1": 31,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 6906,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68732869bad70de69c45c1b3",
          "name": "Denver Post - Custom Malware | Xord",
          "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
          "modified": "2025-08-12T03:05:26.037000",
          "created": "2025-07-13T03:30:49.347000",
          "tags": [
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "entries",
            "url http",
            "domain",
            "ipv4",
            "filehashsha256",
            "hostname",
            "types of",
            "united kingdom",
            "united",
            "germany",
            "france",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "extraction",
            "data upload",
            "failed",
            "se extraction",
            "enter sc",
            "type",
            "extra data",
            "please",
            "include review",
            "exclude sugges",
            "type ol",
            "please sub",
            "langes",
            "include",
            "review data",
            "extrad",
            "manually add",
            "indicator",
            "sc type",
            "included iocs",
            "se extr",
            "review exclude",
            "sugges",
            "extract data",
            "add indicator",
            "domain related",
            "showing",
            "tewdida data",
            "present jul",
            "script urls",
            "a domains",
            "present jun",
            "search",
            "accept encoding",
            "unknown aaaa",
            "present may",
            "date",
            "meta",
            "body",
            "ipv6",
            "role",
            "present jan",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "regexp",
            "typeof e",
            "typeof t",
            "function",
            "width",
            "error",
            "object",
            "x20trnf",
            "pseudo",
            "child",
            "form",
            "class",
            "null",
            "write",
            "this",
            "void",
            "accept",
            "copy",
            "extr please",
            "typ data",
            "indicalok no",
            "gmt max",
            "reverse dns",
            "location united",
            "america flag",
            "ashburn",
            "america asn",
            "dns resolutions",
            "domains top",
            "extri please",
            "review",
            "sugges data",
            "find suxesteu",
            "typ indical",
            "on hos",
            "dynamicloader",
            "medium",
            "show",
            "high",
            "windows",
            "cmd c",
            "delete",
            "next",
            "unknown",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "read c",
            "as15169",
            "execution",
            "dock",
            "persistence",
            "malware",
            "roboto",
            "fwlink",
            "powershell",
            "delete c",
            "guard",
            "win32",
            "passive dns",
            "ransom",
            "trojan",
            "gmt cache",
            "sameorigin",
            "443 ma2592000",
            "pulse",
            "trojandropper",
            "worm",
            "ur extraction",
            "find",
            "types",
            "seard data",
            "source se",
            "url toi",
            "ela fer",
            "iocs",
            "search otx",
            "extr",
            "indicators h",
            "weall",
            "indica",
            "sc data",
            "data u",
            "extre",
            "find s",
            "onv incmde",
            "exclude data",
            "suggested",
            "typ no"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3107,
            "domain": 526,
            "hostname": 940,
            "FileHash-SHA256": 2209,
            "email": 2,
            "FileHash-MD5": 80,
            "FileHash-SHA1": 31,
            "SSLCertFingerprint": 11
          },
          "indicator_count": 6906,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "250 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f235b9a7a94a6a61acd651",
          "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
          "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
          "modified": "2025-03-07T08:38:08.584000",
          "created": "2024-09-24T03:44:57.902000",
          "tags": [
            "geoip",
            "public url",
            "as16509",
            "amazon02",
            "as20940",
            "akamaiasn1",
            "as8075",
            "as15169",
            "google",
            "akamaias",
            "facebook",
            "telecom",
            "twitter",
            "media",
            "win64",
            "level3",
            "mini",
            "ukraine",
            "proton",
            "ghost",
            "win32",
            "cuba",
            "mexico",
            "indonesia",
            "seznam",
            "as3359",
            "as852"
          ],
          "references": [
            "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
            "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
            "https://n0paste.eu/UH6n5pD/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Anguilla",
            "Poland",
            "Aruba",
            "Australia",
            "Barbados",
            "Costa Rica",
            "Guatemala",
            "Philippines",
            "Panama",
            "Sint Maarten (Dutch part)",
            "Saint Martin (French part)",
            "Cayman Islands",
            "Cura\u00e7ao",
            "Mexico",
            "Saint Vincent and the Grenadines",
            "Saint Kitts and Nevis",
            "Tanzania, United Republic of",
            "Netherlands",
            "Ukraine",
            "Trinidad and Tobago",
            "Japan",
            "Bahamas",
            "United Kingdom of Great Britain and Northern Ireland",
            "Georgia"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government",
            "Telecommunications",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1,
            "CIDR": 1186,
            "CVE": 4,
            "FileHash-MD5": 29,
            "FileHash-SHA1": 3,
            "URL": 25493,
            "domain": 5396,
            "email": 10,
            "hostname": 10770
          },
          "indicator_count": 42892,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 147,
          "modified_text": "408 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://n0paste.eu/UH6n5pD/",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Other malware",
            "Win.malware.vmprotect-9880726-0"
          ],
          "industries": [
            "Telecommunications",
            "Healthcare",
            "Education",
            "Government",
            "Legal",
            "Technology"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "692f04e9fa3d782118e94aac",
      "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
      "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
      "modified": "2026-01-01T15:04:20.907000",
      "created": "2025-12-02T15:25:29.158000",
      "tags": [
        "levelblue",
        "open threat",
        "dynamicloader",
        "tlsv1",
        "high",
        "msie",
        "windows nt",
        "delete c",
        "fwlink",
        "stream",
        "powershell",
        "write",
        "malware",
        "local",
        "united",
        "flag",
        "date",
        "server",
        "crazy egg",
        "name server",
        "gmt flag",
        "domain address",
        "markmonitor",
        "enom",
        "sugges",
        "onv incude",
        "data upload",
        "find s",
        "extraction",
        "types",
        "type",
        "indicator",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "contacted hosts",
        "search",
        "entries",
        "read c",
        "medium",
        "memcommit",
        "tls handshake",
        "failure",
        "module load",
        "next",
        "execution",
        "dock",
        "capture",
        "persistence",
        "copy",
        "unknown",
        "suricata alert",
        "et info",
        "bad traffic",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "t1480 execution",
        "file defense",
        "write c",
        "x02x82",
        "xe6x15c6",
        "x16f",
        "xc0xc0xc0",
        "revengerat",
        "guard",
        "service",
        "encrypt",
        "entries yara",
        "delphi",
        "win32",
        "jordan",
        "delete app"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Vmprotect-9880726-0",
          "display_name": "Win.Malware.Vmprotect-9880726-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [
        "Technology",
        "Legal"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4624,
        "FileHash-SHA256": 2021,
        "FileHash-MD5": 51,
        "FileHash-SHA1": 20,
        "SSLCertFingerprint": 10,
        "hostname": 1433,
        "domain": 728
      },
      "indicator_count": 8887,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6893032410060f658d862c60",
      "name": "Hosting App - Partial research | Emotet Worm",
      "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
      "modified": "2025-09-05T07:00:00.711000",
      "created": "2025-08-06T07:24:20.645000",
      "tags": [
        "url https",
        "iocs",
        "learn more",
        "ipv4",
        "domain",
        "hostname",
        "types of",
        "sweden",
        "united",
        "belgium",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "showing",
        "document file",
        "v2 document",
        "search",
        "medium",
        "ms windows",
        "vista event",
        "port",
        "msie",
        "windows nt",
        "wow64",
        "dirty",
        "write",
        "powershell",
        "copy",
        "next",
        "defender",
        "dynamicloader",
        "high",
        "fwlink",
        "windows",
        "cmd c",
        "alerts",
        "bios",
        "related pulses",
        "pulses",
        "related tags",
        "file type",
        "ascii text",
        "sha256",
        "external",
        "virustotal api",
        "screenshots",
        "june",
        "flag",
        "usa windows",
        "input threat",
        "level analysis",
        "summary",
        "gbrflag",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "ssl certificate",
        "defense evasion",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "mitre att",
        "date",
        "path",
        "format",
        "august",
        "hybrid",
        "local",
        "form",
        "click",
        "strings",
        "ubar",
        "truetype",
        "web open",
        "font format",
        "description web",
        "general",
        "iframe",
        "slcc2",
        "media center",
        "destination",
        "tlsv1",
        "unknown",
        "execution",
        "dock",
        "persistence",
        "malware",
        "encrypt",
        "ck techniques",
        "read c",
        "show",
        "entries",
        "delete",
        "data upload",
        "extraction",
        "onlv",
        "find",
        "type",
        "no matching",
        "indicator",
        "mtb may",
        "trojandropper",
        "passive dns",
        "next associated",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "ipv4 add",
        "trojan",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg",
        "shellterlod may",
        "win32qqpass apr",
        "trojanspy",
        "ransom",
        "wiper",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results aug",
        "urls show",
        "hookwowlow may"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4593,
        "hostname": 1754,
        "domain": 399,
        "FileHash-SHA256": 2128,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 299,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 9616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68930449988277cd29c25cb7",
      "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
      "description": "",
      "modified": "2025-09-05T07:00:00.711000",
      "created": "2025-08-06T07:29:13.136000",
      "tags": [
        "url https",
        "iocs",
        "learn more",
        "ipv4",
        "domain",
        "hostname",
        "types of",
        "sweden",
        "united",
        "belgium",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "showing",
        "document file",
        "v2 document",
        "search",
        "medium",
        "ms windows",
        "vista event",
        "port",
        "msie",
        "windows nt",
        "wow64",
        "dirty",
        "write",
        "powershell",
        "copy",
        "next",
        "defender",
        "dynamicloader",
        "high",
        "fwlink",
        "windows",
        "cmd c",
        "alerts",
        "bios",
        "related pulses",
        "pulses",
        "related tags",
        "file type",
        "ascii text",
        "sha256",
        "external",
        "virustotal api",
        "screenshots",
        "june",
        "flag",
        "usa windows",
        "input threat",
        "level analysis",
        "summary",
        "gbrflag",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "ssl certificate",
        "defense evasion",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "mitre att",
        "date",
        "path",
        "format",
        "august",
        "hybrid",
        "local",
        "form",
        "click",
        "strings",
        "ubar",
        "truetype",
        "web open",
        "font format",
        "description web",
        "general",
        "iframe",
        "slcc2",
        "media center",
        "destination",
        "tlsv1",
        "unknown",
        "execution",
        "dock",
        "persistence",
        "malware",
        "encrypt",
        "ck techniques",
        "read c",
        "show",
        "entries",
        "delete",
        "data upload",
        "extraction",
        "onlv",
        "find",
        "type",
        "no matching",
        "indicator",
        "mtb may",
        "trojandropper",
        "passive dns",
        "next associated",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "ipv4 add",
        "trojan",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg",
        "shellterlod may",
        "win32qqpass apr",
        "trojanspy",
        "ransom",
        "wiper",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results aug",
        "urls show",
        "hookwowlow may"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6893032410060f658d862c60",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4593,
        "hostname": 1754,
        "domain": 399,
        "FileHash-SHA256": 2128,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 299,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 9616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "226 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68732864356c4353e0b1efe2",
      "name": "Denver Post - Custom Malware | Xord",
      "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
      "modified": "2025-08-12T03:05:26.037000",
      "created": "2025-07-13T03:30:44.589000",
      "tags": [
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "entries",
        "url http",
        "domain",
        "ipv4",
        "filehashsha256",
        "hostname",
        "types of",
        "united kingdom",
        "united",
        "germany",
        "france",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "extraction",
        "data upload",
        "failed",
        "se extraction",
        "enter sc",
        "type",
        "extra data",
        "please",
        "include review",
        "exclude sugges",
        "type ol",
        "please sub",
        "langes",
        "include",
        "review data",
        "extrad",
        "manually add",
        "indicator",
        "sc type",
        "included iocs",
        "se extr",
        "review exclude",
        "sugges",
        "extract data",
        "add indicator",
        "domain related",
        "showing",
        "tewdida data",
        "present jul",
        "script urls",
        "a domains",
        "present jun",
        "search",
        "accept encoding",
        "unknown aaaa",
        "present may",
        "date",
        "meta",
        "body",
        "ipv6",
        "role",
        "present jan",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "regexp",
        "typeof e",
        "typeof t",
        "function",
        "width",
        "error",
        "object",
        "x20trnf",
        "pseudo",
        "child",
        "form",
        "class",
        "null",
        "write",
        "this",
        "void",
        "accept",
        "copy",
        "extr please",
        "typ data",
        "indicalok no",
        "gmt max",
        "reverse dns",
        "location united",
        "america flag",
        "ashburn",
        "america asn",
        "dns resolutions",
        "domains top",
        "extri please",
        "review",
        "sugges data",
        "find suxesteu",
        "typ indical",
        "on hos",
        "dynamicloader",
        "medium",
        "show",
        "high",
        "windows",
        "cmd c",
        "delete",
        "next",
        "unknown",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "as15169",
        "execution",
        "dock",
        "persistence",
        "malware",
        "roboto",
        "fwlink",
        "powershell",
        "delete c",
        "guard",
        "win32",
        "passive dns",
        "ransom",
        "trojan",
        "gmt cache",
        "sameorigin",
        "443 ma2592000",
        "pulse",
        "trojandropper",
        "worm",
        "ur extraction",
        "find",
        "types",
        "seard data",
        "source se",
        "url toi",
        "ela fer",
        "iocs",
        "search otx",
        "extr",
        "indicators h",
        "weall",
        "indica",
        "sc data",
        "data u",
        "extre",
        "find s",
        "onv incmde",
        "exclude data",
        "suggested",
        "typ no"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3107,
        "domain": 526,
        "hostname": 940,
        "FileHash-SHA256": 2209,
        "email": 2,
        "FileHash-MD5": 80,
        "FileHash-SHA1": 31,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 6906,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68732869bad70de69c45c1b3",
      "name": "Denver Post - Custom Malware | Xord",
      "description": "YARA Detections:\n\u2022 xord_nopsled_in_jquery\ncompromised_site_redirector_fromcharcode\n\u2022 KnownMaliciousObfuscationPattern\n\u2022 WebExploit | \nAlerts:\n\u2022 ransomware_file_modifications\n\u2022 script_created_process\n\u2022 antivm_generic_disk\n\u2022 infostealer_cookies\n\u2022 suspicious_command\n\u2022 dead_host\n\u2022 suspicious_write_exe\n\u2022 network_icmp\n\u2022 modifies_certificates\n\u2022 process_martian\n* Malware IP - \n142.251.215.232",
      "modified": "2025-08-12T03:05:26.037000",
      "created": "2025-07-13T03:30:49.347000",
      "tags": [
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "entries",
        "url http",
        "domain",
        "ipv4",
        "filehashsha256",
        "hostname",
        "types of",
        "united kingdom",
        "united",
        "germany",
        "france",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "extraction",
        "data upload",
        "failed",
        "se extraction",
        "enter sc",
        "type",
        "extra data",
        "please",
        "include review",
        "exclude sugges",
        "type ol",
        "please sub",
        "langes",
        "include",
        "review data",
        "extrad",
        "manually add",
        "indicator",
        "sc type",
        "included iocs",
        "se extr",
        "review exclude",
        "sugges",
        "extract data",
        "add indicator",
        "domain related",
        "showing",
        "tewdida data",
        "present jul",
        "script urls",
        "a domains",
        "present jun",
        "search",
        "accept encoding",
        "unknown aaaa",
        "present may",
        "date",
        "meta",
        "body",
        "ipv6",
        "role",
        "present jan",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "regexp",
        "typeof e",
        "typeof t",
        "function",
        "width",
        "error",
        "object",
        "x20trnf",
        "pseudo",
        "child",
        "form",
        "class",
        "null",
        "write",
        "this",
        "void",
        "accept",
        "copy",
        "extr please",
        "typ data",
        "indicalok no",
        "gmt max",
        "reverse dns",
        "location united",
        "america flag",
        "ashburn",
        "america asn",
        "dns resolutions",
        "domains top",
        "extri please",
        "review",
        "sugges data",
        "find suxesteu",
        "typ indical",
        "on hos",
        "dynamicloader",
        "medium",
        "show",
        "high",
        "windows",
        "cmd c",
        "delete",
        "next",
        "unknown",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "read c",
        "as15169",
        "execution",
        "dock",
        "persistence",
        "malware",
        "roboto",
        "fwlink",
        "powershell",
        "delete c",
        "guard",
        "win32",
        "passive dns",
        "ransom",
        "trojan",
        "gmt cache",
        "sameorigin",
        "443 ma2592000",
        "pulse",
        "trojandropper",
        "worm",
        "ur extraction",
        "find",
        "types",
        "seard data",
        "source se",
        "url toi",
        "ela fer",
        "iocs",
        "search otx",
        "extr",
        "indicators h",
        "weall",
        "indica",
        "sc data",
        "data u",
        "extre",
        "find s",
        "onv incmde",
        "exclude data",
        "suggested",
        "typ no"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3107,
        "domain": 526,
        "hostname": 940,
        "FileHash-SHA256": 2209,
        "email": 2,
        "FileHash-MD5": 80,
        "FileHash-SHA1": 31,
        "SSLCertFingerprint": 11
      },
      "indicator_count": 6906,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "250 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f235b9a7a94a6a61acd651",
      "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
      "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
      "modified": "2025-03-07T08:38:08.584000",
      "created": "2024-09-24T03:44:57.902000",
      "tags": [
        "geoip",
        "public url",
        "as16509",
        "amazon02",
        "as20940",
        "akamaiasn1",
        "as8075",
        "as15169",
        "google",
        "akamaias",
        "facebook",
        "telecom",
        "twitter",
        "media",
        "win64",
        "level3",
        "mini",
        "ukraine",
        "proton",
        "ghost",
        "win32",
        "cuba",
        "mexico",
        "indonesia",
        "seznam",
        "as3359",
        "as852"
      ],
      "references": [
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
        "https://n0paste.eu/UH6n5pD/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Anguilla",
        "Poland",
        "Aruba",
        "Australia",
        "Barbados",
        "Costa Rica",
        "Guatemala",
        "Philippines",
        "Panama",
        "Sint Maarten (Dutch part)",
        "Saint Martin (French part)",
        "Cayman Islands",
        "Cura\u00e7ao",
        "Mexico",
        "Saint Vincent and the Grenadines",
        "Saint Kitts and Nevis",
        "Tanzania, United Republic of",
        "Netherlands",
        "Ukraine",
        "Trinidad and Tobago",
        "Japan",
        "Bahamas",
        "United Kingdom of Great Britain and Northern Ireland",
        "Georgia"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government",
        "Telecommunications",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1,
        "CIDR": 1186,
        "CVE": 4,
        "FileHash-MD5": 29,
        "FileHash-SHA1": 3,
        "URL": 25493,
        "domain": 5396,
        "email": 10,
        "hostname": 10770
      },
      "indicator_count": 42892,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 147,
      "modified_text": "408 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "downlevel.mobile",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "downlevel.mobile",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776611901.8390985
}