{
  "type": "Domain",
  "indicator": "dropshipping.buzz",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/dropshipping.buzz",
    "alexa": "http://www.alexa.com/siteinfo/dropshipping.buzz",
    "indicator": "dropshipping.buzz",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3930871992,
      "indicator": "dropshipping.buzz",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "66a8fc31eef230721db4d064",
          "name": "Mid-year Doppelganger information operations in Europe and the US",
          "description": "This investigation delves into information operations conducted by Russian actors known as Doppelg\u00e4nger, focusing on their activities from early June to late-July 2024. It examines their tactics, associated infrastructure, and motivations, particularly in relation to the unexpected snap general election in France during this period. The analysis reveals a persistent and complex effort to disseminate disinformation through social media, impersonating legitimate news websites and employing intricate redirection chains. The operations primarily target conservative and nationalist sentiments, aiming to destabilize Western democracies by exploiting existing societal and political divisions.",
          "modified": "2025-08-07T12:51:05.434000",
          "created": "2024-07-30T14:44:01.273000",
          "tags": [
            "redirection",
            "social media",
            "russian actors",
            "disinformation",
            "elections"
          ],
          "references": [
            "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
          ],
          "public": 1,
          "adversary": "Doppelg\u00e4nger",
          "targeted_countries": [
            "France",
            "Germany",
            "United States of America",
            "Ukraine",
            "Israel",
            "Poland",
            "Taiwan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1498.001",
              "name": "Direct Network Flood",
              "display_name": "T1498.001 - Direct Network Flood"
            },
            {
              "id": "T1583.002",
              "name": "DNS Server",
              "display_name": "T1583.002 - DNS Server"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1134.002",
              "name": "Create Process with Token",
              "display_name": "T1134.002 - Create Process with Token"
            },
            {
              "id": "T1589.002",
              "name": "Email Addresses",
              "display_name": "T1589.002 - Email Addresses"
            },
            {
              "id": "T1583.003",
              "name": "Virtual Private Server",
              "display_name": "T1583.003 - Virtual Private Server"
            },
            {
              "id": "T1609",
              "name": "Container Administration Command",
              "display_name": "T1609 - Container Administration Command"
            },
            {
              "id": "T1114.003",
              "name": "Email Forwarding Rule",
              "display_name": "T1114.003 - Email Forwarding Rule"
            },
            {
              "id": "T1589.001",
              "name": "Credentials",
              "display_name": "T1589.001 - Credentials"
            },
            {
              "id": "T1499",
              "name": "Endpoint Denial of Service",
              "display_name": "T1499 - Endpoint Denial of Service"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1127.001",
              "name": "MSBuild",
              "display_name": "T1127.001 - MSBuild"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 265,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "URL": 232,
            "domain": 419,
            "email": 1,
            "hostname": 23
          },
          "indicator_count": 676,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386909,
          "modified_text": "299 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6788c6a841a3b4f6aafd1c3d",
          "name": "Mid-year Doppelganger information operations in Europe and the US",
          "description": "",
          "modified": "2025-01-16T08:43:20.646000",
          "created": "2025-01-16T08:43:20.646000",
          "tags": [
            "redirection",
            "social media",
            "russian actors",
            "disinformation",
            "elections"
          ],
          "references": [
            "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
          ],
          "public": 1,
          "adversary": "Doppelg\u00e4nger",
          "targeted_countries": [
            "France",
            "Germany",
            "United States of America",
            "Ukraine",
            "Israel",
            "Poland",
            "Taiwan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1498.001",
              "name": "Direct Network Flood",
              "display_name": "T1498.001 - Direct Network Flood"
            },
            {
              "id": "T1583.002",
              "name": "DNS Server",
              "display_name": "T1583.002 - DNS Server"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1134.002",
              "name": "Create Process with Token",
              "display_name": "T1134.002 - Create Process with Token"
            },
            {
              "id": "T1589.002",
              "name": "Email Addresses",
              "display_name": "T1589.002 - Email Addresses"
            },
            {
              "id": "T1583.003",
              "name": "Virtual Private Server",
              "display_name": "T1583.003 - Virtual Private Server"
            },
            {
              "id": "T1609",
              "name": "Container Administration Command",
              "display_name": "T1609 - Container Administration Command"
            },
            {
              "id": "T1114.003",
              "name": "Email Forwarding Rule",
              "display_name": "T1114.003 - Email Forwarding Rule"
            },
            {
              "id": "T1589.001",
              "name": "Credentials",
              "display_name": "T1589.001 - Credentials"
            },
            {
              "id": "T1499",
              "name": "Endpoint Denial of Service",
              "display_name": "T1499 - Endpoint Denial of Service"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1127.001",
              "name": "MSBuild",
              "display_name": "T1127.001 - MSBuild"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "66ab1af7fa97122299b0eac5",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Tr1sa111",
            "id": "192483",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "URL": 235,
            "domain": 419,
            "email": 1,
            "hostname": 26
          },
          "indicator_count": 682,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 278,
          "modified_text": "502 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67429f73a3f45fa88890276d",
          "name": "StreamMining",
          "description": "",
          "modified": "2024-11-24T03:37:23.616000",
          "created": "2024-11-24T03:37:23.616000",
          "tags": [
            "eliminar",
            "leer ms",
            "wishlist vista",
            "poltica",
            "secadores",
            "vista",
            "sala",
            "vaporal",
            "utensilios",
            "belleza equipos",
            "ciudad"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "670f94e03014212e19fa5a77",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "rivocado",
            "id": "300960",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "URL": 170,
            "domain": 11158,
            "hostname": 3549
          },
          "indicator_count": 14883,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 25,
          "modified_text": "555 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67429f7224d433f384b935c8",
          "name": "StreamMining",
          "description": "",
          "modified": "2024-11-24T03:37:22.551000",
          "created": "2024-11-24T03:37:22.551000",
          "tags": [
            "eliminar",
            "leer ms",
            "wishlist vista",
            "poltica",
            "secadores",
            "vista",
            "sala",
            "vaporal",
            "utensilios",
            "belleza equipos",
            "ciudad"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "670f94e03014212e19fa5a77",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "rivocado",
            "id": "300960",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "URL": 170,
            "domain": 11158,
            "hostname": 3549
          },
          "indicator_count": 14883,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 20,
          "modified_text": "555 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "670f94e03014212e19fa5a77",
          "name": "Malicious-Dangerous-Domain&URL-New-IOC List",
          "description": "By Helaly",
          "modified": "2024-11-15T10:01:11.688000",
          "created": "2024-10-16T10:26:40.893000",
          "tags": [
            "eliminar",
            "leer ms",
            "wishlist vista",
            "poltica",
            "secadores",
            "vista",
            "sala",
            "vaporal",
            "utensilios",
            "belleza equipos",
            "ciudad"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 39659,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Eslam-ElHelaly",
            "id": "259630",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 6,
            "URL": 170,
            "domain": 11158,
            "hostname": 3549
          },
          "indicator_count": 14883,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 80,
          "modified_text": "564 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66ab1af7fa97122299b0eac5",
          "name": "Mid-year Doppelganger information operations in Europe and the US",
          "description": "",
          "modified": "2024-08-29T14:02:18.012000",
          "created": "2024-08-01T05:19:51.580000",
          "tags": [
            "redirection",
            "social media",
            "russian actors",
            "disinformation",
            "elections"
          ],
          "references": [
            "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
          ],
          "public": 1,
          "adversary": "Doppelg\u00e4nger",
          "targeted_countries": [
            "France",
            "Germany",
            "United States of America",
            "Ukraine",
            "Israel",
            "Poland",
            "Taiwan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1498.001",
              "name": "Direct Network Flood",
              "display_name": "T1498.001 - Direct Network Flood"
            },
            {
              "id": "T1583.002",
              "name": "DNS Server",
              "display_name": "T1583.002 - DNS Server"
            },
            {
              "id": "T1566.002",
              "name": "Spearphishing Link",
              "display_name": "T1566.002 - Spearphishing Link"
            },
            {
              "id": "T1566.001",
              "name": "Spearphishing Attachment",
              "display_name": "T1566.001 - Spearphishing Attachment"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1134.002",
              "name": "Create Process with Token",
              "display_name": "T1134.002 - Create Process with Token"
            },
            {
              "id": "T1589.002",
              "name": "Email Addresses",
              "display_name": "T1589.002 - Email Addresses"
            },
            {
              "id": "T1583.003",
              "name": "Virtual Private Server",
              "display_name": "T1583.003 - Virtual Private Server"
            },
            {
              "id": "T1609",
              "name": "Container Administration Command",
              "display_name": "T1609 - Container Administration Command"
            },
            {
              "id": "T1114.003",
              "name": "Email Forwarding Rule",
              "display_name": "T1114.003 - Email Forwarding Rule"
            },
            {
              "id": "T1589.001",
              "name": "Credentials",
              "display_name": "T1589.001 - Credentials"
            },
            {
              "id": "T1499",
              "name": "Endpoint Denial of Service",
              "display_name": "T1499 - Endpoint Denial of Service"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            },
            {
              "id": "T1127.001",
              "name": "MSBuild",
              "display_name": "T1127.001 - MSBuild"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "66a8fc31eef230721db4d064",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "tr2222200",
            "id": "207905",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "URL": 235,
            "domain": 419,
            "email": 1,
            "hostname": 26
          },
          "indicator_count": 682,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 188,
          "modified_text": "642 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
      ],
      "related": {
        "alienvault": {
          "adversary": [
            "Doppelg\u00e4nger"
          ],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "Doppelg\u00e4nger"
          ],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "66a8fc31eef230721db4d064",
      "name": "Mid-year Doppelganger information operations in Europe and the US",
      "description": "This investigation delves into information operations conducted by Russian actors known as Doppelg\u00e4nger, focusing on their activities from early June to late-July 2024. It examines their tactics, associated infrastructure, and motivations, particularly in relation to the unexpected snap general election in France during this period. The analysis reveals a persistent and complex effort to disseminate disinformation through social media, impersonating legitimate news websites and employing intricate redirection chains. The operations primarily target conservative and nationalist sentiments, aiming to destabilize Western democracies by exploiting existing societal and political divisions.",
      "modified": "2025-08-07T12:51:05.434000",
      "created": "2024-07-30T14:44:01.273000",
      "tags": [
        "redirection",
        "social media",
        "russian actors",
        "disinformation",
        "elections"
      ],
      "references": [
        "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
      ],
      "public": 1,
      "adversary": "Doppelg\u00e4nger",
      "targeted_countries": [
        "France",
        "Germany",
        "United States of America",
        "Ukraine",
        "Israel",
        "Poland",
        "Taiwan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1498.001",
          "name": "Direct Network Flood",
          "display_name": "T1498.001 - Direct Network Flood"
        },
        {
          "id": "T1583.002",
          "name": "DNS Server",
          "display_name": "T1583.002 - DNS Server"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1134.002",
          "name": "Create Process with Token",
          "display_name": "T1134.002 - Create Process with Token"
        },
        {
          "id": "T1589.002",
          "name": "Email Addresses",
          "display_name": "T1589.002 - Email Addresses"
        },
        {
          "id": "T1583.003",
          "name": "Virtual Private Server",
          "display_name": "T1583.003 - Virtual Private Server"
        },
        {
          "id": "T1609",
          "name": "Container Administration Command",
          "display_name": "T1609 - Container Administration Command"
        },
        {
          "id": "T1114.003",
          "name": "Email Forwarding Rule",
          "display_name": "T1114.003 - Email Forwarding Rule"
        },
        {
          "id": "T1589.001",
          "name": "Credentials",
          "display_name": "T1589.001 - Credentials"
        },
        {
          "id": "T1499",
          "name": "Endpoint Denial of Service",
          "display_name": "T1499 - Endpoint Denial of Service"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1127.001",
          "name": "MSBuild",
          "display_name": "T1127.001 - MSBuild"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 265,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "URL": 232,
        "domain": 419,
        "email": 1,
        "hostname": 23
      },
      "indicator_count": 676,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386909,
      "modified_text": "299 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6788c6a841a3b4f6aafd1c3d",
      "name": "Mid-year Doppelganger information operations in Europe and the US",
      "description": "",
      "modified": "2025-01-16T08:43:20.646000",
      "created": "2025-01-16T08:43:20.646000",
      "tags": [
        "redirection",
        "social media",
        "russian actors",
        "disinformation",
        "elections"
      ],
      "references": [
        "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
      ],
      "public": 1,
      "adversary": "Doppelg\u00e4nger",
      "targeted_countries": [
        "France",
        "Germany",
        "United States of America",
        "Ukraine",
        "Israel",
        "Poland",
        "Taiwan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1498.001",
          "name": "Direct Network Flood",
          "display_name": "T1498.001 - Direct Network Flood"
        },
        {
          "id": "T1583.002",
          "name": "DNS Server",
          "display_name": "T1583.002 - DNS Server"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1134.002",
          "name": "Create Process with Token",
          "display_name": "T1134.002 - Create Process with Token"
        },
        {
          "id": "T1589.002",
          "name": "Email Addresses",
          "display_name": "T1589.002 - Email Addresses"
        },
        {
          "id": "T1583.003",
          "name": "Virtual Private Server",
          "display_name": "T1583.003 - Virtual Private Server"
        },
        {
          "id": "T1609",
          "name": "Container Administration Command",
          "display_name": "T1609 - Container Administration Command"
        },
        {
          "id": "T1114.003",
          "name": "Email Forwarding Rule",
          "display_name": "T1114.003 - Email Forwarding Rule"
        },
        {
          "id": "T1589.001",
          "name": "Credentials",
          "display_name": "T1589.001 - Credentials"
        },
        {
          "id": "T1499",
          "name": "Endpoint Denial of Service",
          "display_name": "T1499 - Endpoint Denial of Service"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1127.001",
          "name": "MSBuild",
          "display_name": "T1127.001 - MSBuild"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "66ab1af7fa97122299b0eac5",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Tr1sa111",
        "id": "192483",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "URL": 235,
        "domain": 419,
        "email": 1,
        "hostname": 26
      },
      "indicator_count": 682,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 278,
      "modified_text": "502 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67429f73a3f45fa88890276d",
      "name": "StreamMining",
      "description": "",
      "modified": "2024-11-24T03:37:23.616000",
      "created": "2024-11-24T03:37:23.616000",
      "tags": [
        "eliminar",
        "leer ms",
        "wishlist vista",
        "poltica",
        "secadores",
        "vista",
        "sala",
        "vaporal",
        "utensilios",
        "belleza equipos",
        "ciudad"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "670f94e03014212e19fa5a77",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "rivocado",
        "id": "300960",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "URL": 170,
        "domain": 11158,
        "hostname": 3549
      },
      "indicator_count": 14883,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 25,
      "modified_text": "555 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67429f7224d433f384b935c8",
      "name": "StreamMining",
      "description": "",
      "modified": "2024-11-24T03:37:22.551000",
      "created": "2024-11-24T03:37:22.551000",
      "tags": [
        "eliminar",
        "leer ms",
        "wishlist vista",
        "poltica",
        "secadores",
        "vista",
        "sala",
        "vaporal",
        "utensilios",
        "belleza equipos",
        "ciudad"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "670f94e03014212e19fa5a77",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "rivocado",
        "id": "300960",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "URL": 170,
        "domain": 11158,
        "hostname": 3549
      },
      "indicator_count": 14883,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 20,
      "modified_text": "555 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "670f94e03014212e19fa5a77",
      "name": "Malicious-Dangerous-Domain&URL-New-IOC List",
      "description": "By Helaly",
      "modified": "2024-11-15T10:01:11.688000",
      "created": "2024-10-16T10:26:40.893000",
      "tags": [
        "eliminar",
        "leer ms",
        "wishlist vista",
        "poltica",
        "secadores",
        "vista",
        "sala",
        "vaporal",
        "utensilios",
        "belleza equipos",
        "ciudad"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 39659,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Eslam-ElHelaly",
        "id": "259630",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_259630/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 6,
        "URL": 170,
        "domain": 11158,
        "hostname": 3549
      },
      "indicator_count": 14883,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 80,
      "modified_text": "564 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66ab1af7fa97122299b0eac5",
      "name": "Mid-year Doppelganger information operations in Europe and the US",
      "description": "",
      "modified": "2024-08-29T14:02:18.012000",
      "created": "2024-08-01T05:19:51.580000",
      "tags": [
        "redirection",
        "social media",
        "russian actors",
        "disinformation",
        "elections"
      ],
      "references": [
        "https://harfanglab.io/en/insidethelab/doppelganger-operations-europe-us/"
      ],
      "public": 1,
      "adversary": "Doppelg\u00e4nger",
      "targeted_countries": [
        "France",
        "Germany",
        "United States of America",
        "Ukraine",
        "Israel",
        "Poland",
        "Taiwan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1498.001",
          "name": "Direct Network Flood",
          "display_name": "T1498.001 - Direct Network Flood"
        },
        {
          "id": "T1583.002",
          "name": "DNS Server",
          "display_name": "T1583.002 - DNS Server"
        },
        {
          "id": "T1566.002",
          "name": "Spearphishing Link",
          "display_name": "T1566.002 - Spearphishing Link"
        },
        {
          "id": "T1566.001",
          "name": "Spearphishing Attachment",
          "display_name": "T1566.001 - Spearphishing Attachment"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1134.002",
          "name": "Create Process with Token",
          "display_name": "T1134.002 - Create Process with Token"
        },
        {
          "id": "T1589.002",
          "name": "Email Addresses",
          "display_name": "T1589.002 - Email Addresses"
        },
        {
          "id": "T1583.003",
          "name": "Virtual Private Server",
          "display_name": "T1583.003 - Virtual Private Server"
        },
        {
          "id": "T1609",
          "name": "Container Administration Command",
          "display_name": "T1609 - Container Administration Command"
        },
        {
          "id": "T1114.003",
          "name": "Email Forwarding Rule",
          "display_name": "T1114.003 - Email Forwarding Rule"
        },
        {
          "id": "T1589.001",
          "name": "Credentials",
          "display_name": "T1589.001 - Credentials"
        },
        {
          "id": "T1499",
          "name": "Endpoint Denial of Service",
          "display_name": "T1499 - Endpoint Denial of Service"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        },
        {
          "id": "T1127.001",
          "name": "MSBuild",
          "display_name": "T1127.001 - MSBuild"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "66a8fc31eef230721db4d064",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "tr2222200",
        "id": "207905",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "URL": 235,
        "domain": 419,
        "email": 1,
        "hostname": 26
      },
      "indicator_count": 682,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 188,
      "modified_text": "642 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "dropshipping.buzz",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "dropshipping.buzz",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780413084.1349611
}