{
  "type": "Domain",
  "indicator": "enumdata.org",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/enumdata.org",
    "alexa": "http://www.alexa.com/siteinfo/enumdata.org",
    "indicator": "enumdata.org",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3957827566,
      "indicator": "enumdata.org",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68db395368d6c4042517f3f3",
          "name": "Target Saver M1 Agent TSA Spy \u2022 Mastadon - Hit Tip! Thanks!",
          "description": "Hot Tip! I would love to give a shout out to the person who provided this information, I\u2019m not sure if they want to remain anonymous or not. Thank SO Much!\n\nSpyware and a source for distributing malicious media. Complete foothold\non networks, browsers, phones, search history and everything, massive streaming pornography distributed, members and contributors. \n\nVery important tip.  I will analyze and break down into digestible pulse sizes.",
          "modified": "2025-12-27T15:01:22.545000",
          "created": "2025-09-30T01:58:43.592000",
          "tags": [
            "http traffic",
            "match info",
            "http get",
            "info performs",
            "dns query",
            "https http",
            "mitre att",
            "evasion ta0005",
            "creates",
            "info",
            "oc0006 http",
            "wininet c0005",
            "resolved ips",
            "get http",
            "html document",
            "unicode text",
            "dynamicloader",
            "fe ff",
            "medium",
            "x00bx00",
            "uswv",
            "k uswv",
            "search",
            "high",
            "delete c",
            "yara detections",
            "redline",
            "guard",
            "write",
            "united",
            "present sep",
            "aaaa",
            "passive dns",
            "urls",
            "next associated",
            "found",
            "x content",
            "hacktool",
            "trojan",
            "error",
            "lowfi",
            "win32",
            "worm",
            "ip address",
            "mtb apr",
            "ransom",
            "virtool",
            "ain add",
            "directui",
            "element",
            "classinfobase",
            "ccbase",
            "hwndhost",
            "yara rule",
            "hpavvalue",
            "qaejh",
            "name servers",
            "cryp",
            "emails",
            "next related",
            "domain related",
            "no expiration",
            "url http",
            "url https",
            "indicator role",
            "hostname",
            "email",
            "present jun",
            "present aug",
            "present jul",
            "servers",
            "title",
            "encrypt",
            "altsvc h3",
            "date tue",
            "acceptranges",
            "reportto",
            "server",
            "gmt expires",
            "gmt contenttype",
            "script",
            "expiresthu",
            "maxage63072000",
            "pragma",
            "google safe",
            "unknown ns",
            "files",
            "location united",
            "asn as15169",
            "trojandropper",
            "susp",
            "creation date",
            "asn as133618",
            "tags",
            "related tags",
            "indicator facts",
            "backdoor",
            "ipv4 add",
            "click",
            "artro",
            "target saver",
            "trojanspy",
            "reverse dns",
            "america flag",
            "443 ma2592000",
            "hostname add",
            "verdict",
            "present mar",
            "present jan",
            "present dec",
            "present apr",
            "ipv4",
            "type indicator",
            "role title",
            "related pulses",
            "iocs",
            "moved",
            "downloads",
            "apple",
            "microsoft",
            "hexagonsystem",
            "mastadon",
            "status",
            "twitter",
            "gmt content",
            "easyredir cache",
            "v4 add",
            "redacted for",
            "privacy tech",
            "privacy admin",
            "registrar abuse",
            "available from",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "entity",
            "code",
            "date",
            "dnssec",
            "showing",
            "unknown aaaa",
            "sha256",
            "sha1",
            "ascii text",
            "ck id",
            "show technique",
            "ck matrix",
            "meta",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "certificate"
          ],
          "references": [
            "FileHash-SHA256 025ca2c59c26197f3c1cd746469a5b9fe219a748716abd90daee792f34037d63",
            "mastodon.social",
            "https://families.google/intl/pt-PT_ALL/familylink/",
            "http://service.adultprovide.com/docs/records.htm?site=bigtitsboss",
            "slscr.update.microsoft.com \u2022client.wns.windows.com \u2022  c.pki.goog \u2022 login.live.com",
            "https://discuss.ai.google.dev/c/gemma/10",
            "https://uj140.keap-link003.com/v2/render/acc9c3f6b0340c8e01d0d3d0e1662c9e/eJxtjjsLwjAUhf_LnTP0hdRspYQSWkXEwU1Ce4XUmob0Riil_90o0snxPD7OWYDQKEOyAw6-j7MIGDhstdVoqBwNqfYbprs4T3IGgzaPyo3eAl_-sVv-cbM0yfYRA5otho44FLKBddOXc1HW8ljdTvIqmgDjU5N4heEJODmPDJS1aLrfjxpn4Hc1TLi-ARRkO0Y=/pixel.png",
            "https://m.bigwetbutts.com/ tmi",
            "Spyware: FileHash-SHA256 035e393630953b89c602e7cfa3409da790e99309c2d916336147cf9c59ee1b89",
            "Mirai: simswap.in",
            "66.254.114.41 \u2022 brazzersnetwork.com \u2022 brazzers.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 www.pornhub.com",
            "https://buildings.hexagongeosystems.com \u2022 https://connect.hexagongeosystems.com",
            "https://load.ss.hexagongeosystems.com \u2022 https://rail.hexagongeosystems.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:VirTool:Win32/GenDecnryptAlgo.S02",
              "display_name": "#Lowfi:HSTR:VirTool:Win32/GenDecnryptAlgo.S02",
              "target": null
            },
            {
              "id": "Win.Ransomware.Bitman-9862733-0",
              "display_name": "Win.Ransomware.Bitman-9862733-0",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            },
            {
              "id": "Target Saver",
              "display_name": "Target Saver",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Hacktool",
              "display_name": "Hacktool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [
            "Media",
            "Legal",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2964,
            "hostname": 1164,
            "URL": 4334,
            "domain": 956,
            "FileHash-MD5": 476,
            "FileHash-SHA1": 451,
            "CVE": 1,
            "email": 20,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 10368,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "113 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6832b9467aa167c4d0e25886",
          "name": "http;//www.in-addr.arpa",
          "description": "The full text of the first full-scale computer code to be developed by the American Academy of Technology (ARPA) has been published on the website of Internet Architecture Board (IAB) and its website.",
          "modified": "2025-06-24T05:01:28.721000",
          "created": "2025-05-25T06:31:34.218000",
          "tags": [
            "general banking",
            "monday",
            "friday",
            "saturday",
            "skaner internet",
            "archive html5",
            "uploader",
            "board"
          ],
          "references": [
            "http;//www.in-addr.arpa",
            "http://ns2.apnic.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 95,
            "email": 3,
            "URL": 874,
            "hostname": 321,
            "FileHash-SHA256": 25
          },
          "indicator_count": 1318,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "299 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d147ac5afafb76f652ccfb",
          "name": "cyberfolks.pl / Hosting/ 185.208.164.121 / VPS / 94.152.11.60 / 193.218.154.51",
          "description": "The full text of the text-free version of Microsoft's Chrome browser can be viewed here:. \u00c2\u00a31.5m.. (\u20ac2.4m)  \u20ac",
          "modified": "2024-12-16T22:19:24.841000",
          "created": "2024-08-30T04:16:44.939000",
          "tags": [
            "vhash",
            "ssdeep",
            "digicert",
            "g2 firmy",
            "digicert g3",
            "entrust gwny",
            "gwny",
            "microsoft ecc",
            "microsoft azure",
            "ecc tls",
            "rsa tls",
            "microsoft rsa",
            "aoc ca",
            "digicert tls",
            "azure rsa",
            "eoc ca",
            "digicert cloud",
            "azure tls",
            "azure ecc",
            "xargs",
            "jeli",
            "azure",
            "authority",
            "java",
            "ms windows",
            "dziennik zdarze",
            "vista",
            "pe32",
            "intel",
            "defender",
            "systemy",
            "plik",
            "tekst ascii",
            "dane archiwalne",
            "ptime",
            "danie",
            "msie",
            "windows nt",
            "okrndata",
            "jzyk",
            "cieka",
            "sha1",
            "sha256",
            "imphasz",
            "pejzasz",
            "windows",
            "eurostile",
            "disk1",
            "augustin",
            "butterfield",
            "cook",
            "drummer",
            "erickson",
            "fjsv",
            "flynn",
            "gorman",
            "easy",
            "rada",
            "xanadu",
            "config",
            "reboot",
            "screen",
            "trash",
            "wersja pliku",
            "v2 dokument",
            "aaaa",
            "cname",
            "aaaaa",
            "whasz",
            "dostawa",
            "cache entry",
            "wav chrome",
            "gzip chrome",
            "text chrome",
            "woff chrome",
            "cab c",
            "lnk c",
            "doc c",
            "doc chrome",
            "ttf chrome"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6307,
            "hostname": 7851,
            "domain": 1282,
            "FileHash-MD5": 221,
            "FileHash-SHA256": 1346,
            "IPv4": 1437,
            "IPv6": 8,
            "FileHash-SHA1": 192,
            "email": 3,
            "CIDR": 8,
            "CVE": 2
          },
          "indicator_count": 18657,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 125,
          "modified_text": "488 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 www.pornhub.com",
        "66.254.114.41 \u2022 brazzersnetwork.com \u2022 brazzers.com",
        "mastodon.social",
        "https://discuss.ai.google.dev/c/gemma/10",
        "http://service.adultprovide.com/docs/records.htm?site=bigtitsboss",
        "https://families.google/intl/pt-PT_ALL/familylink/",
        "https://buildings.hexagongeosystems.com \u2022 https://connect.hexagongeosystems.com",
        "https://load.ss.hexagongeosystems.com \u2022 https://rail.hexagongeosystems.com",
        "Mirai: simswap.in",
        "http;//www.in-addr.arpa",
        "https://uj140.keap-link003.com/v2/render/acc9c3f6b0340c8e01d0d3d0e1662c9e/eJxtjjsLwjAUhf_LnTP0hdRspYQSWkXEwU1Ce4XUmob0Riil_90o0snxPD7OWYDQKEOyAw6-j7MIGDhstdVoqBwNqfYbprs4T3IGgzaPyo3eAl_-sVv-cbM0yfYRA5otho44FLKBddOXc1HW8ljdTvIqmgDjU5N4heEJODmPDJS1aLrfjxpn4Hc1TLi-ARRkO0Y=/pixel.png",
        "http://ns2.apnic.net",
        "https://m.bigwetbutts.com/ tmi",
        "FileHash-SHA256 025ca2c59c26197f3c1cd746469a5b9fe219a748716abd90daee792f34037d63",
        "slscr.update.microsoft.com \u2022client.wns.windows.com \u2022  c.pki.goog \u2022 login.live.com",
        "Spyware: FileHash-SHA256 035e393630953b89c602e7cfa3409da790e99309c2d916336147cf9c59ee1b89"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "#lowfi:hstr:virtool:win32/gendecnryptalgo.s02",
            "Artro",
            "Target saver",
            "Hacktool",
            "Alf:heraklezeval:trojan:win32/clipbanker",
            "Trojanspy",
            "Win.ransomware.bitman-9862733-0"
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Legal",
            "Media"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68db395368d6c4042517f3f3",
      "name": "Target Saver M1 Agent TSA Spy \u2022 Mastadon - Hit Tip! Thanks!",
      "description": "Hot Tip! I would love to give a shout out to the person who provided this information, I\u2019m not sure if they want to remain anonymous or not. Thank SO Much!\n\nSpyware and a source for distributing malicious media. Complete foothold\non networks, browsers, phones, search history and everything, massive streaming pornography distributed, members and contributors. \n\nVery important tip.  I will analyze and break down into digestible pulse sizes.",
      "modified": "2025-12-27T15:01:22.545000",
      "created": "2025-09-30T01:58:43.592000",
      "tags": [
        "http traffic",
        "match info",
        "http get",
        "info performs",
        "dns query",
        "https http",
        "mitre att",
        "evasion ta0005",
        "creates",
        "info",
        "oc0006 http",
        "wininet c0005",
        "resolved ips",
        "get http",
        "html document",
        "unicode text",
        "dynamicloader",
        "fe ff",
        "medium",
        "x00bx00",
        "uswv",
        "k uswv",
        "search",
        "high",
        "delete c",
        "yara detections",
        "redline",
        "guard",
        "write",
        "united",
        "present sep",
        "aaaa",
        "passive dns",
        "urls",
        "next associated",
        "found",
        "x content",
        "hacktool",
        "trojan",
        "error",
        "lowfi",
        "win32",
        "worm",
        "ip address",
        "mtb apr",
        "ransom",
        "virtool",
        "ain add",
        "directui",
        "element",
        "classinfobase",
        "ccbase",
        "hwndhost",
        "yara rule",
        "hpavvalue",
        "qaejh",
        "name servers",
        "cryp",
        "emails",
        "next related",
        "domain related",
        "no expiration",
        "url http",
        "url https",
        "indicator role",
        "hostname",
        "email",
        "present jun",
        "present aug",
        "present jul",
        "servers",
        "title",
        "encrypt",
        "altsvc h3",
        "date tue",
        "acceptranges",
        "reportto",
        "server",
        "gmt expires",
        "gmt contenttype",
        "script",
        "expiresthu",
        "maxage63072000",
        "pragma",
        "google safe",
        "unknown ns",
        "files",
        "location united",
        "asn as15169",
        "trojandropper",
        "susp",
        "creation date",
        "asn as133618",
        "tags",
        "related tags",
        "indicator facts",
        "backdoor",
        "ipv4 add",
        "click",
        "artro",
        "target saver",
        "trojanspy",
        "reverse dns",
        "america flag",
        "443 ma2592000",
        "hostname add",
        "verdict",
        "present mar",
        "present jan",
        "present dec",
        "present apr",
        "ipv4",
        "type indicator",
        "role title",
        "related pulses",
        "iocs",
        "moved",
        "downloads",
        "apple",
        "microsoft",
        "hexagonsystem",
        "mastadon",
        "status",
        "twitter",
        "gmt content",
        "easyredir cache",
        "v4 add",
        "redacted for",
        "privacy tech",
        "privacy admin",
        "registrar abuse",
        "available from",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "entity",
        "code",
        "date",
        "dnssec",
        "showing",
        "unknown aaaa",
        "sha256",
        "sha1",
        "ascii text",
        "ck id",
        "show technique",
        "ck matrix",
        "meta",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "certificate"
      ],
      "references": [
        "FileHash-SHA256 025ca2c59c26197f3c1cd746469a5b9fe219a748716abd90daee792f34037d63",
        "mastodon.social",
        "https://families.google/intl/pt-PT_ALL/familylink/",
        "http://service.adultprovide.com/docs/records.htm?site=bigtitsboss",
        "slscr.update.microsoft.com \u2022client.wns.windows.com \u2022  c.pki.goog \u2022 login.live.com",
        "https://discuss.ai.google.dev/c/gemma/10",
        "https://uj140.keap-link003.com/v2/render/acc9c3f6b0340c8e01d0d3d0e1662c9e/eJxtjjsLwjAUhf_LnTP0hdRspYQSWkXEwU1Ce4XUmob0Riil_90o0snxPD7OWYDQKEOyAw6-j7MIGDhstdVoqBwNqfYbprs4T3IGgzaPyo3eAl_-sVv-cbM0yfYRA5otho44FLKBddOXc1HW8ljdTvIqmgDjU5N4heEJODmPDJS1aLrfjxpn4Hc1TLi-ARRkO0Y=/pixel.png",
        "https://m.bigwetbutts.com/ tmi",
        "Spyware: FileHash-SHA256 035e393630953b89c602e7cfa3409da790e99309c2d916336147cf9c59ee1b89",
        "Mirai: simswap.in",
        "66.254.114.41 \u2022 brazzersnetwork.com \u2022 brazzers.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian \u2022 www.pornhub.com",
        "https://buildings.hexagongeosystems.com \u2022 https://connect.hexagongeosystems.com",
        "https://load.ss.hexagongeosystems.com \u2022 https://rail.hexagongeosystems.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:VirTool:Win32/GenDecnryptAlgo.S02",
          "display_name": "#Lowfi:HSTR:VirTool:Win32/GenDecnryptAlgo.S02",
          "target": null
        },
        {
          "id": "Win.Ransomware.Bitman-9862733-0",
          "display_name": "Win.Ransomware.Bitman-9862733-0",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        },
        {
          "id": "Target Saver",
          "display_name": "Target Saver",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Hacktool",
          "display_name": "Hacktool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [
        "Media",
        "Legal",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2964,
        "hostname": 1164,
        "URL": 4334,
        "domain": 956,
        "FileHash-MD5": 476,
        "FileHash-SHA1": 451,
        "CVE": 1,
        "email": 20,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 10368,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "113 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6832b9467aa167c4d0e25886",
      "name": "http;//www.in-addr.arpa",
      "description": "The full text of the first full-scale computer code to be developed by the American Academy of Technology (ARPA) has been published on the website of Internet Architecture Board (IAB) and its website.",
      "modified": "2025-06-24T05:01:28.721000",
      "created": "2025-05-25T06:31:34.218000",
      "tags": [
        "general banking",
        "monday",
        "friday",
        "saturday",
        "skaner internet",
        "archive html5",
        "uploader",
        "board"
      ],
      "references": [
        "http;//www.in-addr.arpa",
        "http://ns2.apnic.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 95,
        "email": 3,
        "URL": 874,
        "hostname": 321,
        "FileHash-SHA256": 25
      },
      "indicator_count": 1318,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "299 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d147ac5afafb76f652ccfb",
      "name": "cyberfolks.pl / Hosting/ 185.208.164.121 / VPS / 94.152.11.60 / 193.218.154.51",
      "description": "The full text of the text-free version of Microsoft's Chrome browser can be viewed here:. \u00c2\u00a31.5m.. (\u20ac2.4m)  \u20ac",
      "modified": "2024-12-16T22:19:24.841000",
      "created": "2024-08-30T04:16:44.939000",
      "tags": [
        "vhash",
        "ssdeep",
        "digicert",
        "g2 firmy",
        "digicert g3",
        "entrust gwny",
        "gwny",
        "microsoft ecc",
        "microsoft azure",
        "ecc tls",
        "rsa tls",
        "microsoft rsa",
        "aoc ca",
        "digicert tls",
        "azure rsa",
        "eoc ca",
        "digicert cloud",
        "azure tls",
        "azure ecc",
        "xargs",
        "jeli",
        "azure",
        "authority",
        "java",
        "ms windows",
        "dziennik zdarze",
        "vista",
        "pe32",
        "intel",
        "defender",
        "systemy",
        "plik",
        "tekst ascii",
        "dane archiwalne",
        "ptime",
        "danie",
        "msie",
        "windows nt",
        "okrndata",
        "jzyk",
        "cieka",
        "sha1",
        "sha256",
        "imphasz",
        "pejzasz",
        "windows",
        "eurostile",
        "disk1",
        "augustin",
        "butterfield",
        "cook",
        "drummer",
        "erickson",
        "fjsv",
        "flynn",
        "gorman",
        "easy",
        "rada",
        "xanadu",
        "config",
        "reboot",
        "screen",
        "trash",
        "wersja pliku",
        "v2 dokument",
        "aaaa",
        "cname",
        "aaaaa",
        "whasz",
        "dostawa",
        "cache entry",
        "wav chrome",
        "gzip chrome",
        "text chrome",
        "woff chrome",
        "cab c",
        "lnk c",
        "doc c",
        "doc chrome",
        "ttf chrome"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6307,
        "hostname": 7851,
        "domain": 1282,
        "FileHash-MD5": 221,
        "FileHash-SHA256": 1346,
        "IPv4": 1437,
        "IPv6": 8,
        "FileHash-SHA1": 192,
        "email": 3,
        "CIDR": 8,
        "CVE": 2
      },
      "indicator_count": 18657,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 125,
      "modified_text": "488 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "enumdata.org",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "enumdata.org",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629516.71863
}