{
  "type": "URL",
  "indicator": "http://creatium.intercom-attachments-4.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://creatium.intercom-attachments-4.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4074476874,
      "indicator": "http://creatium.intercom-attachments-4.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "689af6a1704fa2745bc8c2a3",
          "name": "Hijacked Twitter / X.com account. Phishing | Abnormal use",
          "description": "Hijacked phishing Twitter/ X.com.\nWin32/Unruy.C Activity\n#phishing #hijacked #intercoms #unruy #trojan #VTflood #malware #attack",
          "modified": "2025-09-11T08:02:36.759000",
          "created": "2025-08-12T08:09:05.642000",
          "tags": [
            "log id",
            "gmtn",
            "secure",
            "tls web",
            "passive dns",
            "urls",
            "path",
            "self",
            "encrypt",
            "ca issuers",
            "false",
            "search",
            "read c",
            "united",
            "entries",
            "show",
            "showing",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "copy",
            "write",
            "suspicious",
            "malware",
            "unknown",
            "process32nextw",
            "shellexecuteexw",
            "medium process",
            "discovery t1057",
            "t1057",
            "discovery",
            "medium",
            "locally unique",
            "identifier",
            "veailmboprd",
            "next associated",
            "ipv4 add",
            "pulse pulses",
            "files",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "smoke loader",
            "trojan",
            "body",
            "learn",
            "ck id",
            "name tactics",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "ssl certificate",
            "execution att",
            "show process",
            "programfiles",
            "command decode",
            "flag",
            "suricata ipv4",
            "mitre att",
            "show technique",
            "ck matrix",
            "date",
            "comspec",
            "model",
            "twitter",
            "august",
            "hybrid",
            "general",
            "click",
            "strings"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1504,
            "FileHash-SHA256": 1232,
            "SSLCertFingerprint": 14,
            "domain": 245,
            "hostname": 526,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 38
          },
          "indicator_count": 3602,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684522ae1f20db8b90ea41a4",
          "name": "Stealthy Nexus Australia -X.com attacks against monitored targets",
          "description": "Nexus-australia-websocket-Austraia .\n#malware  #injected #trojandropper #delf_deletes_spyware #spyware #malicious #badactor #backdoor #encrypts #warning_office_encrypted_doc",
          "modified": "2025-07-08T04:03:04.386000",
          "created": "2025-06-08T05:42:06.731000",
          "tags": [
            "url https",
            "url http",
            "united",
            "china",
            "hong kong",
            "russia",
            "search",
            "type indicator",
            "role title",
            "added active",
            "amer",
            "related pulses",
            "ipv4",
            "entries",
            "flag",
            "indicator role",
            "title added",
            "active related",
            "filehashmd5",
            "ck ids",
            "t1057",
            "discovery",
            "t1071",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480",
            "guardrails",
            "t1553",
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "digicert tls",
            "rsa sha256",
            "tls web",
            "full name",
            "digicert inc",
            "organization",
            "false",
            "pulses hostname",
            "showing",
            "dynamicloader",
            "medium",
            "write c",
            "show",
            "yara detections",
            "copy",
            "high",
            "t1055",
            "write",
            "april",
            "report spam",
            "business social",
            "media account",
            "created",
            "minutes ago",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "filehash",
            "sha256 add",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "detections name",
            "previous",
            "exif data",
            "value exe",
            "fileflags",
            "machinetype amd",
            "amd64 exe",
            "fileos windows",
            "pulse",
            "file score",
            "low risk",
            "pulses"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [
            "Financial"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 888,
            "domain": 115,
            "hostname": 275,
            "FileHash-MD5": 34,
            "FileHash-SHA256": 158,
            "FileHash-SHA1": 30,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 1502,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "285 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Financial"
          ],
          "unique_indicators": 4675
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/intercom-attachments-4.com",
    "whois": "http://whois.domaintools.com/intercom-attachments-4.com",
    "domain": "intercom-attachments-4.com",
    "hostname": "creatium.intercom-attachments-4.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "689af6a1704fa2745bc8c2a3",
      "name": "Hijacked Twitter / X.com account. Phishing | Abnormal use",
      "description": "Hijacked phishing Twitter/ X.com.\nWin32/Unruy.C Activity\n#phishing #hijacked #intercoms #unruy #trojan #VTflood #malware #attack",
      "modified": "2025-09-11T08:02:36.759000",
      "created": "2025-08-12T08:09:05.642000",
      "tags": [
        "log id",
        "gmtn",
        "secure",
        "tls web",
        "passive dns",
        "urls",
        "path",
        "self",
        "encrypt",
        "ca issuers",
        "false",
        "search",
        "read c",
        "united",
        "entries",
        "show",
        "showing",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "copy",
        "write",
        "suspicious",
        "malware",
        "unknown",
        "process32nextw",
        "shellexecuteexw",
        "medium process",
        "discovery t1057",
        "t1057",
        "discovery",
        "medium",
        "locally unique",
        "identifier",
        "veailmboprd",
        "next associated",
        "ipv4 add",
        "pulse pulses",
        "files",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "smoke loader",
        "trojan",
        "body",
        "learn",
        "ck id",
        "name tactics",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "ssl certificate",
        "execution att",
        "show process",
        "programfiles",
        "command decode",
        "flag",
        "suricata ipv4",
        "mitre att",
        "show technique",
        "ck matrix",
        "date",
        "comspec",
        "model",
        "twitter",
        "august",
        "hybrid",
        "general",
        "click",
        "strings"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1504,
        "FileHash-SHA256": 1232,
        "SSLCertFingerprint": 14,
        "domain": 245,
        "hostname": 526,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 38
      },
      "indicator_count": 3602,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "684522ae1f20db8b90ea41a4",
      "name": "Stealthy Nexus Australia -X.com attacks against monitored targets",
      "description": "Nexus-australia-websocket-Austraia .\n#malware  #injected #trojandropper #delf_deletes_spyware #spyware #malicious #badactor #backdoor #encrypts #warning_office_encrypted_doc",
      "modified": "2025-07-08T04:03:04.386000",
      "created": "2025-06-08T05:42:06.731000",
      "tags": [
        "url https",
        "url http",
        "united",
        "china",
        "hong kong",
        "russia",
        "search",
        "type indicator",
        "role title",
        "added active",
        "amer",
        "related pulses",
        "ipv4",
        "entries",
        "flag",
        "indicator role",
        "title added",
        "active related",
        "filehashmd5",
        "ck ids",
        "t1057",
        "discovery",
        "t1071",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480",
        "guardrails",
        "t1553",
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "digicert tls",
        "rsa sha256",
        "tls web",
        "full name",
        "digicert inc",
        "organization",
        "false",
        "pulses hostname",
        "showing",
        "dynamicloader",
        "medium",
        "write c",
        "show",
        "yara detections",
        "copy",
        "high",
        "t1055",
        "write",
        "april",
        "report spam",
        "business social",
        "media account",
        "created",
        "minutes ago",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "filehash",
        "sha256 add",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "detections name",
        "previous",
        "exif data",
        "value exe",
        "fileflags",
        "machinetype amd",
        "amd64 exe",
        "fileos windows",
        "pulse",
        "file score",
        "low risk",
        "pulses"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [
        "Financial"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 888,
        "domain": 115,
        "hostname": 275,
        "FileHash-MD5": 34,
        "FileHash-SHA256": 158,
        "FileHash-SHA1": 30,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 1502,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "285 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://creatium.intercom-attachments-4.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://creatium.intercom-attachments-4.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642024.2278006
}