{
  "type": "URL",
  "indicator": "http://js.hs-scripts.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "http://js.hs-scripts.com",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #3032",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain hs-scripts.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3943362206,
      "indicator": "http://js.hs-scripts.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "67d9aa3446a826d09e3fcbd1",
          "name": "SSL [.] com - (Unenriched)",
          "description": "Analysis of phishing domain/service - ssl dot com\n\nUpdated 04.09.25: was able to pull IOCs from graph (vT): https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark",
          "modified": "2025-05-08T21:00:41.641000",
          "created": "2025-03-18T17:15:32.007000",
          "tags": [
            "malware",
            "virus",
            "trojan",
            "ransomware",
            "static",
            "analysis",
            "indicator of compromise",
            "ioc",
            "extraction",
            "emulation",
            "online",
            "submit",
            "sample",
            "download",
            "platform",
            "sandbox",
            "vxstream",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "javascript",
            "ansi",
            "pcap processing",
            "pcap",
            "prefetch8 ansi",
            "united",
            "date",
            "threat level",
            "show process",
            "hash seen",
            "programfiles",
            "win64",
            "comspec",
            "suspicious",
            "model",
            "hybrid",
            "close",
            "click",
            "hosts",
            "service",
            "general",
            "path",
            "encrypt",
            "strings",
            "contact",
            "SSL"
          ],
          "references": [
            "https://www.filescan.io/uploads/67d9a1b50a7899f3579c2e15/reports/e94f370c-9b21-4fc7-be6d-a23f17a236a0/ioc",
            "https://hybrid-analysis.com/sample/225749540c7c585ae4567062cfb85980f0966cc3386540b5259471b8e2e5315e",
            "https://www.virustotal.com/gui/domain/ssl.com/details",
            "https://hybrid-analysis.com/sample/225749540c7c585ae4567062cfb85980f0966cc3386540b5259471b8e2e5315e/67d9a21c369b542db10921d1",
            "https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark",
            "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c",
            "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c/iocs",
            "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c/summary",
            "https://metadefender.com/results/url/aHR0cDovL3NzbC5jb20=",
            "https://pastebin.com/yYxyUWra - 03.18.25 = Paste to CERT Related Pulses/References",
            "https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark - 04.09.25"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Technology",
            "Education",
            "Government",
            "Telecommunications",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 39,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 218,
            "FileHash-MD5": 80,
            "FileHash-SHA1": 80,
            "FileHash-SHA256": 462,
            "domain": 31,
            "hostname": 225,
            "SSLCertFingerprint": 15,
            "email": 10
          },
          "indicator_count": 1121,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "389 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b0fa3624bf0384e427f2e7",
          "name": "Tracking Domains 4.2 - 08.19.24",
          "description": "Tracking Domains detected by Privacy Badger Ext. on Microsoft Edge Browser (W11 Device) using Telus ISP (ASN852)\n*Not-Enriched (08.05.24): ~50,000 suggests IOCs by AlienVault\nFrom VT: 2 IPs hosted by 45090 (Shenzhen Tencent Computer Systems Company Limited) & 4611 (CNNIC member) seem to be the problem here 118[.]89.204.198, 118[.]89.0.0/16 & 202[.]123.107.15, 202[.]123.107.0/24 (Respectively)",
          "modified": "2024-09-04T15:01:01.432000",
          "created": "2024-08-05T16:13:42.563000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
            "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
            "https://viz.greynoise.io/query/AS4611",
            "https://urlscan.io/asn/AS4611",
            "https://urlscan.io/search/#asn:%22AS4611%22",
            "https://urlscan.io/asn/AS45090",
            "https://urlscan.io/search/#asn%3A%22AS45090%22",
            "https://viz.greynoise.io/query/AS45090",
            "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
            "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
            "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
            "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6180,
            "FileHash-MD5": 1,
            "domain": 24921,
            "URL": 10854
          },
          "indicator_count": 41956,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "635 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/225749540c7c585ae4567062cfb85980f0966cc3386540b5259471b8e2e5315e",
        "https://urlscan.io/asn/AS4611",
        "https://urlscan.io/search/#asn:%22AS4611%22",
        "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
        "https://www.virustotal.com/gui/domain/ssl.com/details",
        "https://viz.greynoise.io/query/AS4611",
        "https://urlscan.io/asn/AS45090",
        "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be",
        "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
        "https://viz.greynoise.io/query/AS45090",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
        "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
        "https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark - 04.09.25",
        "https://hybrid-analysis.com/sample/225749540c7c585ae4567062cfb85980f0966cc3386540b5259471b8e2e5315e/67d9a21c369b542db10921d1",
        "https://urlscan.io/search/#asn%3A%22AS45090%22",
        "https://pastebin.com/yYxyUWra - 03.18.25 = Paste to CERT Related Pulses/References",
        "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c/summary",
        "https://metadefender.com/results/url/aHR0cDovL3NzbC5jb20=",
        "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c",
        "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
        "https://www.filescan.io/uploads/67d9a1b50a7899f3579c2e15/reports/e94f370c-9b21-4fc7-be6d-a23f17a236a0/ioc",
        "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
        "https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Education",
            "Healthcare",
            "Telecommunications",
            "Technology",
            "Government"
          ],
          "unique_indicators": 10754
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/hs-scripts.com",
    "whois": "http://whois.domaintools.com/hs-scripts.com",
    "domain": "hs-scripts.com",
    "hostname": "js.hs-scripts.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "67d9aa3446a826d09e3fcbd1",
      "name": "SSL [.] com - (Unenriched)",
      "description": "Analysis of phishing domain/service - ssl dot com\n\nUpdated 04.09.25: was able to pull IOCs from graph (vT): https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark",
      "modified": "2025-05-08T21:00:41.641000",
      "created": "2025-03-18T17:15:32.007000",
      "tags": [
        "malware",
        "virus",
        "trojan",
        "ransomware",
        "static",
        "analysis",
        "indicator of compromise",
        "ioc",
        "extraction",
        "emulation",
        "online",
        "submit",
        "sample",
        "download",
        "platform",
        "sandbox",
        "vxstream",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "javascript",
        "ansi",
        "pcap processing",
        "pcap",
        "prefetch8 ansi",
        "united",
        "date",
        "threat level",
        "show process",
        "hash seen",
        "programfiles",
        "win64",
        "comspec",
        "suspicious",
        "model",
        "hybrid",
        "close",
        "click",
        "hosts",
        "service",
        "general",
        "path",
        "encrypt",
        "strings",
        "contact",
        "SSL"
      ],
      "references": [
        "https://www.filescan.io/uploads/67d9a1b50a7899f3579c2e15/reports/e94f370c-9b21-4fc7-be6d-a23f17a236a0/ioc",
        "https://hybrid-analysis.com/sample/225749540c7c585ae4567062cfb85980f0966cc3386540b5259471b8e2e5315e",
        "https://www.virustotal.com/gui/domain/ssl.com/details",
        "https://hybrid-analysis.com/sample/225749540c7c585ae4567062cfb85980f0966cc3386540b5259471b8e2e5315e/67d9a21c369b542db10921d1",
        "https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark",
        "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c",
        "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c/iocs",
        "https://www.virustotal.com/gui/collection/9ba080a708abedd7a118bdc24ce5cf5d842d87a86b89b9cc2191afe0f0d4231c/summary",
        "https://metadefender.com/results/url/aHR0cDovL3NzbC5jb20=",
        "https://pastebin.com/yYxyUWra - 03.18.25 = Paste to CERT Related Pulses/References",
        "https://www.virustotal.com/graph/embed/ga5becca9d0964040a5408d2de66d37952e5d92e7a3694941a8d11cc8bbf1fc94?theme=dark - 04.09.25"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Technology",
        "Education",
        "Government",
        "Telecommunications",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 39,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 218,
        "FileHash-MD5": 80,
        "FileHash-SHA1": 80,
        "FileHash-SHA256": 462,
        "domain": 31,
        "hostname": 225,
        "SSLCertFingerprint": 15,
        "email": 10
      },
      "indicator_count": 1121,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "389 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66b0fa3624bf0384e427f2e7",
      "name": "Tracking Domains 4.2 - 08.19.24",
      "description": "Tracking Domains detected by Privacy Badger Ext. on Microsoft Edge Browser (W11 Device) using Telus ISP (ASN852)\n*Not-Enriched (08.05.24): ~50,000 suggests IOCs by AlienVault\nFrom VT: 2 IPs hosted by 45090 (Shenzhen Tencent Computer Systems Company Limited) & 4611 (CNNIC member) seem to be the problem here 118[.]89.204.198, 118[.]89.0.0/16 & 202[.]123.107.15, 202[.]123.107.0/24 (Respectively)",
      "modified": "2024-09-04T15:01:01.432000",
      "created": "2024-08-05T16:13:42.563000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
        "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
        "https://viz.greynoise.io/query/AS4611",
        "https://urlscan.io/asn/AS4611",
        "https://urlscan.io/search/#asn:%22AS4611%22",
        "https://urlscan.io/asn/AS45090",
        "https://urlscan.io/search/#asn%3A%22AS45090%22",
        "https://viz.greynoise.io/query/AS45090",
        "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
        "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
        "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
        "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6180,
        "FileHash-MD5": 1,
        "domain": 24921,
        "URL": 10854
      },
      "indicator_count": 41956,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "635 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "http://js.hs-scripts.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "http://js.hs-scripts.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780373818.1100867
}