{
  "type": "URL",
  "indicator": "https://2.intelx.io/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://2.intelx.io/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3777135699,
      "indicator": "https://2.intelx.io/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "660b176a98b0c92ba5a962bc",
          "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
          "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
          "modified": "2024-09-04T05:01:56.993000",
          "created": "2024-04-01T20:22:02.851000",
          "tags": [
            "BEC"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
            "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
            "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
            "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
            "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 233,
            "FileHash-SHA1": 230,
            "FileHash-SHA256": 6703,
            "URL": 4450,
            "CIDR": 3,
            "domain": 6223,
            "hostname": 2863,
            "email": 7,
            "CVE": 53
          },
          "indicator_count": 20765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "634 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66a93c8f75886d2d79470aae",
          "name": "dosdean[@]ualberta[.]ca breach and leak of PII - [CA]54[.]39[.]36[.]60.rar/Important Files/Profile/Desktop/CA.txt",
          "description": "dosdean[@]ualberta[.]ca breach and leak of PII - [CA]54[.]39[.]36[.]60.rar/Important Files/Profile/Desktop/CA.txt\nThis collection is a puzzle piece outlining the what and where re: an unreported leak (detected with Intelligence X) by some leadership/admin folks\nhttps://intelx.io/?s=dosdean%40ualberta.ca\n07.30.24: https://www.virustotal.com/graph/embed/g5d1e9d5c08cc40108a8b683c12187fd93590ba8e2a614af3a045039b3f03f866?theme=dark",
          "modified": "2024-09-03T00:02:13.980000",
          "created": "2024-07-30T19:18:39.681000",
          "tags": [
            "please",
            "javascript",
            "entity",
            "ovh sas",
            "intelligence x",
            "results",
            "product blog",
            "login",
            "sign",
            "most relevant",
            "darknet",
            "please search",
            "search advanced",
            "categories date",
            "term",
            "slow",
            "scroll",
            "UAlberta"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/548c5a0005aa38898622757c81250a39ff50e3c9abc7c671954e169ea72f50be/summary",
            "https://www.virustotal.com/graph/embed/g5d1e9d5c08cc40108a8b683c12187fd93590ba8e2a614af3a045039b3f03f866?theme=dark",
            "https://www.virustotal.com/gui/collection/548c5a0005aa38898622757c81250a39ff50e3c9abc7c671954e169ea72f50be/iocs",
            "https://intelx.io/?s=dosdean%40ualberta.ca"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 2,
            "FileHash-MD5": 62,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 303,
            "URL": 36,
            "domain": 22,
            "hostname": 164,
            "CVE": 8
          },
          "indicator_count": 659,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "635 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f4d0c4cca0c5f58530600",
          "name": "BGP.Tools",
          "description": "BGP is a very malicious, developed spyware tool. Attorneys, insurance companies use tool. BGP  Hurricane. In the past they will call target and a modem connects draining ALL content. It can CNC device, erase everything from it, manipulate dropbox as well as other clouds.  Very destructive.Once you're a target your privacy is gone for good. Assertions from threat crowd that CISA/Valmet are government phishing entities concerns me. BGP gets a  100% malicious score. Listed as part of infrastructure is CISA. A familiar name in adult content and other commands, vulnerabilities,etc. I'm not sure what to believe, or what's going on.",
          "modified": "2023-11-29T05:05:42.592000",
          "created": "2023-10-30T06:28:28.160000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "whois whois",
            "communicating",
            "relacionada",
            "resolutions",
            "historical ssl",
            "collections new",
            "family",
            "lolkek",
            "dark power",
            "ransomware",
            "play ransomware",
            "makop",
            "core",
            "redline stealer",
            "hacktool",
            "emotet",
            "quasar rat",
            "wiper",
            "ursnif",
            "malware",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "self",
            "server",
            "date wed",
            "html info",
            "meta tags",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "ascii text",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "date",
            "unknown",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "njrat",
            "cobalt strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3631,
            "FileHash-MD5": 45,
            "FileHash-SHA1": 44,
            "FileHash-SHA256": 1788,
            "CVE": 5,
            "domain": 543,
            "hostname": 1328,
            "CIDR": 2,
            "email": 1
          },
          "indicator_count": 7387,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "914 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653fd47a852cc130c72de9e5",
          "name": "BGP.Tools",
          "description": "",
          "modified": "2023-11-29T05:05:42.592000",
          "created": "2023-10-30T16:06:18.567000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "whois whois",
            "communicating",
            "relacionada",
            "resolutions",
            "historical ssl",
            "collections new",
            "family",
            "lolkek",
            "dark power",
            "ransomware",
            "play ransomware",
            "makop",
            "core",
            "redline stealer",
            "hacktool",
            "emotet",
            "quasar rat",
            "wiper",
            "ursnif",
            "malware",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "self",
            "server",
            "date wed",
            "html info",
            "meta tags",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "ascii text",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "date",
            "unknown",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "njrat",
            "cobalt strike"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "653f4d0c4cca0c5f58530600",
          "export_count": 39,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3631,
            "FileHash-MD5": 45,
            "FileHash-SHA1": 44,
            "FileHash-SHA256": 1788,
            "CVE": 5,
            "domain": 543,
            "hostname": 1328,
            "CIDR": 2,
            "email": 1
          },
          "indicator_count": 7387,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "914 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate",
        "https://intelx.io/?s=dosdean%40ualberta.ca",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://www.virustotal.com/graph/embed/g5d1e9d5c08cc40108a8b683c12187fd93590ba8e2a614af3a045039b3f03f866?theme=dark",
        "https://www.virustotal.com/gui/collection/548c5a0005aa38898622757c81250a39ff50e3c9abc7c671954e169ea72f50be/summary",
        "https://www.virustotal.com/gui/collection/548c5a0005aa38898622757c81250a39ff50e3c9abc7c671954e169ea72f50be/iocs",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Government",
            "Technology",
            "Education"
          ],
          "unique_indicators": 13780
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/intelx.io",
    "whois": "http://whois.domaintools.com/intelx.io",
    "domain": "intelx.io",
    "hostname": "2.intelx.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "660b176a98b0c92ba5a962bc",
      "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
      "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
      "modified": "2024-09-04T05:01:56.993000",
      "created": "2024-04-01T20:22:02.851000",
      "tags": [
        "BEC"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 233,
        "FileHash-SHA1": 230,
        "FileHash-SHA256": 6703,
        "URL": 4450,
        "CIDR": 3,
        "domain": 6223,
        "hostname": 2863,
        "email": 7,
        "CVE": 53
      },
      "indicator_count": 20765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "634 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66a93c8f75886d2d79470aae",
      "name": "dosdean[@]ualberta[.]ca breach and leak of PII - [CA]54[.]39[.]36[.]60.rar/Important Files/Profile/Desktop/CA.txt",
      "description": "dosdean[@]ualberta[.]ca breach and leak of PII - [CA]54[.]39[.]36[.]60.rar/Important Files/Profile/Desktop/CA.txt\nThis collection is a puzzle piece outlining the what and where re: an unreported leak (detected with Intelligence X) by some leadership/admin folks\nhttps://intelx.io/?s=dosdean%40ualberta.ca\n07.30.24: https://www.virustotal.com/graph/embed/g5d1e9d5c08cc40108a8b683c12187fd93590ba8e2a614af3a045039b3f03f866?theme=dark",
      "modified": "2024-09-03T00:02:13.980000",
      "created": "2024-07-30T19:18:39.681000",
      "tags": [
        "please",
        "javascript",
        "entity",
        "ovh sas",
        "intelligence x",
        "results",
        "product blog",
        "login",
        "sign",
        "most relevant",
        "darknet",
        "please search",
        "search advanced",
        "categories date",
        "term",
        "slow",
        "scroll",
        "UAlberta"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/548c5a0005aa38898622757c81250a39ff50e3c9abc7c671954e169ea72f50be/summary",
        "https://www.virustotal.com/graph/embed/g5d1e9d5c08cc40108a8b683c12187fd93590ba8e2a614af3a045039b3f03f866?theme=dark",
        "https://www.virustotal.com/gui/collection/548c5a0005aa38898622757c81250a39ff50e3c9abc7c671954e169ea72f50be/iocs",
        "https://intelx.io/?s=dosdean%40ualberta.ca"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 2,
        "FileHash-MD5": 62,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 303,
        "URL": 36,
        "domain": 22,
        "hostname": 164,
        "CVE": 8
      },
      "indicator_count": 659,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "635 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f4d0c4cca0c5f58530600",
      "name": "BGP.Tools",
      "description": "BGP is a very malicious, developed spyware tool. Attorneys, insurance companies use tool. BGP  Hurricane. In the past they will call target and a modem connects draining ALL content. It can CNC device, erase everything from it, manipulate dropbox as well as other clouds.  Very destructive.Once you're a target your privacy is gone for good. Assertions from threat crowd that CISA/Valmet are government phishing entities concerns me. BGP gets a  100% malicious score. Listed as part of infrastructure is CISA. A familiar name in adult content and other commands, vulnerabilities,etc. I'm not sure what to believe, or what's going on.",
      "modified": "2023-11-29T05:05:42.592000",
      "created": "2023-10-30T06:28:28.160000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "whois whois",
        "communicating",
        "relacionada",
        "resolutions",
        "historical ssl",
        "collections new",
        "family",
        "lolkek",
        "dark power",
        "ransomware",
        "play ransomware",
        "makop",
        "core",
        "redline stealer",
        "hacktool",
        "emotet",
        "quasar rat",
        "wiper",
        "ursnif",
        "malware",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "self",
        "server",
        "date wed",
        "html info",
        "meta tags",
        "name verdict",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "ascii text",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "date",
        "unknown",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "njrat",
        "cobalt strike"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3631,
        "FileHash-MD5": 45,
        "FileHash-SHA1": 44,
        "FileHash-SHA256": 1788,
        "CVE": 5,
        "domain": 543,
        "hostname": 1328,
        "CIDR": 2,
        "email": 1
      },
      "indicator_count": 7387,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "914 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653fd47a852cc130c72de9e5",
      "name": "BGP.Tools",
      "description": "",
      "modified": "2023-11-29T05:05:42.592000",
      "created": "2023-10-30T16:06:18.567000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "whois whois",
        "communicating",
        "relacionada",
        "resolutions",
        "historical ssl",
        "collections new",
        "family",
        "lolkek",
        "dark power",
        "ransomware",
        "play ransomware",
        "makop",
        "core",
        "redline stealer",
        "hacktool",
        "emotet",
        "quasar rat",
        "wiper",
        "ursnif",
        "malware",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "self",
        "server",
        "date wed",
        "html info",
        "meta tags",
        "name verdict",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "ascii text",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "date",
        "unknown",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "njrat",
        "cobalt strike"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "653f4d0c4cca0c5f58530600",
      "export_count": 39,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3631,
        "FileHash-MD5": 45,
        "FileHash-SHA1": 44,
        "FileHash-SHA256": 1788,
        "CVE": 5,
        "domain": 543,
        "hostname": 1328,
        "CIDR": 2,
        "email": 1
      },
      "indicator_count": 7387,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "914 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://2.intelx.io/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://2.intelx.io/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780242853.917903
}