{
  "type": "URL",
  "indicator": "https://3.bookingyourrooms.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://3.bookingyourrooms.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4102699805,
      "indicator": "https://3.bookingyourrooms.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68858e8244c8db854e8947c1",
          "name": "Goodreads Malware",
          "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
          "modified": "2025-08-26T01:03:19.405000",
          "created": "2025-07-27T02:27:14.517000",
          "tags": [
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "ip address",
            "related nids",
            "files location",
            "united",
            "flag united",
            "present jun",
            "present may",
            "present apr",
            "search",
            "moved",
            "creation date",
            "record value",
            "date",
            "body",
            "meta",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "memcommit",
            "value1",
            "partnerid4146",
            "username",
            "gamesessionid",
            "port",
            "destination",
            "regsetvalueexa",
            "mozilla",
            "write",
            "persistence",
            "execution",
            "malware",
            "copy",
            "next",
            "process32nextw",
            "show",
            "entries",
            "module load",
            "t1129",
            "intel",
            "ms windows",
            "showing",
            "t1045",
            "win32",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "size",
            "pattern match",
            "ascii text",
            "null",
            "error",
            "starfield",
            "click",
            "hybrid",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "smbds ipc",
            "ms17010",
            "msf style",
            "probe ms17010",
            "generic flags",
            "yara detections",
            "nrv2x",
            "upxoepplace"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 155,
            "hostname": 1237,
            "FileHash-SHA256": 1141,
            "domain": 574,
            "URL": 4593,
            "FileHash-SHA1": 139,
            "email": 1,
            "SSLCertFingerprint": 8
          },
          "indicator_count": 7848,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "236 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68851d56edbe226314c31445",
          "name": "LinuxTsunami - Mirai_Botnet_Malware",
          "description": "[EXE:CPUByteOrder - Little endian]\n\u2022 ELF:Mirai-APD\\ [Trj]\n\u2022 Unix.Trojan.Mirai-1\nIDS Detections: SUSPICIOUS Path to BusyBox TELNET login failed ||\n\u2022 Yara Detections: Mirai_Botnet_Malware ,  SUSP_XORed_Mozilla ,  is__elf ,  Linux_Mirai Alerts dead_host network_icmp tcp_syn_scan nolookup_communication writes_to_stdout ||\n\nInteresting: 162.93.126.142\nLocation: \nUnited States of America\n[ASN:  AS6949 charles schwab & co inc]\n*Unix.Trojan.Mirai-1\n\nAssociated Files: [5e2b1e9f7aa3dbfe8494a1ffd30e8a552f06d47f03e8ce17d4fb3b63c67991a1] \u2022 ELF:Mirai-APD\\ [Trj]\t\t\u2022 Unix.Trojan.Mirai-1 || 5\n\u2022 Backdoor:Linux/Tsunami.C!MTB\nIDS Detections:\nIRC Nick change on non-standard port\nTeamTNT IRC Bot Joining Channel\nIRC Channel JOIN on non-standard port\nIRC authorization message\nYara Detections:\nis__elf ||\n\nLinuxTsunami\nAlerts: \nnetwork_irc\nnolookup_communication\nIP\u2019s Contacted:\n194.31.98.17\nDomains Contacted:\nc6a7d807.vpn.njalla.net\n#hackers #lawfirms #mirai #botnets #remote_control #quasi",
          "modified": "2025-08-25T17:00:22.985000",
          "created": "2025-07-26T18:24:22.495000",
          "tags": [
            "pulse",
            "http",
            "ip address",
            "passive dns",
            "related nids",
            "urls",
            "files location",
            "czechia flag",
            "czechia related",
            "pulses otx",
            "ipv4 add",
            "pulse pulses",
            "files",
            "hosting",
            "czechia asn",
            "as2118",
            "pulses",
            "related tags",
            "port",
            "destination",
            "light",
            "high",
            "tcp syn",
            "meerkat",
            "resolverror",
            "yara detections",
            "malware",
            "icmp traffic",
            "path",
            "copy",
            "pv4 add",
            "pulse submit",
            "url analysis",
            "location united",
            "america flag",
            "united",
            "america asn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "learn",
            "spawns",
            "command",
            "found",
            "defense evasion",
            "t1480 execution",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "mitre att",
            "show technique",
            "null",
            "refresh",
            "body",
            "span",
            "hybrid",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "google safe",
            "browsing",
            "windows error",
            "april",
            "october",
            "september",
            "sandbox reports",
            "rejectedfailed",
            "timestamp input",
            "message status",
            "actions april",
            "june",
            "august",
            "july",
            "internal error",
            "entries",
            "show",
            "search",
            "backdoor",
            "teamtnt irc",
            "bot joining",
            "intel",
            "notice",
            "irc server",
            "tsunami",
            "domain",
            "creation date",
            "privacy inc",
            "customer",
            "domain add",
            "p address",
            "process details",
            "domains",
            "a domains",
            "script urls",
            "date",
            "status",
            "meta",
            "ov ssl",
            "record value",
            "showing",
            "certificate",
            "hostname add",
            "present may",
            "present jun",
            "present oct",
            "present jul",
            "present mar",
            "present nov",
            "present sep",
            "present feb",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 73,
            "FileHash-SHA1": 77,
            "FileHash-SHA256": 404,
            "URL": 647,
            "domain": 124,
            "hostname": 487,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 1816,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "237 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6882b365b45b9c6ee0eb7abc",
          "name": "Mold and Water Damage | Botnet - every search will remit false results",
          "description": "Mold and Water Damage | Botnet - every search will remit false results. In this instance it was a lawfirm. https://www.wshblaw.com/\n#malware #packed #botnetresults #likely #botnettester",
          "modified": "2025-08-23T20:02:25.025000",
          "created": "2025-07-24T22:27:49.105000",
          "tags": [
            "redacted for",
            "name servers",
            "united",
            "date",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "unknown",
            "etpro trojan",
            "possible virut",
            "dga nxdomain",
            "responses",
            "entries",
            "search",
            "read c",
            "show",
            "read",
            "win32",
            "copy",
            "write",
            "malware",
            "next",
            "files ip",
            "address",
            "date hash",
            "domain related",
            "showing",
            "ip address",
            "ip related",
            "pulses none",
            "related tags",
            "none indicator",
            "facts domain",
            "poland unknown",
            "aaaa",
            "present apr",
            "domain add",
            "pulse pulses",
            "windows",
            "windows nt",
            "medium",
            "high",
            "cnc beacon",
            "trojan",
            "present may",
            "present jun",
            "present sep",
            "present nov",
            "present feb",
            "present aug",
            "present oct",
            "backdoor",
            "msil",
            "united kingdom",
            "great britain",
            "susp",
            "win64",
            "content type",
            "trojandropper",
            "worm",
            "ransom",
            "expiration",
            "no expiration",
            "hostname",
            "url http",
            "embeddedwb",
            "shellexecuteexw",
            "whitelisted",
            "msie",
            "service",
            "cloud",
            "hostname add",
            "extraction",
            "data upload",
            "enter soukue",
            "url uk",
            "teukau",
            "drup uk",
            "drows type",
            "extre",
            "include review",
            "exclude sugges",
            "find",
            "a domains",
            "gmt content",
            "ipv4 add",
            "canada unknown",
            "meta",
            "cloudflare",
            "status",
            "span",
            "reverse dns",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "body",
            "apache",
            "delete",
            "ukraine",
            "registrar",
            "creation date",
            "servers",
            "present jul",
            "self",
            "date tue",
            "gmt server",
            "expires wed",
            "apache vary",
            "server google",
            "tag manager",
            "gmt etag",
            "acceptranges",
            "contentlength",
            "pragma",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "itre att",
            "unicode text",
            "utf8 text",
            "crlf",
            "lf line",
            "copy md5",
            "sha1",
            "copy sha1",
            "sha256",
            "copy sha256",
            "size",
            "truetype",
            "ascii text",
            "pattern match",
            "mitre att",
            "format",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "strings"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1326,
            "URL": 3745,
            "domain": 778,
            "email": 2,
            "FileHash-SHA256": 2360,
            "FileHash-MD5": 355,
            "FileHash-SHA1": 347,
            "SSLCertFingerprint": 3,
            "CVE": 1
          },
          "indicator_count": 8917,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "238 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 18310
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/bookingyourrooms.com",
    "whois": "http://whois.domaintools.com/bookingyourrooms.com",
    "domain": "bookingyourrooms.com",
    "hostname": "3.bookingyourrooms.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68858e8244c8db854e8947c1",
      "name": "Goodreads Malware",
      "description": "Goodreads is an older book review website. I found  Goodreads[.]com links botnet joining Pulse. Just curious. #goodreads #malware #goodreads_botnet_join #thismightbeabotnet\n#gogray #purpleteamit #malware \n#thismightbeabotnet #ineedtolearnmore",
      "modified": "2025-08-26T01:03:19.405000",
      "created": "2025-07-27T02:27:14.517000",
      "tags": [
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "ip address",
        "related nids",
        "files location",
        "united",
        "flag united",
        "present jun",
        "present may",
        "present apr",
        "search",
        "moved",
        "creation date",
        "record value",
        "date",
        "body",
        "meta",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "memcommit",
        "value1",
        "partnerid4146",
        "username",
        "gamesessionid",
        "port",
        "destination",
        "regsetvalueexa",
        "mozilla",
        "write",
        "persistence",
        "execution",
        "malware",
        "copy",
        "next",
        "process32nextw",
        "show",
        "entries",
        "module load",
        "t1129",
        "intel",
        "ms windows",
        "showing",
        "t1045",
        "win32",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "size",
        "pattern match",
        "ascii text",
        "null",
        "error",
        "starfield",
        "click",
        "hybrid",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "smbds ipc",
        "ms17010",
        "msf style",
        "probe ms17010",
        "generic flags",
        "yara detections",
        "nrv2x",
        "upxoepplace"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 155,
        "hostname": 1237,
        "FileHash-SHA256": 1141,
        "domain": 574,
        "URL": 4593,
        "FileHash-SHA1": 139,
        "email": 1,
        "SSLCertFingerprint": 8
      },
      "indicator_count": 7848,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "236 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68851d56edbe226314c31445",
      "name": "LinuxTsunami - Mirai_Botnet_Malware",
      "description": "[EXE:CPUByteOrder - Little endian]\n\u2022 ELF:Mirai-APD\\ [Trj]\n\u2022 Unix.Trojan.Mirai-1\nIDS Detections: SUSPICIOUS Path to BusyBox TELNET login failed ||\n\u2022 Yara Detections: Mirai_Botnet_Malware ,  SUSP_XORed_Mozilla ,  is__elf ,  Linux_Mirai Alerts dead_host network_icmp tcp_syn_scan nolookup_communication writes_to_stdout ||\n\nInteresting: 162.93.126.142\nLocation: \nUnited States of America\n[ASN:  AS6949 charles schwab & co inc]\n*Unix.Trojan.Mirai-1\n\nAssociated Files: [5e2b1e9f7aa3dbfe8494a1ffd30e8a552f06d47f03e8ce17d4fb3b63c67991a1] \u2022 ELF:Mirai-APD\\ [Trj]\t\t\u2022 Unix.Trojan.Mirai-1 || 5\n\u2022 Backdoor:Linux/Tsunami.C!MTB\nIDS Detections:\nIRC Nick change on non-standard port\nTeamTNT IRC Bot Joining Channel\nIRC Channel JOIN on non-standard port\nIRC authorization message\nYara Detections:\nis__elf ||\n\nLinuxTsunami\nAlerts: \nnetwork_irc\nnolookup_communication\nIP\u2019s Contacted:\n194.31.98.17\nDomains Contacted:\nc6a7d807.vpn.njalla.net\n#hackers #lawfirms #mirai #botnets #remote_control #quasi",
      "modified": "2025-08-25T17:00:22.985000",
      "created": "2025-07-26T18:24:22.495000",
      "tags": [
        "pulse",
        "http",
        "ip address",
        "passive dns",
        "related nids",
        "urls",
        "files location",
        "czechia flag",
        "czechia related",
        "pulses otx",
        "ipv4 add",
        "pulse pulses",
        "files",
        "hosting",
        "czechia asn",
        "as2118",
        "pulses",
        "related tags",
        "port",
        "destination",
        "light",
        "high",
        "tcp syn",
        "meerkat",
        "resolverror",
        "yara detections",
        "malware",
        "icmp traffic",
        "path",
        "copy",
        "pv4 add",
        "pulse submit",
        "url analysis",
        "location united",
        "america flag",
        "united",
        "america asn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "learn",
        "spawns",
        "command",
        "found",
        "defense evasion",
        "t1480 execution",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "mitre att",
        "show technique",
        "null",
        "refresh",
        "body",
        "span",
        "hybrid",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "google safe",
        "browsing",
        "windows error",
        "april",
        "october",
        "september",
        "sandbox reports",
        "rejectedfailed",
        "timestamp input",
        "message status",
        "actions april",
        "june",
        "august",
        "july",
        "internal error",
        "entries",
        "show",
        "search",
        "backdoor",
        "teamtnt irc",
        "bot joining",
        "intel",
        "notice",
        "irc server",
        "tsunami",
        "domain",
        "creation date",
        "privacy inc",
        "customer",
        "domain add",
        "p address",
        "process details",
        "domains",
        "a domains",
        "script urls",
        "date",
        "status",
        "meta",
        "ov ssl",
        "record value",
        "showing",
        "certificate",
        "hostname add",
        "present may",
        "present jun",
        "present oct",
        "present jul",
        "present mar",
        "present nov",
        "present sep",
        "present feb",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 73,
        "FileHash-SHA1": 77,
        "FileHash-SHA256": 404,
        "URL": 647,
        "domain": 124,
        "hostname": 487,
        "CVE": 1,
        "email": 3
      },
      "indicator_count": 1816,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "237 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6882b365b45b9c6ee0eb7abc",
      "name": "Mold and Water Damage | Botnet - every search will remit false results",
      "description": "Mold and Water Damage | Botnet - every search will remit false results. In this instance it was a lawfirm. https://www.wshblaw.com/\n#malware #packed #botnetresults #likely #botnettester",
      "modified": "2025-08-23T20:02:25.025000",
      "created": "2025-07-24T22:27:49.105000",
      "tags": [
        "redacted for",
        "name servers",
        "united",
        "date",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "unknown",
        "etpro trojan",
        "possible virut",
        "dga nxdomain",
        "responses",
        "entries",
        "search",
        "read c",
        "show",
        "read",
        "win32",
        "copy",
        "write",
        "malware",
        "next",
        "files ip",
        "address",
        "date hash",
        "domain related",
        "showing",
        "ip address",
        "ip related",
        "pulses none",
        "related tags",
        "none indicator",
        "facts domain",
        "poland unknown",
        "aaaa",
        "present apr",
        "domain add",
        "pulse pulses",
        "windows",
        "windows nt",
        "medium",
        "high",
        "cnc beacon",
        "trojan",
        "present may",
        "present jun",
        "present sep",
        "present nov",
        "present feb",
        "present aug",
        "present oct",
        "backdoor",
        "msil",
        "united kingdom",
        "great britain",
        "susp",
        "win64",
        "content type",
        "trojandropper",
        "worm",
        "ransom",
        "expiration",
        "no expiration",
        "hostname",
        "url http",
        "embeddedwb",
        "shellexecuteexw",
        "whitelisted",
        "msie",
        "service",
        "cloud",
        "hostname add",
        "extraction",
        "data upload",
        "enter soukue",
        "url uk",
        "teukau",
        "drup uk",
        "drows type",
        "extre",
        "include review",
        "exclude sugges",
        "find",
        "a domains",
        "gmt content",
        "ipv4 add",
        "canada unknown",
        "meta",
        "cloudflare",
        "status",
        "span",
        "reverse dns",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "body",
        "apache",
        "delete",
        "ukraine",
        "registrar",
        "creation date",
        "servers",
        "present jul",
        "self",
        "date tue",
        "gmt server",
        "expires wed",
        "apache vary",
        "server google",
        "tag manager",
        "gmt etag",
        "acceptranges",
        "contentlength",
        "pragma",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "itre att",
        "unicode text",
        "utf8 text",
        "crlf",
        "lf line",
        "copy md5",
        "sha1",
        "copy sha1",
        "sha256",
        "copy sha256",
        "size",
        "truetype",
        "ascii text",
        "pattern match",
        "mitre att",
        "format",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "strings"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1326,
        "URL": 3745,
        "domain": 778,
        "email": 2,
        "FileHash-SHA256": 2360,
        "FileHash-MD5": 355,
        "FileHash-SHA1": 347,
        "SSLCertFingerprint": 3,
        "CVE": 1
      },
      "indicator_count": 8917,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "238 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://3.bookingyourrooms.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://3.bookingyourrooms.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776628327.6720734
}