{
  "type": "URL",
  "indicator": "https://3b1027e.apps.presencelearning.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://3b1027e.apps.presencelearning.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3783948761,
      "indicator": "https://3b1027e.apps.presencelearning.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "658481716d9034bb0d52212d",
          "name": "Apple Attack | Floxif Spyware | Threat Network | Virus Network",
          "description": "Threat Network affecting and/or originating from Apple server. Malware attacks apple airpods, tv, apple store\napple trade, apple tv\napple watch, apple card, apple og?, apple server.\nSystemUpdate.dll issue. Device may partially attempt, device will show latest update, com[promised devices may have throttled update on attempt.\n\nFloxif:\nShort bio\nTrojan.Floxif is Malwarebytes\u2019 detection name for a file-changing Trojanthat targets Windows systems.\n\nSymptoms\nTrojan.Floxif can change legitimate files into infected files. Then the infected files act as a backdoor, giving the threat actor control over the machine.\n\nStaged data. Floxif primarily target Windows, Apple is less vulnerable to buy can be experience a Floxif attack.",
          "modified": "2024-01-20T14:03:29.247000",
          "created": "2023-12-21T18:18:25.746000",
          "tags": [
            "bitrep",
            "learn",
            "apple card",
            "apple",
            "apple store",
            "apple tv",
            "watch vision",
            "airpods tv",
            "apple watch",
            "buy apple",
            "apple trade",
            "footer",
            "media",
            "find",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malicious site",
            "hostname",
            "hostnames",
            "detection list",
            "blacklist",
            "malware",
            "alexa",
            "ip address",
            "whois record",
            "ssl certificate",
            "iocs",
            "whois whois",
            "historical ssl",
            "communicating",
            "threat network",
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "attack",
            "probe",
            "search",
            "threat",
            "paste",
            "contacted",
            "april",
            "threat roundup",
            "pe resource",
            "lcid1033",
            "smlen",
            "spn647",
            "bv6fet56ww",
            "february",
            "core",
            "name verdict",
            "falcon sandbox",
            "threat analyzer",
            "samples",
            "generic malware",
            "tag count",
            "malware generic",
            "tue dec",
            "threat report",
            "summary",
            "first",
            "http response",
            "final url",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "self",
            "server apple",
            "connection",
            "html info",
            "title apple",
            "meta tags",
            "indextab og",
            "apple og",
            "spyware",
            "plugins",
            "cab",
            "fraud urls",
            "data collection",
            "staged data",
            "privilege escalation",
            "defense evasion",
            "evasive",
            "stealthy",
            "serial number",
            "symantec time",
            "stamping",
            "algorithm",
            "thumbprint",
            "from",
            "symantec sha256",
            "sha256 code",
            "signing ca",
            "class",
            "vhash",
            "authentihash",
            "imphash",
            "rich pe",
            "ssdeep",
            "file type",
            "win32 dll",
            "magic pe32",
            "intel",
            "ms windows",
            "compiler",
            "vs2008",
            "rticon english",
            "vs2005",
            "chi2",
            "contained",
            "info compiler",
            "products",
            "header target",
            "machine intel",
            "utc entry",
            "floxif",
            "serving ip",
            "address",
            "headers nel",
            "dynamic expires",
            "gmt server",
            "file sharing",
            "personal data"
          ],
          "references": [
            "https://www.apple.com/qtactivex/qtplugin.cab",
            "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]",
            "http://www.screensaver.com/ruxitbeacon",
            "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]",
            "http://dns1.whitelist.camect.com    [interesting]",
            "https://www.jbits.courts.state.co    [interesting]",
            "http://www.sos.state.co/                   [interesting]",
            "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary",
            "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary",
            "Crowdsourced YARA  Rulesets",
            "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems",
            "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security",
            "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth",
            "https://www.malwarebytes.com/blog/detections/trojan-floxif",
            "20.190.160.2         Microsoft  [exploit_source]",
            "20.190.160.67       Microsoft  [exploit_source]",
            "20.190.160.73       Microsoft  [exploit_source]",
            "watson.events.data.microsoft.com      [traffic manager]",
            "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181.   [stack hash]",
            "watson.telemetry.microsoft.us   [Data traffic manager]",
            "www.anyxxxtube.net [tracking]",
            "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Apple",
              "display_name": "Apple",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 609,
            "FileHash-SHA1": 361,
            "FileHash-SHA256": 1977,
            "domain": 460,
            "hostname": 992,
            "URL": 3115
          },
          "indicator_count": 7514,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655a13e4538e896c00f2077e",
          "name": "Spyware: http://browser.events.data.microsoftstart.cn",
          "description": "This report is generated by MITRE ATT&CK\u2122 and produced by the team at the University of California, San Francisco, and is available on the web, via the Microsoft Research website.\nTulach, 114.114.114.114, spyware, phishing, fraud, malvertizing, password cracker, iPhone unlocker, malicious, media sharing, miscellaneous attacks.",
          "modified": "2023-12-19T13:01:12.394000",
          "created": "2023-11-19T13:55:48.898000",
          "tags": [
            "linkid246338",
            "whois record",
            "ssl certificate",
            "contacted",
            "execution",
            "historical ssl",
            "whois whois",
            "communicating",
            "resolutions",
            "referrer",
            "random",
            "august",
            "lockbit",
            "attack",
            "core",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "done adding",
            "catalog file",
            "authority",
            "class",
            "mitre att",
            "script",
            "temp",
            "ascii text",
            "date",
            "unknown",
            "service",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "local",
            "click",
            "strings",
            "threat roundup"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 34,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2526,
            "URL": 3515,
            "domain": 458,
            "hostname": 1092
          },
          "indicator_count": 7653,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655af35616dbd4781c681948",
          "name": "Spyware: http://browser.events.data.microsoftstart.cn",
          "description": "",
          "modified": "2023-12-19T13:01:12.394000",
          "created": "2023-11-20T05:49:10.586000",
          "tags": [
            "linkid246338",
            "whois record",
            "ssl certificate",
            "contacted",
            "execution",
            "historical ssl",
            "whois whois",
            "communicating",
            "resolutions",
            "referrer",
            "random",
            "august",
            "lockbit",
            "attack",
            "core",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "root ca",
            "done adding",
            "catalog file",
            "authority",
            "class",
            "mitre att",
            "script",
            "temp",
            "ascii text",
            "date",
            "unknown",
            "service",
            "generator",
            "critical",
            "error",
            "meta",
            "hybrid",
            "local",
            "click",
            "strings",
            "threat roundup"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655a13e4538e896c00f2077e",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 34,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2526,
            "URL": 3515,
            "domain": 458,
            "hostname": 1092
          },
          "indicator_count": 7653,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]",
        "www.anyxxxtube.net [tracking]",
        "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]",
        "watson.events.data.microsoft.com      [traffic manager]",
        "http://www.sos.state.co/                   [interesting]",
        "https://www.apple.com/qtactivex/qtplugin.cab",
        "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security",
        "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems",
        "http://www.screensaver.com/ruxitbeacon",
        "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181.   [stack hash]",
        "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]",
        "20.190.160.73       Microsoft  [exploit_source]",
        "http://dns1.whitelist.camect.com    [interesting]",
        "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary",
        "20.190.160.2         Microsoft  [exploit_source]",
        "Crowdsourced YARA  Rulesets",
        "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad",
        "watson.telemetry.microsoft.us   [Data traffic manager]",
        "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary",
        "https://www.malwarebytes.com/blog/detections/trojan-floxif",
        "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth",
        "https://www.jbits.courts.state.co    [interesting]",
        "20.190.160.67       Microsoft  [exploit_source]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Apple",
            "Malware",
            "Tulach"
          ],
          "industries": [],
          "unique_indicators": 14754
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/presencelearning.com",
    "whois": "http://whois.domaintools.com/presencelearning.com",
    "domain": "presencelearning.com",
    "hostname": "3b1027e.apps.presencelearning.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "658481716d9034bb0d52212d",
      "name": "Apple Attack | Floxif Spyware | Threat Network | Virus Network",
      "description": "Threat Network affecting and/or originating from Apple server. Malware attacks apple airpods, tv, apple store\napple trade, apple tv\napple watch, apple card, apple og?, apple server.\nSystemUpdate.dll issue. Device may partially attempt, device will show latest update, com[promised devices may have throttled update on attempt.\n\nFloxif:\nShort bio\nTrojan.Floxif is Malwarebytes\u2019 detection name for a file-changing Trojanthat targets Windows systems.\n\nSymptoms\nTrojan.Floxif can change legitimate files into infected files. Then the infected files act as a backdoor, giving the threat actor control over the machine.\n\nStaged data. Floxif primarily target Windows, Apple is less vulnerable to buy can be experience a Floxif attack.",
      "modified": "2024-01-20T14:03:29.247000",
      "created": "2023-12-21T18:18:25.746000",
      "tags": [
        "bitrep",
        "learn",
        "apple card",
        "apple",
        "apple store",
        "apple tv",
        "watch vision",
        "airpods tv",
        "apple watch",
        "buy apple",
        "apple trade",
        "footer",
        "media",
        "find",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malicious site",
        "hostname",
        "hostnames",
        "detection list",
        "blacklist",
        "malware",
        "alexa",
        "ip address",
        "whois record",
        "ssl certificate",
        "iocs",
        "whois whois",
        "historical ssl",
        "communicating",
        "threat network",
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "attack",
        "probe",
        "search",
        "threat",
        "paste",
        "contacted",
        "april",
        "threat roundup",
        "pe resource",
        "lcid1033",
        "smlen",
        "spn647",
        "bv6fet56ww",
        "february",
        "core",
        "name verdict",
        "falcon sandbox",
        "threat analyzer",
        "samples",
        "generic malware",
        "tag count",
        "malware generic",
        "tue dec",
        "threat report",
        "summary",
        "first",
        "http response",
        "final url",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "self",
        "server apple",
        "connection",
        "html info",
        "title apple",
        "meta tags",
        "indextab og",
        "apple og",
        "spyware",
        "plugins",
        "cab",
        "fraud urls",
        "data collection",
        "staged data",
        "privilege escalation",
        "defense evasion",
        "evasive",
        "stealthy",
        "serial number",
        "symantec time",
        "stamping",
        "algorithm",
        "thumbprint",
        "from",
        "symantec sha256",
        "sha256 code",
        "signing ca",
        "class",
        "vhash",
        "authentihash",
        "imphash",
        "rich pe",
        "ssdeep",
        "file type",
        "win32 dll",
        "magic pe32",
        "intel",
        "ms windows",
        "compiler",
        "vs2008",
        "rticon english",
        "vs2005",
        "chi2",
        "contained",
        "info compiler",
        "products",
        "header target",
        "machine intel",
        "utc entry",
        "floxif",
        "serving ip",
        "address",
        "headers nel",
        "dynamic expires",
        "gmt server",
        "file sharing",
        "personal data"
      ],
      "references": [
        "https://www.apple.com/qtactivex/qtplugin.cab",
        "https://www.hybrid-analysis.com/sample/f9fab0bda2e82393cdcbb235dd41b48e00552116101deb0215bc64032741dcad",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/. [ phishing, driver, malvertizing, targeting]",
        "http://www.screensaver.com/ruxitbeacon",
        "https://otx.alienvault.com/indicator/hostname/ac-netstorage.apple.com [front facing withu4ever.com dating app/fraud service stores Apple data]",
        "http://dns1.whitelist.camect.com    [interesting]",
        "https://www.jbits.courts.state.co    [interesting]",
        "http://www.sos.state.co/                   [interesting]",
        "https://www.virustotal.com/gui/file/b883f5fab23c459f41dee72e3f89fc19734fa2f505cb5bee192960f4a0f94062/summary",
        "https://www.virustotal.com/gui/url/2cb82dbaba5c1a7ea415992f28e2d35d06187a8cfc59691b43c1589e072b2c24/summary",
        "Crowdsourced YARA  Rulesets",
        "Matches rule Malware_Floxif_mpsvc_dll from ruleset gen_floxif by Florian Roth (Nextron Systems",
        "Matches rule Windows_Virus_Floxif_493d1897 from ruleset Windows_Virus_Floxif by Elastic Security",
        "Matches rule SUSP_XORed_MSDOS_Stub_Message from ruleset gen_xor_hunting by Florian Roth",
        "https://www.malwarebytes.com/blog/detections/trojan-floxif",
        "20.190.160.2         Microsoft  [exploit_source]",
        "20.190.160.67       Microsoft  [exploit_source]",
        "20.190.160.73       Microsoft  [exploit_source]",
        "watson.events.data.microsoft.com      [traffic manager]",
        "http://watson.microsoft.com/StageOne/rundll32_exe/6_1_7600_16385/4a5bc637StackHash_2264/0_0_0_0/00000000/c0000005/63df0a5b.htm?LCID=1033&OS=6.1.7601.2.00010100.1.0.1.17514&SM=LEN&SPN=647&BV=6FET56WW&MID=54046387-FC68-43CA-9068-077C0A157181.   [stack hash]",
        "watson.telemetry.microsoft.us   [Data traffic manager]",
        "www.anyxxxtube.net [tracking]",
        "https://shitting.takefile.link/4cgeojxano82/2375.Kty10122__scatting__Shit-Porn.net_.mp4.html [file sharing, personal network storage and backup]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Apple",
          "display_name": "Apple",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 609,
        "FileHash-SHA1": 361,
        "FileHash-SHA256": 1977,
        "domain": 460,
        "hostname": 992,
        "URL": 3115
      },
      "indicator_count": 7514,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655a13e4538e896c00f2077e",
      "name": "Spyware: http://browser.events.data.microsoftstart.cn",
      "description": "This report is generated by MITRE ATT&CK\u2122 and produced by the team at the University of California, San Francisco, and is available on the web, via the Microsoft Research website.\nTulach, 114.114.114.114, spyware, phishing, fraud, malvertizing, password cracker, iPhone unlocker, malicious, media sharing, miscellaneous attacks.",
      "modified": "2023-12-19T13:01:12.394000",
      "created": "2023-11-19T13:55:48.898000",
      "tags": [
        "linkid246338",
        "whois record",
        "ssl certificate",
        "contacted",
        "execution",
        "historical ssl",
        "whois whois",
        "communicating",
        "resolutions",
        "referrer",
        "random",
        "august",
        "lockbit",
        "attack",
        "core",
        "name verdict",
        "falcon sandbox",
        "pattern match",
        "root ca",
        "done adding",
        "catalog file",
        "authority",
        "class",
        "mitre att",
        "script",
        "temp",
        "ascii text",
        "date",
        "unknown",
        "service",
        "generator",
        "critical",
        "error",
        "meta",
        "hybrid",
        "local",
        "click",
        "strings",
        "threat roundup"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 34,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 2526,
        "URL": 3515,
        "domain": 458,
        "hostname": 1092
      },
      "indicator_count": 7653,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655af35616dbd4781c681948",
      "name": "Spyware: http://browser.events.data.microsoftstart.cn",
      "description": "",
      "modified": "2023-12-19T13:01:12.394000",
      "created": "2023-11-20T05:49:10.586000",
      "tags": [
        "linkid246338",
        "whois record",
        "ssl certificate",
        "contacted",
        "execution",
        "historical ssl",
        "whois whois",
        "communicating",
        "resolutions",
        "referrer",
        "random",
        "august",
        "lockbit",
        "attack",
        "core",
        "name verdict",
        "falcon sandbox",
        "pattern match",
        "root ca",
        "done adding",
        "catalog file",
        "authority",
        "class",
        "mitre att",
        "script",
        "temp",
        "ascii text",
        "date",
        "unknown",
        "service",
        "generator",
        "critical",
        "error",
        "meta",
        "hybrid",
        "local",
        "click",
        "strings",
        "threat roundup"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655a13e4538e896c00f2077e",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 34,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 2526,
        "URL": 3515,
        "domain": 458,
        "hostname": 1092
      },
      "indicator_count": 7653,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://3b1027e.apps.presencelearning.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://3b1027e.apps.presencelearning.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776628029.1839037
}