{
  "type": "URL",
  "indicator": "https://a.a3ion.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://a.a3ion.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3734828372,
      "indicator": "https://a.a3ion.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68d332d77a7eedf3ad71c406",
          "name": "Denizbankk.net \u2022  LevelBlue - Open Threat Exchange",
          "description": "Denizbankk.net \u2022 Debian.org \u2022 hallrender.com \u2022 alienvault.com \u2022 hopto.org \u2022 striven.com| ? | This is concerning. It\u2019s not like intended to find what I have found but I am disappointed. The few people on the platform who do their own research eventually leave with a large amount of reposters. Related to haallrendee, brian sabey and each link listed. Stange happenings this weak. [otx auto populated- Google Safe Browsing, Denizbankk.net, has been used by the Russian government to create a secure web address that can be accessed only if the user has the correct address.{",
          "modified": "2025-10-23T23:03:23.167000",
          "created": "2025-09-23T23:52:55.453000",
          "tags": [
            "log id",
            "gmtn",
            "tls web",
            "zerossl",
            "zerossl rsa",
            "domain secure",
            "site ca",
            "fa c7",
            "ocsp",
            "a167",
            "code",
            "keepalive",
            "false",
            "record type",
            "ttl a",
            "value",
            "o jarm",
            "fingerprint",
            "file format",
            "relevance",
            "united",
            "tempe",
            "arizona create",
            "domain",
            "expiry date",
            "name",
            "query time",
            "technical city",
            "tempe technical",
            "technical state",
            "rdap database",
            "handle",
            "iana registrar",
            "links",
            "algorithm",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl rsa",
            "validity",
            "server",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "registrar url",
            "registrar whois",
            "date",
            "available from",
            "country",
            "proxy",
            "postal code",
            "city",
            "admin city",
            "tempe admin",
            "filehashmd5",
            "url https",
            "filehashsha1",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashsha256",
            "showing",
            "germany unknown",
            "passive dns",
            "entries",
            "a domains",
            "body doctype",
            "content type",
            "gmt server",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "main",
            "apache",
            "accept",
            "title",
            "present dec",
            "present jun",
            "present nov",
            "aaaa",
            "present feb",
            "present sep",
            "search",
            "canada",
            "encrypt",
            "devam",
            "ad soyad",
            "mteri numaras",
            "gvenlik iin",
            "gizli soru",
            "gvenlik sorusu",
            "cevab",
            "ltfen bir",
            "present may",
            "moved",
            "present oct",
            "ip address",
            "gandi sas",
            "body",
            "backdoor",
            "next associated",
            "trojandropper",
            "fastly error",
            "please",
            "sea p",
            "twitter",
            "win32",
            "creation date",
            "name servers",
            "hostname add",
            "pulse pulses",
            "urls",
            "record value",
            "japan",
            "germany",
            "ipv4",
            "countries",
            "america",
            "netherlands",
            "italy",
            "brian sabey",
            "report spam",
            "tsara brashears",
            "created",
            "days ago",
            "green well",
            "sabey stash",
            "service",
            "hours ago",
            "malicious",
            "forbidden",
            "actionlistccc",
            "malware family",
            "mufanom att",
            "capture",
            "ck ids",
            "checkin",
            "t1036",
            "t1055",
            "injection",
            "t1056"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 617,
            "URL": 2495,
            "hostname": 1698,
            "FileHash-MD5": 275,
            "FileHash-SHA1": 265,
            "FileHash-SHA256": 1241,
            "SSLCertFingerprint": 2,
            "email": 4
          },
          "indicator_count": 6597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "221 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68d3368ae75cccf736a55441",
          "name": "ET TROJAN Hiloti/Mufanom Downloader Checkin | Denizbankk.net",
          "description": "",
          "modified": "2025-10-23T23:03:23.167000",
          "created": "2025-09-24T00:08:42.048000",
          "tags": [
            "log id",
            "gmtn",
            "tls web",
            "zerossl",
            "zerossl rsa",
            "domain secure",
            "site ca",
            "fa c7",
            "ocsp",
            "a167",
            "code",
            "keepalive",
            "false",
            "record type",
            "ttl a",
            "value",
            "o jarm",
            "fingerprint",
            "file format",
            "relevance",
            "united",
            "tempe",
            "arizona create",
            "domain",
            "expiry date",
            "name",
            "query time",
            "technical city",
            "tempe technical",
            "technical state",
            "rdap database",
            "handle",
            "iana registrar",
            "links",
            "algorithm",
            "key identifier",
            "data",
            "v3 serial",
            "number",
            "cat ozerossl",
            "cnzerossl rsa",
            "validity",
            "server",
            "domain name",
            "status",
            "abuse contact",
            "email",
            "registrar abuse",
            "contact phone",
            "registrar iana",
            "registrar url",
            "registrar whois",
            "date",
            "available from",
            "country",
            "proxy",
            "postal code",
            "city",
            "admin city",
            "tempe admin",
            "filehashmd5",
            "url https",
            "filehashsha1",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "filehashsha256",
            "showing",
            "germany unknown",
            "passive dns",
            "entries",
            "a domains",
            "body doctype",
            "content type",
            "gmt server",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "main",
            "apache",
            "accept",
            "title",
            "present dec",
            "present jun",
            "present nov",
            "aaaa",
            "present feb",
            "present sep",
            "search",
            "canada",
            "encrypt",
            "devam",
            "ad soyad",
            "mteri numaras",
            "gvenlik iin",
            "gizli soru",
            "gvenlik sorusu",
            "cevab",
            "ltfen bir",
            "present may",
            "moved",
            "present oct",
            "ip address",
            "gandi sas",
            "body",
            "backdoor",
            "next associated",
            "trojandropper",
            "fastly error",
            "please",
            "sea p",
            "twitter",
            "win32",
            "creation date",
            "name servers",
            "hostname add",
            "pulse pulses",
            "urls",
            "record value",
            "japan",
            "germany",
            "ipv4",
            "countries",
            "america",
            "netherlands",
            "italy",
            "brian sabey",
            "report spam",
            "tsara brashears",
            "created",
            "days ago",
            "green well",
            "sabey stash",
            "service",
            "hours ago",
            "malicious",
            "forbidden",
            "actionlistccc",
            "malware family",
            "mufanom att",
            "capture",
            "ck ids",
            "checkin",
            "t1036",
            "t1055",
            "injection",
            "t1056"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1448",
              "name": "Carrier Billing Fraud",
              "display_name": "T1448 - Carrier Billing Fraud"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "68d332d77a7eedf3ad71c406",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 617,
            "URL": 2495,
            "hostname": 1698,
            "FileHash-MD5": 275,
            "FileHash-SHA1": 265,
            "FileHash-SHA256": 1241,
            "SSLCertFingerprint": 2,
            "email": 4
          },
          "indicator_count": 6597,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "221 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64d15ddd28efbfbd3aee0b40",
          "name": "SEC.COM",
          "description": "",
          "modified": "2023-09-08T00:02:16.727000",
          "created": "2023-08-07T21:10:53.630000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 239,
            "domain": 123,
            "URL": 426,
            "FileHash-SHA256": 16
          },
          "indicator_count": 804,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 81,
          "modified_text": "998 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 6930
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/a3ion.com",
    "whois": "http://whois.domaintools.com/a3ion.com",
    "domain": "a3ion.com",
    "hostname": "a.a3ion.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68d332d77a7eedf3ad71c406",
      "name": "Denizbankk.net \u2022  LevelBlue - Open Threat Exchange",
      "description": "Denizbankk.net \u2022 Debian.org \u2022 hallrender.com \u2022 alienvault.com \u2022 hopto.org \u2022 striven.com| ? | This is concerning. It\u2019s not like intended to find what I have found but I am disappointed. The few people on the platform who do their own research eventually leave with a large amount of reposters. Related to haallrendee, brian sabey and each link listed. Stange happenings this weak. [otx auto populated- Google Safe Browsing, Denizbankk.net, has been used by the Russian government to create a secure web address that can be accessed only if the user has the correct address.{",
      "modified": "2025-10-23T23:03:23.167000",
      "created": "2025-09-23T23:52:55.453000",
      "tags": [
        "log id",
        "gmtn",
        "tls web",
        "zerossl",
        "zerossl rsa",
        "domain secure",
        "site ca",
        "fa c7",
        "ocsp",
        "a167",
        "code",
        "keepalive",
        "false",
        "record type",
        "ttl a",
        "value",
        "o jarm",
        "fingerprint",
        "file format",
        "relevance",
        "united",
        "tempe",
        "arizona create",
        "domain",
        "expiry date",
        "name",
        "query time",
        "technical city",
        "tempe technical",
        "technical state",
        "rdap database",
        "handle",
        "iana registrar",
        "links",
        "algorithm",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl rsa",
        "validity",
        "server",
        "domain name",
        "status",
        "abuse contact",
        "email",
        "registrar abuse",
        "contact phone",
        "registrar iana",
        "registrar url",
        "registrar whois",
        "date",
        "available from",
        "country",
        "proxy",
        "postal code",
        "city",
        "admin city",
        "tempe admin",
        "filehashmd5",
        "url https",
        "filehashsha1",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashsha256",
        "showing",
        "germany unknown",
        "passive dns",
        "entries",
        "a domains",
        "body doctype",
        "content type",
        "gmt server",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "main",
        "apache",
        "accept",
        "title",
        "present dec",
        "present jun",
        "present nov",
        "aaaa",
        "present feb",
        "present sep",
        "search",
        "canada",
        "encrypt",
        "devam",
        "ad soyad",
        "mteri numaras",
        "gvenlik iin",
        "gizli soru",
        "gvenlik sorusu",
        "cevab",
        "ltfen bir",
        "present may",
        "moved",
        "present oct",
        "ip address",
        "gandi sas",
        "body",
        "backdoor",
        "next associated",
        "trojandropper",
        "fastly error",
        "please",
        "sea p",
        "twitter",
        "win32",
        "creation date",
        "name servers",
        "hostname add",
        "pulse pulses",
        "urls",
        "record value",
        "japan",
        "germany",
        "ipv4",
        "countries",
        "america",
        "netherlands",
        "italy",
        "brian sabey",
        "report spam",
        "tsara brashears",
        "created",
        "days ago",
        "green well",
        "sabey stash",
        "service",
        "hours ago",
        "malicious",
        "forbidden",
        "actionlistccc",
        "malware family",
        "mufanom att",
        "capture",
        "ck ids",
        "checkin",
        "t1036",
        "t1055",
        "injection",
        "t1056"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 617,
        "URL": 2495,
        "hostname": 1698,
        "FileHash-MD5": 275,
        "FileHash-SHA1": 265,
        "FileHash-SHA256": 1241,
        "SSLCertFingerprint": 2,
        "email": 4
      },
      "indicator_count": 6597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "221 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68d3368ae75cccf736a55441",
      "name": "ET TROJAN Hiloti/Mufanom Downloader Checkin | Denizbankk.net",
      "description": "",
      "modified": "2025-10-23T23:03:23.167000",
      "created": "2025-09-24T00:08:42.048000",
      "tags": [
        "log id",
        "gmtn",
        "tls web",
        "zerossl",
        "zerossl rsa",
        "domain secure",
        "site ca",
        "fa c7",
        "ocsp",
        "a167",
        "code",
        "keepalive",
        "false",
        "record type",
        "ttl a",
        "value",
        "o jarm",
        "fingerprint",
        "file format",
        "relevance",
        "united",
        "tempe",
        "arizona create",
        "domain",
        "expiry date",
        "name",
        "query time",
        "technical city",
        "tempe technical",
        "technical state",
        "rdap database",
        "handle",
        "iana registrar",
        "links",
        "algorithm",
        "key identifier",
        "data",
        "v3 serial",
        "number",
        "cat ozerossl",
        "cnzerossl rsa",
        "validity",
        "server",
        "domain name",
        "status",
        "abuse contact",
        "email",
        "registrar abuse",
        "contact phone",
        "registrar iana",
        "registrar url",
        "registrar whois",
        "date",
        "available from",
        "country",
        "proxy",
        "postal code",
        "city",
        "admin city",
        "tempe admin",
        "filehashmd5",
        "url https",
        "filehashsha1",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "filehashsha256",
        "showing",
        "germany unknown",
        "passive dns",
        "entries",
        "a domains",
        "body doctype",
        "content type",
        "gmt server",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "main",
        "apache",
        "accept",
        "title",
        "present dec",
        "present jun",
        "present nov",
        "aaaa",
        "present feb",
        "present sep",
        "search",
        "canada",
        "encrypt",
        "devam",
        "ad soyad",
        "mteri numaras",
        "gvenlik iin",
        "gizli soru",
        "gvenlik sorusu",
        "cevab",
        "ltfen bir",
        "present may",
        "moved",
        "present oct",
        "ip address",
        "gandi sas",
        "body",
        "backdoor",
        "next associated",
        "trojandropper",
        "fastly error",
        "please",
        "sea p",
        "twitter",
        "win32",
        "creation date",
        "name servers",
        "hostname add",
        "pulse pulses",
        "urls",
        "record value",
        "japan",
        "germany",
        "ipv4",
        "countries",
        "america",
        "netherlands",
        "italy",
        "brian sabey",
        "report spam",
        "tsara brashears",
        "created",
        "days ago",
        "green well",
        "sabey stash",
        "service",
        "hours ago",
        "malicious",
        "forbidden",
        "actionlistccc",
        "malware family",
        "mufanom att",
        "capture",
        "ck ids",
        "checkin",
        "t1036",
        "t1055",
        "injection",
        "t1056"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1199",
          "name": "Trusted Relationship",
          "display_name": "T1199 - Trusted Relationship"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1448",
          "name": "Carrier Billing Fraud",
          "display_name": "T1448 - Carrier Billing Fraud"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "68d332d77a7eedf3ad71c406",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 617,
        "URL": 2495,
        "hostname": 1698,
        "FileHash-MD5": 275,
        "FileHash-SHA1": 265,
        "FileHash-SHA256": 1241,
        "SSLCertFingerprint": 2,
        "email": 4
      },
      "indicator_count": 6597,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "221 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "64d15ddd28efbfbd3aee0b40",
      "name": "SEC.COM",
      "description": "",
      "modified": "2023-09-08T00:02:16.727000",
      "created": "2023-08-07T21:10:53.630000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ellenmmm",
        "id": "233693",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 239,
        "domain": 123,
        "URL": 426,
        "FileHash-SHA256": 16
      },
      "indicator_count": 804,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 81,
      "modified_text": "998 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://a.a3ion.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://a.a3ion.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780421991.0087879
}