{
  "type": "URL",
  "indicator": "https://ads6.ssp.cgnl.io",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ads6.ssp.cgnl.io",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3449063184,
      "indicator": "https://ads6.ssp.cgnl.io",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "65708e4e9c1be22930c7a9c9",
          "name": "Hiding in common sight, misplaced attribution as just being AD Fraud",
          "description": "",
          "modified": "2023-12-06T15:07:58.810000",
          "created": "2023-12-06T15:07:58.810000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 525,
            "domain": 91,
            "URL": 531,
            "hostname": 281,
            "FileHash-MD5": 1
          },
          "indicator_count": 1429,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "908 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "639e2fed7c2b1110ee6897a5",
          "name": "A few corkers on here BEC BEC BEC",
          "description": "",
          "modified": "2023-01-16T20:01:36.977000",
          "created": "2022-12-17T21:09:01.151000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1739,
            "hostname": 936,
            "domain": 366,
            "FileHash-SHA256": 730,
            "CVE": 1,
            "FileHash-MD5": 58,
            "FileHash-SHA1": 56
          },
          "indicator_count": 3886,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 91,
          "modified_text": "1232 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6369ac0353360444c64310d9",
          "name": "ads ad",
          "description": "",
          "modified": "2022-12-08T01:02:33.733000",
          "created": "2022-11-08T01:08:19.778000",
          "tags": [
            "size",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "seen",
            "disabled hash",
            "hash seen",
            "type data",
            "strings",
            "general",
            "click"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 110,
            "URL": 196,
            "domain": 11,
            "FileHash-MD5": 15,
            "FileHash-SHA1": 15,
            "FileHash-SHA256": 16
          },
          "indicator_count": 363,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 393,
          "modified_text": "1271 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6282747cb32e6183686525ca",
          "name": "Hiding in common sight, misplaced attribution as just being AD Fraud",
          "description": "Get ready for the Russians to take over cause while most of cyber has been sleeping thru this chronic abuse just putting it down to common low impact ad fraud your about to find out whats really going on!",
          "modified": "2022-06-15T00:01:21.489000",
          "created": "2022-05-16T15:57:48.548000",
          "tags": [
            "found",
            "iptv",
            "ad",
            "click",
            "fraud",
            "hiding in common sight",
            "initial access brokerage",
            "creds",
            "dirtying tv traffic",
            "nefarious domain parking",
            "enterprise leverage via the average consumer",
            "analytics abuse",
            "CNAME cookie abuse",
            "Cookie abuse",
            "GDPR might as well not exist"
          ],
          "references": [
            "Ad/click Fraud disguises much more",
            "initial access brokers",
            "http://aka.ms/LearnAboutSenderIdentification  Akamai rank: #256\t  URL http://aka.ms/LearnAboutSenderIdentification.  Akamai rank: #256\t  URL http://aka.ms/learnathon  Akamai rank: #256\t  URL https://aka.ms/atasaguide-recenum  Akamai rank: #256\t  URL https://aka.ms/cp_r=",
            "cant complete due to continious freezing"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 281,
            "URL": 531,
            "FileHash-SHA256": 525,
            "domain": 91,
            "FileHash-MD5": 1
          },
          "indicator_count": 1429,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 396,
          "modified_text": "1448 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Ad/click Fraud disguises much more",
        "cant complete due to continious freezing",
        "initial access brokers",
        "http://aka.ms/LearnAboutSenderIdentification  Akamai rank: #256\t  URL http://aka.ms/LearnAboutSenderIdentification.  Akamai rank: #256\t  URL http://aka.ms/learnathon  Akamai rank: #256\t  URL https://aka.ms/atasaguide-recenum  Akamai rank: #256\t  URL https://aka.ms/cp_r="
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 5529
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/cgnl.io",
    "whois": "http://whois.domaintools.com/cgnl.io",
    "domain": "cgnl.io",
    "hostname": "ads6.ssp.cgnl.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "65708e4e9c1be22930c7a9c9",
      "name": "Hiding in common sight, misplaced attribution as just being AD Fraud",
      "description": "",
      "modified": "2023-12-06T15:07:58.810000",
      "created": "2023-12-06T15:07:58.810000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 525,
        "domain": 91,
        "URL": 531,
        "hostname": 281,
        "FileHash-MD5": 1
      },
      "indicator_count": 1429,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "908 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "639e2fed7c2b1110ee6897a5",
      "name": "A few corkers on here BEC BEC BEC",
      "description": "",
      "modified": "2023-01-16T20:01:36.977000",
      "created": "2022-12-17T21:09:01.151000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1739,
        "hostname": 936,
        "domain": 366,
        "FileHash-SHA256": 730,
        "CVE": 1,
        "FileHash-MD5": 58,
        "FileHash-SHA1": 56
      },
      "indicator_count": 3886,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 91,
      "modified_text": "1232 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6369ac0353360444c64310d9",
      "name": "ads ad",
      "description": "",
      "modified": "2022-12-08T01:02:33.733000",
      "created": "2022-11-08T01:08:19.778000",
      "tags": [
        "size",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "seen",
        "disabled hash",
        "hash seen",
        "type data",
        "strings",
        "general",
        "click"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 110,
        "URL": 196,
        "domain": 11,
        "FileHash-MD5": 15,
        "FileHash-SHA1": 15,
        "FileHash-SHA256": 16
      },
      "indicator_count": 363,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 393,
      "modified_text": "1271 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6282747cb32e6183686525ca",
      "name": "Hiding in common sight, misplaced attribution as just being AD Fraud",
      "description": "Get ready for the Russians to take over cause while most of cyber has been sleeping thru this chronic abuse just putting it down to common low impact ad fraud your about to find out whats really going on!",
      "modified": "2022-06-15T00:01:21.489000",
      "created": "2022-05-16T15:57:48.548000",
      "tags": [
        "found",
        "iptv",
        "ad",
        "click",
        "fraud",
        "hiding in common sight",
        "initial access brokerage",
        "creds",
        "dirtying tv traffic",
        "nefarious domain parking",
        "enterprise leverage via the average consumer",
        "analytics abuse",
        "CNAME cookie abuse",
        "Cookie abuse",
        "GDPR might as well not exist"
      ],
      "references": [
        "Ad/click Fraud disguises much more",
        "initial access brokers",
        "http://aka.ms/LearnAboutSenderIdentification  Akamai rank: #256\t  URL http://aka.ms/LearnAboutSenderIdentification.  Akamai rank: #256\t  URL http://aka.ms/learnathon  Akamai rank: #256\t  URL https://aka.ms/atasaguide-recenum  Akamai rank: #256\t  URL https://aka.ms/cp_r=",
        "cant complete due to continious freezing"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 281,
        "URL": 531,
        "FileHash-SHA256": 525,
        "domain": 91,
        "FileHash-MD5": 1
      },
      "indicator_count": 1429,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 396,
      "modified_text": "1448 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ads6.ssp.cgnl.io",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ads6.ssp.cgnl.io",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780360493.2507334
}