{
  "type": "URL",
  "indicator": "https://alias2.white-label-dating.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://alias2.white-label-dating.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4119207872,
      "indicator": "https://alias2.white-label-dating.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68e32dd0c55bf224eb99dd58",
          "name": "Appspot.com - Google account fraud & infostealing",
          "description": "Fake Google email accounts. I\u2019ve reviewed a handful of targets with this issue. If starting with a new device, signed up for a new google account,\nthe users are automatically logged out, forced to sign in again, checked security features where you can see an unauthorized autonomous general\nphone, or iPhone or MacBook was also signed in in a different location. Even if you delete the device or email account, I\u2019ve seen the intruder handle CnC of all backups of photos and clouds. \n\n\n\n[OTX auto populated - The full list of domain names: APPSPot.COM.com, which was created on the same day as the Google search engine, has been published by the internet regulator, the IANA.]",
          "modified": "2025-11-05T01:01:26.928000",
          "created": "2025-10-06T02:47:44.098000",
          "tags": [
            "aaaa",
            "susp",
            "trojan",
            "google",
            "server",
            "domain status",
            "registrar abuse",
            "domain name",
            "us registrant",
            "email",
            "contact email",
            "rdap database",
            "google app",
            "google hosted",
            "please",
            "vulnerabilities",
            "join",
            "bring",
            "api explorer",
            "engine",
            "admin sdk",
            "info",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "ssl certificate",
            "ascii text",
            "united",
            "pattern match",
            "mitre att",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "porn",
            "phishing",
            "fraud",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "download",
            "apt",
            "ansi",
            "dumps",
            "file string",
            "seen",
            "disabled hash",
            "close",
            "hosts",
            "contact",
            "tellwise",
            "passive dns",
            "urls",
            "pulse pulses",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as15169",
            "extraction",
            "data upload",
            "extra",
            "referen http",
            "changed data",
            "failed",
            "include review",
            "t07 exclude",
            "extri data",
            "changed",
            "exclude",
            "find s",
            "tvnes data",
            "status",
            "present nov",
            "name servers",
            "entries",
            "geoid no",
            "present dec",
            "date",
            "error",
            "title",
            "sugges",
            "typ no",
            "no entrieotound",
            "scam",
            "foundry",
            "sabey type",
            "denver",
            "quasi",
            "phoenix",
            "australia"
          ],
          "references": [
            "appspot.com  \u2022 hyper7install.appspot.com",
            "https://hybrid-analysis.com/sample/c61237fcb798f05e6af32a6aa13f8e795aac47559d601eb7f93ad65bcf58b418/68e30c476b91a8000b0dd786",
            "http://acounts.google.com/v/signin/identifier?continue=hts%253%252F2Fconsole.cloud.google.com2Fapengine&dsh=5-1106814258%2539876543210",
            "Changed last several digits of gmail account # In example",
            "http://console.cloud.google.com/appengine",
            "https://310940000.android.com.twitter.android.adsenseformobileapps.com/",
            "https://www.netify.ai/resources/domains \u2022 192-168-0-21.3pt3m9ng2hf.ddns.manage.alta.inc",
            "device-local-de06e551-6b23-4aa3-bb67-6972ae6d30b5.remotewd.com 192.168.0.21",
            "116e33e0-8832-11ec-aef5-99a1d044639a-local.solinkcloud.com",
            "jaycobundaberg.eclipseaurahub.com.au 192.168.0.21",
            "grafana.ledocloud.com\u2022 192.168.0.21",
            "192-168-0-21.siliconevalley1.direct.quickconnect.to"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32/Madang",
              "display_name": "Win32/Madang",
              "target": null
            },
            {
              "id": "Win.Downloader.Small-1966",
              "display_name": "Win.Downloader.Small-1966",
              "target": null
            },
            {
              "id": "Win32:SaliCode",
              "display_name": "Win32:SaliCode",
              "target": null
            },
            {
              "id": "Virtool:Win32/Vbinder.CO",
              "display_name": "Virtool:Win32/Vbinder.CO",
              "target": "/malware/Virtool:Win32/Vbinder.CO"
            },
            {
              "id": "!Themida",
              "display_name": "!Themida",
              "target": null
            },
            {
              "id": "Virus:Win32/Sality.AT",
              "display_name": "Virus:Win32/Sality.AT",
              "target": "/malware/Virus:Win32/Sality.AT"
            },
            {
              "id": "Win32/Scrarev.C",
              "display_name": "Win32/Scrarev.C",
              "target": null
            },
            {
              "id": "Trojan:MSIL/RapidStealer.A",
              "display_name": "Trojan:MSIL/RapidStealer.A",
              "target": "/malware/Trojan:MSIL/RapidStealer.A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1598",
              "name": "Phishing for Information",
              "display_name": "T1598 - Phishing for Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 222,
            "FileHash-MD5": 146,
            "FileHash-SHA1": 317,
            "FileHash-SHA256": 1120,
            "email": 3,
            "hostname": 881,
            "URL": 1338,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 4034,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "166 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68b798c0a419c49eeb4e2a13",
          "name": "Archive.ph - Mirai",
          "description": "Outdated archiving domain of questionable origin     can expose or has exposed monitored target/s to\nUnix.Dropper.Mirai-7135858-0.\n\nThe domain seems to want to appear as if it originates from Russia. There is a DoD & Endgame systems relationship. Multiple archived pages have been injected and deleted.\n(Little Endian) is a name seen  often related to an innocent known to be targeted by a pro male entity who utilizes Pegasus, Palantir, Gotham, Foundry , Tulach, for silencing.\n#trulymissed #mirai #malicious",
          "modified": "2025-10-03T00:01:12.616000",
          "created": "2025-09-03T01:24:16.418000",
          "tags": [
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "javascript",
            "spawns",
            "united",
            "present aug",
            "div div",
            "meta",
            "fffae1",
            "xml title",
            "drag",
            "div form",
            "form div",
            "a li",
            "encrypt",
            "russia",
            "passive dns",
            "urls",
            "aaaa",
            "netherlands",
            "your ip",
            "panama",
            "russia unknown",
            "present mar",
            "present jun",
            "moved",
            "present jul",
            "present sep",
            "ip address",
            "present jan",
            "body",
            "title",
            "domain",
            "files",
            "content type",
            "body doctype",
            "as16509",
            "intel mac",
            "os x",
            "ipv4 add",
            "port",
            "destination",
            "read c",
            "medium",
            "entries",
            "et info",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "malware",
            "url analysis",
            "files ip",
            "name server",
            "domain address",
            "algorithm",
            "key identifier",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cne6",
            "validity",
            "subject public",
            "key info",
            "us as15169",
            "us as396982",
            "mitre att",
            "pattern match",
            "form",
            "onload",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "verify",
            "asnone",
            "china as4134",
            "resolverror",
            "high",
            "dns query",
            "as7018 att",
            "japan as4713",
            "south korea",
            "little \u2018endian\u2019",
            "mirai",
            "dod",
            "endgame systems",
            "government overreach",
            "sabey type",
            "foundry type",
            "apple",
            "cve"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unix.Dropper.Mirai-7135858-0",
              "display_name": "Unix.Dropper.Mirai-7135858-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2069,
            "domain": 406,
            "FileHash-SHA256": 1498,
            "hostname": 811,
            "FileHash-MD5": 150,
            "FileHash-SHA1": 138,
            "SSLCertFingerprint": 8,
            "CIDR": 1,
            "CVE": 1
          },
          "indicator_count": 5082,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "199 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c54659742e10df0e2dd0ec",
          "name": "Archive.ph - Mirai",
          "description": "",
          "modified": "2025-10-03T00:01:12.616000",
          "created": "2025-09-13T10:24:25.814000",
          "tags": [
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "initial access",
            "javascript",
            "spawns",
            "united",
            "present aug",
            "div div",
            "meta",
            "fffae1",
            "xml title",
            "drag",
            "div form",
            "form div",
            "a li",
            "encrypt",
            "russia",
            "passive dns",
            "urls",
            "aaaa",
            "netherlands",
            "your ip",
            "panama",
            "russia unknown",
            "present mar",
            "present jun",
            "moved",
            "present jul",
            "present sep",
            "ip address",
            "present jan",
            "body",
            "title",
            "domain",
            "files",
            "content type",
            "body doctype",
            "as16509",
            "intel mac",
            "os x",
            "ipv4 add",
            "port",
            "destination",
            "read c",
            "medium",
            "entries",
            "et info",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "malware",
            "url analysis",
            "files ip",
            "name server",
            "domain address",
            "algorithm",
            "key identifier",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cne6",
            "validity",
            "subject public",
            "key info",
            "us as15169",
            "us as396982",
            "mitre att",
            "pattern match",
            "form",
            "onload",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "verify",
            "asnone",
            "china as4134",
            "resolverror",
            "high",
            "dns query",
            "as7018 att",
            "japan as4713",
            "south korea",
            "little \u2018endian\u2019",
            "mirai",
            "dod",
            "endgame systems",
            "government overreach",
            "sabey type",
            "foundry type",
            "apple",
            "cve"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Unix.Dropper.Mirai-7135858-0",
              "display_name": "Unix.Dropper.Mirai-7135858-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "68b798c0a419c49eeb4e2a13",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "privacynotacrime",
            "id": "349346",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2069,
            "domain": 406,
            "FileHash-SHA256": 1498,
            "hostname": 811,
            "FileHash-MD5": 150,
            "FileHash-SHA1": 138,
            "SSLCertFingerprint": 8,
            "CIDR": 1,
            "CVE": 1
          },
          "indicator_count": 5082,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 59,
          "modified_text": "199 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "689b9b9fab42ca4f016a226f",
          "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
          "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
          "modified": "2025-09-11T13:03:18.814000",
          "created": "2025-08-12T19:53:03.953000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "href",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "unknown ns",
            "ip address",
            "creation date",
            "search",
            "present sep",
            "moved",
            "domain add",
            "encrypt",
            "accept",
            "please",
            "passive dns",
            "msie",
            "next associated",
            "html",
            "background",
            "unknown site",
            "div div",
            "trojan",
            "zeus",
            "process32nextw",
            "read c",
            "show",
            "shellexecuteexw",
            "windows nt",
            "wow64",
            "copy",
            "dock",
            "write",
            "malware",
            "unknown",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "august",
            "hybrid",
            "port",
            "destination",
            "tlsv1",
            "as15169",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "persistence",
            "data upload",
            "extraction",
            "win32",
            "ransom",
            "trojandropper",
            "mtb nov",
            "forcud",
            "files show",
            "date hash",
            "avast avg"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4179,
            "domain": 774,
            "hostname": 1673,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 110,
            "FileHash-SHA256": 2073,
            "email": 1,
            "SSLCertFingerprint": 13,
            "CVE": 1
          },
          "indicator_count": 8993,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "device-local-de06e551-6b23-4aa3-bb67-6972ae6d30b5.remotewd.com 192.168.0.21",
        "192-168-0-21.siliconevalley1.direct.quickconnect.to",
        "jaycobundaberg.eclipseaurahub.com.au 192.168.0.21",
        "https://hybrid-analysis.com/sample/c61237fcb798f05e6af32a6aa13f8e795aac47559d601eb7f93ad65bcf58b418/68e30c476b91a8000b0dd786",
        "http://console.cloud.google.com/appengine",
        "appspot.com  \u2022 hyper7install.appspot.com",
        "grafana.ledocloud.com\u2022 192.168.0.21",
        "https://310940000.android.com.twitter.android.adsenseformobileapps.com/",
        "https://www.netify.ai/resources/domains \u2022 192-168-0-21.3pt3m9ng2hf.ddns.manage.alta.inc",
        "http://acounts.google.com/v/signin/identifier?continue=hts%253%252F2Fconsole.cloud.google.com2Fapengine&dsh=5-1106814258%2539876543210",
        "Changed last several digits of gmail account # In example",
        "116e33e0-8832-11ec-aef5-99a1d044639a-local.solinkcloud.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win.downloader.small-1966",
            "Virtool:win32/vbinder.co",
            "Virus:win32/sality.at",
            "Win32/madang",
            "Unix.dropper.mirai-7135858-0",
            "Win32/scrarev.c",
            "Win32:salicode",
            "Trojan:msil/rapidstealer.a",
            "!themida"
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "unique_indicators": 17550
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/white-label-dating.com",
    "whois": "http://whois.domaintools.com/white-label-dating.com",
    "domain": "white-label-dating.com",
    "hostname": "alias2.white-label-dating.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68e32dd0c55bf224eb99dd58",
      "name": "Appspot.com - Google account fraud & infostealing",
      "description": "Fake Google email accounts. I\u2019ve reviewed a handful of targets with this issue. If starting with a new device, signed up for a new google account,\nthe users are automatically logged out, forced to sign in again, checked security features where you can see an unauthorized autonomous general\nphone, or iPhone or MacBook was also signed in in a different location. Even if you delete the device or email account, I\u2019ve seen the intruder handle CnC of all backups of photos and clouds. \n\n\n\n[OTX auto populated - The full list of domain names: APPSPot.COM.com, which was created on the same day as the Google search engine, has been published by the internet regulator, the IANA.]",
      "modified": "2025-11-05T01:01:26.928000",
      "created": "2025-10-06T02:47:44.098000",
      "tags": [
        "aaaa",
        "susp",
        "trojan",
        "google",
        "server",
        "domain status",
        "registrar abuse",
        "domain name",
        "us registrant",
        "email",
        "contact email",
        "rdap database",
        "google app",
        "google hosted",
        "please",
        "vulnerabilities",
        "join",
        "bring",
        "api explorer",
        "engine",
        "admin sdk",
        "info",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "ssl certificate",
        "ascii text",
        "united",
        "pattern match",
        "mitre att",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "porn",
        "phishing",
        "fraud",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "download",
        "apt",
        "ansi",
        "dumps",
        "file string",
        "seen",
        "disabled hash",
        "close",
        "hosts",
        "contact",
        "tellwise",
        "passive dns",
        "urls",
        "pulse pulses",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as15169",
        "extraction",
        "data upload",
        "extra",
        "referen http",
        "changed data",
        "failed",
        "include review",
        "t07 exclude",
        "extri data",
        "changed",
        "exclude",
        "find s",
        "tvnes data",
        "status",
        "present nov",
        "name servers",
        "entries",
        "geoid no",
        "present dec",
        "date",
        "error",
        "title",
        "sugges",
        "typ no",
        "no entrieotound",
        "scam",
        "foundry",
        "sabey type",
        "denver",
        "quasi",
        "phoenix",
        "australia"
      ],
      "references": [
        "appspot.com  \u2022 hyper7install.appspot.com",
        "https://hybrid-analysis.com/sample/c61237fcb798f05e6af32a6aa13f8e795aac47559d601eb7f93ad65bcf58b418/68e30c476b91a8000b0dd786",
        "http://acounts.google.com/v/signin/identifier?continue=hts%253%252F2Fconsole.cloud.google.com2Fapengine&dsh=5-1106814258%2539876543210",
        "Changed last several digits of gmail account # In example",
        "http://console.cloud.google.com/appengine",
        "https://310940000.android.com.twitter.android.adsenseformobileapps.com/",
        "https://www.netify.ai/resources/domains \u2022 192-168-0-21.3pt3m9ng2hf.ddns.manage.alta.inc",
        "device-local-de06e551-6b23-4aa3-bb67-6972ae6d30b5.remotewd.com 192.168.0.21",
        "116e33e0-8832-11ec-aef5-99a1d044639a-local.solinkcloud.com",
        "jaycobundaberg.eclipseaurahub.com.au 192.168.0.21",
        "grafana.ledocloud.com\u2022 192.168.0.21",
        "192-168-0-21.siliconevalley1.direct.quickconnect.to"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32/Madang",
          "display_name": "Win32/Madang",
          "target": null
        },
        {
          "id": "Win.Downloader.Small-1966",
          "display_name": "Win.Downloader.Small-1966",
          "target": null
        },
        {
          "id": "Win32:SaliCode",
          "display_name": "Win32:SaliCode",
          "target": null
        },
        {
          "id": "Virtool:Win32/Vbinder.CO",
          "display_name": "Virtool:Win32/Vbinder.CO",
          "target": "/malware/Virtool:Win32/Vbinder.CO"
        },
        {
          "id": "!Themida",
          "display_name": "!Themida",
          "target": null
        },
        {
          "id": "Virus:Win32/Sality.AT",
          "display_name": "Virus:Win32/Sality.AT",
          "target": "/malware/Virus:Win32/Sality.AT"
        },
        {
          "id": "Win32/Scrarev.C",
          "display_name": "Win32/Scrarev.C",
          "target": null
        },
        {
          "id": "Trojan:MSIL/RapidStealer.A",
          "display_name": "Trojan:MSIL/RapidStealer.A",
          "target": "/malware/Trojan:MSIL/RapidStealer.A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1598",
          "name": "Phishing for Information",
          "display_name": "T1598 - Phishing for Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 222,
        "FileHash-MD5": 146,
        "FileHash-SHA1": 317,
        "FileHash-SHA256": 1120,
        "email": 3,
        "hostname": 881,
        "URL": 1338,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 4034,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "166 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68b798c0a419c49eeb4e2a13",
      "name": "Archive.ph - Mirai",
      "description": "Outdated archiving domain of questionable origin     can expose or has exposed monitored target/s to\nUnix.Dropper.Mirai-7135858-0.\n\nThe domain seems to want to appear as if it originates from Russia. There is a DoD & Endgame systems relationship. Multiple archived pages have been injected and deleted.\n(Little Endian) is a name seen  often related to an innocent known to be targeted by a pro male entity who utilizes Pegasus, Palantir, Gotham, Foundry , Tulach, for silencing.\n#trulymissed #mirai #malicious",
      "modified": "2025-10-03T00:01:12.616000",
      "created": "2025-09-03T01:24:16.418000",
      "tags": [
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "javascript",
        "spawns",
        "united",
        "present aug",
        "div div",
        "meta",
        "fffae1",
        "xml title",
        "drag",
        "div form",
        "form div",
        "a li",
        "encrypt",
        "russia",
        "passive dns",
        "urls",
        "aaaa",
        "netherlands",
        "your ip",
        "panama",
        "russia unknown",
        "present mar",
        "present jun",
        "moved",
        "present jul",
        "present sep",
        "ip address",
        "present jan",
        "body",
        "title",
        "domain",
        "files",
        "content type",
        "body doctype",
        "as16509",
        "intel mac",
        "os x",
        "ipv4 add",
        "port",
        "destination",
        "read c",
        "medium",
        "entries",
        "et info",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "malware",
        "url analysis",
        "files ip",
        "name server",
        "domain address",
        "algorithm",
        "key identifier",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cne6",
        "validity",
        "subject public",
        "key info",
        "us as15169",
        "us as396982",
        "mitre att",
        "pattern match",
        "form",
        "onload",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "verify",
        "asnone",
        "china as4134",
        "resolverror",
        "high",
        "dns query",
        "as7018 att",
        "japan as4713",
        "south korea",
        "little \u2018endian\u2019",
        "mirai",
        "dod",
        "endgame systems",
        "government overreach",
        "sabey type",
        "foundry type",
        "apple",
        "cve"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unix.Dropper.Mirai-7135858-0",
          "display_name": "Unix.Dropper.Mirai-7135858-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2069,
        "domain": 406,
        "FileHash-SHA256": 1498,
        "hostname": 811,
        "FileHash-MD5": 150,
        "FileHash-SHA1": 138,
        "SSLCertFingerprint": 8,
        "CIDR": 1,
        "CVE": 1
      },
      "indicator_count": 5082,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "199 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c54659742e10df0e2dd0ec",
      "name": "Archive.ph - Mirai",
      "description": "",
      "modified": "2025-10-03T00:01:12.616000",
      "created": "2025-09-13T10:24:25.814000",
      "tags": [
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "initial access",
        "javascript",
        "spawns",
        "united",
        "present aug",
        "div div",
        "meta",
        "fffae1",
        "xml title",
        "drag",
        "div form",
        "form div",
        "a li",
        "encrypt",
        "russia",
        "passive dns",
        "urls",
        "aaaa",
        "netherlands",
        "your ip",
        "panama",
        "russia unknown",
        "present mar",
        "present jun",
        "moved",
        "present jul",
        "present sep",
        "ip address",
        "present jan",
        "body",
        "title",
        "domain",
        "files",
        "content type",
        "body doctype",
        "as16509",
        "intel mac",
        "os x",
        "ipv4 add",
        "port",
        "destination",
        "read c",
        "medium",
        "entries",
        "et info",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "malware",
        "url analysis",
        "files ip",
        "name server",
        "domain address",
        "algorithm",
        "key identifier",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cne6",
        "validity",
        "subject public",
        "key info",
        "us as15169",
        "us as396982",
        "mitre att",
        "pattern match",
        "form",
        "onload",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "verify",
        "asnone",
        "china as4134",
        "resolverror",
        "high",
        "dns query",
        "as7018 att",
        "japan as4713",
        "south korea",
        "little \u2018endian\u2019",
        "mirai",
        "dod",
        "endgame systems",
        "government overreach",
        "sabey type",
        "foundry type",
        "apple",
        "cve"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Unix.Dropper.Mirai-7135858-0",
          "display_name": "Unix.Dropper.Mirai-7135858-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "68b798c0a419c49eeb4e2a13",
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "privacynotacrime",
        "id": "349346",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2069,
        "domain": 406,
        "FileHash-SHA256": 1498,
        "hostname": 811,
        "FileHash-MD5": 150,
        "FileHash-SHA1": 138,
        "SSLCertFingerprint": 8,
        "CIDR": 1,
        "CVE": 1
      },
      "indicator_count": 5082,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 59,
      "modified_text": "199 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "689b9b9fab42ca4f016a226f",
      "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
      "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
      "modified": "2025-09-11T13:03:18.814000",
      "created": "2025-08-12T19:53:03.953000",
      "tags": [
        "url http",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "entries",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "href",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "united",
        "unknown ns",
        "ip address",
        "creation date",
        "search",
        "present sep",
        "moved",
        "domain add",
        "encrypt",
        "accept",
        "please",
        "passive dns",
        "msie",
        "next associated",
        "html",
        "background",
        "unknown site",
        "div div",
        "trojan",
        "zeus",
        "process32nextw",
        "read c",
        "show",
        "shellexecuteexw",
        "windows nt",
        "wow64",
        "copy",
        "dock",
        "write",
        "malware",
        "unknown",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "august",
        "hybrid",
        "port",
        "destination",
        "tlsv1",
        "as15169",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "persistence",
        "data upload",
        "extraction",
        "win32",
        "ransom",
        "trojandropper",
        "mtb nov",
        "forcud",
        "files show",
        "date hash",
        "avast avg"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4179,
        "domain": 774,
        "hostname": 1673,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 110,
        "FileHash-SHA256": 2073,
        "email": 1,
        "SSLCertFingerprint": 13,
        "CVE": 1
      },
      "indicator_count": 8993,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://alias2.white-label-dating.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://alias2.white-label-dating.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776659753.133043
}