{
  "type": "URL",
  "indicator": "https://api-restlet.com/services/v5/rD",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api-restlet.com/services/v5/rD",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "whitelist",
        "message": "Whitelisted domain api-restlet.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 16907500,
      "indicator": "https://api-restlet.com/services/v5/rD",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 16,
      "pulses": [
        {
          "id": "59416b6723008273245d9f47",
          "name": "Xavier: An Information-Stealing Ad Library on Android",
          "description": "TrendMicro has recently discovered a Trojan Android ad library called Xavier (Detected by Trend Micro as ANDROIDOS_XAVIER.AXM) that steals and leaks a user\u2019s information silently. Xavier\u2019s impact has been widespread. Based on data from Trend Micro Mobile App Reputation Service, we detected more than 800 applications embedded the ad library\u2019s SDK that have been downloaded millions of times from Google Play. These applications range from utility apps such as photo manipulators to wallpaper and ringtone changers.",
          "modified": "2018-03-28T16:48:55.241000",
          "created": "2017-06-14T16:59:19.444000",
          "tags": [
            "android",
            "mobile",
            "ANDROIDOS_XAVIER.AXM",
            "google play",
            "trendmicro"
          ],
          "references": [
            "https://documents.trendmicro.com/assets/appendix--analyzing-xavier-an-information-stealing-ad-library-on-android.pdf",
            "https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 55,
          "upvotes_count": 1.0,
          "downvotes_count": 0.0,
          "votes_count": 1.0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "AlienVault",
            "id": "2",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
            "is_subscribed": true,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 352,
            "URL": 3
          },
          "indicator_count": 355,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 386898,
          "modified_text": "2987 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c932e4490891a341b1ac6e",
          "name": "InQuest - 15-09-2025",
          "description": "",
          "modified": "2025-10-16T09:05:23.489000",
          "created": "2025-09-16T09:50:28.821000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 28,
            "URL": 110,
            "FileHash-SHA1": 18,
            "domain": 17,
            "FileHash-SHA256": 158,
            "FileHash-MD5": 4
          },
          "indicator_count": 335,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "229 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c36db4f1c3434d9bb73bac",
          "name": "InQuest - 11-09-2025",
          "description": "",
          "modified": "2025-10-12T00:08:44.048000",
          "created": "2025-09-12T00:47:48.876000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 14,
            "hostname": 38,
            "URL": 203,
            "FileHash-SHA256": 243,
            "domain": 59,
            "FileHash-MD5": 14
          },
          "indicator_count": 571,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "233 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68c20fe2d44936d0a126e54a",
          "name": "InQuest - 10-09-2025",
          "description": "",
          "modified": "2025-10-10T23:02:00.832000",
          "created": "2025-09-10T23:55:14.284000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 18,
            "hostname": 56,
            "URL": 331,
            "FileHash-SHA256": 309,
            "domain": 81,
            "FileHash-MD5": 41
          },
          "indicator_count": 836,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "234 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68b6379553e9978bfcf11f19",
          "name": "InQuest - 01-09-2025",
          "description": "",
          "modified": "2025-10-02T00:00:16.307000",
          "created": "2025-09-02T00:17:25.854000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 60,
            "URL": 240,
            "FileHash-SHA256": 442,
            "domain": 56,
            "FileHash-MD5": 4,
            "FileHash-SHA1": 2
          },
          "indicator_count": 804,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68b0f44fdd529f56acecee2a",
          "name": "InQuest - 28-08-2025",
          "description": "",
          "modified": "2025-09-28T00:00:13.359000",
          "created": "2025-08-29T00:29:03.134000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 16,
            "hostname": 49,
            "URL": 250,
            "domain": 50,
            "FileHash-SHA256": 188,
            "FileHash-MD5": 1
          },
          "indicator_count": 554,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "247 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68afa11b3d5b10addf458ec4",
          "name": "InQuest - 27-08-2025",
          "description": "",
          "modified": "2025-09-27T00:02:33.617000",
          "created": "2025-08-28T00:21:47.876000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 54,
            "URL": 216,
            "FileHash-SHA1": 18,
            "domain": 70,
            "FileHash-SHA256": 193,
            "FileHash-MD5": 1
          },
          "indicator_count": 552,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68abaf5421a4cee8c87aa37f",
          "name": "InQuest - 24-08-2025",
          "description": "",
          "modified": "2025-09-24T00:00:32.348000",
          "created": "2025-08-25T00:33:24.102000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 36,
            "URL": 161,
            "FileHash-SHA1": 2,
            "domain": 19,
            "FileHash-SHA256": 178,
            "FileHash-MD5": 3
          },
          "indicator_count": 399,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "251 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687f143a967e1e3a07d87b83",
          "name": "InQuest - 21-07-2025",
          "description": "",
          "modified": "2025-08-21T04:03:37.017000",
          "created": "2025-07-22T04:31:54.502000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 38,
            "URL": 253,
            "FileHash-SHA256": 229,
            "domain": 45,
            "FileHash-SHA1": 42,
            "FileHash-MD5": 2
          },
          "indicator_count": 609,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "285 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68549fb1f50b3ff0a6a57aad",
          "name": "InQuest - 19-06-2025",
          "description": "",
          "modified": "2025-07-19T23:05:44.525000",
          "created": "2025-06-19T23:39:29.412000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 50,
            "URL": 218,
            "FileHash-SHA256": 437,
            "domain": 31,
            "FileHash-SHA1": 11,
            "FileHash-MD5": 10
          },
          "indicator_count": 757,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "317 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6833ad1fee54654504fdb8c5",
          "name": "InQuest - 25-05-2025",
          "description": "",
          "modified": "2025-06-24T23:00:32.355000",
          "created": "2025-05-25T23:51:59.855000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 75,
            "URL": 283,
            "domain": 57,
            "FileHash-SHA256": 298,
            "FileHash-SHA1": 18,
            "FileHash-MD5": 53
          },
          "indicator_count": 784,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "342 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68325eb386672c5c249ca6ea",
          "name": "InQuest - 24-05-2025",
          "description": "",
          "modified": "2025-06-24T00:00:59.539000",
          "created": "2025-05-25T00:05:07.728000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 69,
            "URL": 266,
            "domain": 60,
            "FileHash-SHA256": 271,
            "FileHash-MD5": 52,
            "FileHash-SHA1": 19
          },
          "indicator_count": 737,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "343 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6831180b91b9acfdb05f5706",
          "name": "InQuest - 23-05-2025",
          "description": "",
          "modified": "2025-06-23T00:02:19.148000",
          "created": "2025-05-24T00:51:23.763000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 461,
            "hostname": 39,
            "URL": 238,
            "domain": 59,
            "FileHash-SHA1": 16,
            "FileHash-MD5": 11
          },
          "indicator_count": 824,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "344 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68194c7ce623327cf6159efe",
          "name": "InQuest - 05-05-2025",
          "description": "",
          "modified": "2025-06-04T23:02:44.696000",
          "created": "2025-05-05T23:40:44.666000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 68,
            "URL": 204,
            "FileHash-SHA256": 222,
            "FileHash-SHA1": 11,
            "domain": 47,
            "FileHash-MD5": 12
          },
          "indicator_count": 564,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "362 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "674f9ce1718136e15df53b91",
          "name": "InQuest - 03-12-2024",
          "description": "",
          "modified": "2025-01-06T23:11:01.995000",
          "created": "2024-12-04T00:05:53.926000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 799,
            "URL": 378,
            "domain": 76,
            "hostname": 82,
            "FileHash-SHA1": 27,
            "FileHash-MD5": 47
          },
          "indicator_count": 1409,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "511 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "674e4ba5d0ce7a54e0ebb0d7",
          "name": "InQuest - 02-12-2024",
          "description": "",
          "modified": "2025-01-02T00:01:57.506000",
          "created": "2024-12-03T00:07:01.241000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 744,
            "URL": 362,
            "domain": 78,
            "hostname": 70,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 16
          },
          "indicator_count": 1317,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1623,
          "modified_text": "516 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://labs.inquest.net/iocdb",
        "https://documents.trendmicro.com/assets/appendix--analyzing-xavier-an-information-stealing-ad-library-on-android.pdf",
        "https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 355
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 4702
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/api-restlet.com",
    "whois": "http://whois.domaintools.com/api-restlet.com",
    "domain": "api-restlet.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 16,
  "pulses": [
    {
      "id": "59416b6723008273245d9f47",
      "name": "Xavier: An Information-Stealing Ad Library on Android",
      "description": "TrendMicro has recently discovered a Trojan Android ad library called Xavier (Detected by Trend Micro as ANDROIDOS_XAVIER.AXM) that steals and leaks a user\u2019s information silently. Xavier\u2019s impact has been widespread. Based on data from Trend Micro Mobile App Reputation Service, we detected more than 800 applications embedded the ad library\u2019s SDK that have been downloaded millions of times from Google Play. These applications range from utility apps such as photo manipulators to wallpaper and ringtone changers.",
      "modified": "2018-03-28T16:48:55.241000",
      "created": "2017-06-14T16:59:19.444000",
      "tags": [
        "android",
        "mobile",
        "ANDROIDOS_XAVIER.AXM",
        "google play",
        "trendmicro"
      ],
      "references": [
        "https://documents.trendmicro.com/assets/appendix--analyzing-xavier-an-information-stealing-ad-library-on-android.pdf",
        "https://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-xavier-information-stealing-ad-library-android/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 55,
      "upvotes_count": 1.0,
      "downvotes_count": 0.0,
      "votes_count": 1.0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "AlienVault",
        "id": "2",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_2/resized/80/avatar_dacfad0ca8.png",
        "is_subscribed": true,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 352,
        "URL": 3
      },
      "indicator_count": 355,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 386898,
      "modified_text": "2987 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c932e4490891a341b1ac6e",
      "name": "InQuest - 15-09-2025",
      "description": "",
      "modified": "2025-10-16T09:05:23.489000",
      "created": "2025-09-16T09:50:28.821000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 28,
        "URL": 110,
        "FileHash-SHA1": 18,
        "domain": 17,
        "FileHash-SHA256": 158,
        "FileHash-MD5": 4
      },
      "indicator_count": 335,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "229 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c36db4f1c3434d9bb73bac",
      "name": "InQuest - 11-09-2025",
      "description": "",
      "modified": "2025-10-12T00:08:44.048000",
      "created": "2025-09-12T00:47:48.876000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 14,
        "hostname": 38,
        "URL": 203,
        "FileHash-SHA256": 243,
        "domain": 59,
        "FileHash-MD5": 14
      },
      "indicator_count": 571,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "233 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68c20fe2d44936d0a126e54a",
      "name": "InQuest - 10-09-2025",
      "description": "",
      "modified": "2025-10-10T23:02:00.832000",
      "created": "2025-09-10T23:55:14.284000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 18,
        "hostname": 56,
        "URL": 331,
        "FileHash-SHA256": 309,
        "domain": 81,
        "FileHash-MD5": 41
      },
      "indicator_count": 836,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "234 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68b6379553e9978bfcf11f19",
      "name": "InQuest - 01-09-2025",
      "description": "",
      "modified": "2025-10-02T00:00:16.307000",
      "created": "2025-09-02T00:17:25.854000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 60,
        "URL": 240,
        "FileHash-SHA256": 442,
        "domain": 56,
        "FileHash-MD5": 4,
        "FileHash-SHA1": 2
      },
      "indicator_count": 804,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68b0f44fdd529f56acecee2a",
      "name": "InQuest - 28-08-2025",
      "description": "",
      "modified": "2025-09-28T00:00:13.359000",
      "created": "2025-08-29T00:29:03.134000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 16,
        "hostname": 49,
        "URL": 250,
        "domain": 50,
        "FileHash-SHA256": 188,
        "FileHash-MD5": 1
      },
      "indicator_count": 554,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "247 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68afa11b3d5b10addf458ec4",
      "name": "InQuest - 27-08-2025",
      "description": "",
      "modified": "2025-09-27T00:02:33.617000",
      "created": "2025-08-28T00:21:47.876000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 54,
        "URL": 216,
        "FileHash-SHA1": 18,
        "domain": 70,
        "FileHash-SHA256": 193,
        "FileHash-MD5": 1
      },
      "indicator_count": 552,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68abaf5421a4cee8c87aa37f",
      "name": "InQuest - 24-08-2025",
      "description": "",
      "modified": "2025-09-24T00:00:32.348000",
      "created": "2025-08-25T00:33:24.102000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 36,
        "URL": 161,
        "FileHash-SHA1": 2,
        "domain": 19,
        "FileHash-SHA256": 178,
        "FileHash-MD5": 3
      },
      "indicator_count": 399,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1623,
      "modified_text": "251 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687f143a967e1e3a07d87b83",
      "name": "InQuest - 21-07-2025",
      "description": "",
      "modified": "2025-08-21T04:03:37.017000",
      "created": "2025-07-22T04:31:54.502000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 38,
        "URL": 253,
        "FileHash-SHA256": 229,
        "domain": 45,
        "FileHash-SHA1": 42,
        "FileHash-MD5": 2
      },
      "indicator_count": 609,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "285 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68549fb1f50b3ff0a6a57aad",
      "name": "InQuest - 19-06-2025",
      "description": "",
      "modified": "2025-07-19T23:05:44.525000",
      "created": "2025-06-19T23:39:29.412000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 50,
        "URL": 218,
        "FileHash-SHA256": 437,
        "domain": 31,
        "FileHash-SHA1": 11,
        "FileHash-MD5": 10
      },
      "indicator_count": 757,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "317 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api-restlet.com/services/v5/rD",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api-restlet.com/services/v5/rD",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780391521.60925
}