{
  "type": "URL",
  "indicator": "https://api.newsroom.bi",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api.newsroom.bi",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4090260223,
      "indicator": "https://api.newsroom.bi",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "687d30048b95aaba628a5ee7",
          "name": "Working on it\u2026\u2026",
          "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
          "modified": "2025-08-19T17:00:59.379000",
          "created": "2025-07-20T18:05:56.587000",
          "tags": [
            "dynamicloader",
            "united",
            "as15169",
            "medium",
            "search",
            "show",
            "write c",
            "whitelisted",
            "brazil as396982",
            "high",
            "themida",
            "write",
            "delphi",
            "copy",
            "upatre",
            "encrypt",
            "june",
            "win32",
            "malware",
            "win64",
            "windows nt",
            "directui",
            "element",
            "classinfobase",
            "value",
            "hwndhost",
            "sapeav12",
            "delete c",
            "worm",
            "explorer",
            "insert",
            "movie",
            "alerts",
            "windows",
            "installs",
            "filehash",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "passive dns",
            "urls",
            "http",
            "ip address",
            "related nids",
            "files location",
            "spain flag",
            "spain domain",
            "files related",
            "spain",
            "entries",
            "next associated",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "gmt content",
            "filehashsha256",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "filehashmd5",
            "showing",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "iocs",
            "learn more",
            "filehashsha1",
            "types of",
            "united kingdom",
            "t1053",
            "taskjob",
            "t1055",
            "injection",
            "t1082",
            "t1119",
            "t1129",
            "modules",
            "t1143",
            "soundcloud",
            "created",
            "hour ago",
            "facebook",
            "twitter",
            "victims website",
            "youtube",
            "jansky",
            "trojandropper",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2012,
            "FileHash-MD5": 140,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1348,
            "SSLCertFingerprint": 3,
            "domain": 288,
            "hostname": 812
          },
          "indicator_count": 4732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68730c407f8484c524c2d7f4",
          "name": "The Denver Post used for Fake news | Foundry  | Twitter | Porn",
          "description": "Is the Denver Post a honey pot? Portal? Used for investigating? Smear campaigns? \n\nVictims reported for multiple years their names have been advertised in malicious red report campaigns, obituaries, threats. This has been true of the Ricky Mountain News which has been out of business for years and Denver Post.\n\n\nI can\u2019t annotate so I can\u2019t include references.\nReferences:\nFoundry\nTwitter\nDouglas Undersheriff who was either being smeared or heading a smear campaign.\nPorn\nTwitter \nInjured worker\u2019s compensation targets with la he loss including death.\nThey don\u2019t want to pay. Crazy fact: Workers compensation keeps the nearly a billion $ annually tax free. Does not want to pay. Bonuses doctors and anyone who will deny truly injured workers their compensation. \n#callthecopsifyousee_o-o_t_pac",
          "modified": "2025-08-12T01:02:51.771000",
          "created": "2025-07-13T01:30:40.917000",
          "tags": [
            "gtmtlfp4r",
            "utc gtmtlfp4r",
            "domains",
            "hashes",
            "reverse dns",
            "url https",
            "general full",
            "united",
            "security tls",
            "resource",
            "protocol h2",
            "software",
            "hash",
            "name value",
            "main",
            "spurlock",
            "carlos illescas",
            "wordpress",
            "denver post",
            "server nginx",
            "date sun",
            "gmt contenttype",
            "connection",
            "wordpress vip",
            "https",
            "link",
            "json",
            "contentencoding",
            "miss xrq",
            "value",
            "july",
            "variables",
            "osano function",
            "gpp function",
            "tcfapi function",
            "uspapi",
            "mg2 string",
            "bcclass",
            "dfmadmodslevel",
            "xblocker",
            "extraction",
            "data upload",
            "extrac",
            "included data",
            "review ious",
            "u excluded",
            "suggesteroo",
            "ony incude",
            "failed",
            "so type",
            "extra data",
            "includec review",
            "exclude suggest",
            "find s",
            "s type",
            "ur extraction",
            "extract",
            "included ic",
            "review ioc",
            "type no",
            "extri",
            "include review",
            "exclude sugges",
            "typ filel",
            "filet filet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1774,
            "FileHash-SHA256": 3808,
            "domain": 373,
            "FileHash-MD5": 155,
            "FileHash-SHA1": 135,
            "hostname": 1156
          },
          "indicator_count": 7401,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "251 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 12994
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/newsroom.bi",
    "whois": "http://whois.domaintools.com/newsroom.bi",
    "domain": "newsroom.bi",
    "hostname": "api.newsroom.bi"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "687d30048b95aaba628a5ee7",
      "name": "Working on it\u2026\u2026",
      "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
      "modified": "2025-08-19T17:00:59.379000",
      "created": "2025-07-20T18:05:56.587000",
      "tags": [
        "dynamicloader",
        "united",
        "as15169",
        "medium",
        "search",
        "show",
        "write c",
        "whitelisted",
        "brazil as396982",
        "high",
        "themida",
        "write",
        "delphi",
        "copy",
        "upatre",
        "encrypt",
        "june",
        "win32",
        "malware",
        "win64",
        "windows nt",
        "directui",
        "element",
        "classinfobase",
        "value",
        "hwndhost",
        "sapeav12",
        "delete c",
        "worm",
        "explorer",
        "insert",
        "movie",
        "alerts",
        "windows",
        "installs",
        "filehash",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "passive dns",
        "urls",
        "http",
        "ip address",
        "related nids",
        "files location",
        "spain flag",
        "spain domain",
        "files related",
        "spain",
        "entries",
        "next associated",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "gmt content",
        "filehashsha256",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "filehashmd5",
        "showing",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "iocs",
        "learn more",
        "filehashsha1",
        "types of",
        "united kingdom",
        "t1053",
        "taskjob",
        "t1055",
        "injection",
        "t1082",
        "t1119",
        "t1129",
        "modules",
        "t1143",
        "soundcloud",
        "created",
        "hour ago",
        "facebook",
        "twitter",
        "victims website",
        "youtube",
        "jansky",
        "trojandropper",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2012,
        "FileHash-MD5": 140,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1348,
        "SSLCertFingerprint": 3,
        "domain": 288,
        "hostname": 812
      },
      "indicator_count": 4732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68730c407f8484c524c2d7f4",
      "name": "The Denver Post used for Fake news | Foundry  | Twitter | Porn",
      "description": "Is the Denver Post a honey pot? Portal? Used for investigating? Smear campaigns? \n\nVictims reported for multiple years their names have been advertised in malicious red report campaigns, obituaries, threats. This has been true of the Ricky Mountain News which has been out of business for years and Denver Post.\n\n\nI can\u2019t annotate so I can\u2019t include references.\nReferences:\nFoundry\nTwitter\nDouglas Undersheriff who was either being smeared or heading a smear campaign.\nPorn\nTwitter \nInjured worker\u2019s compensation targets with la he loss including death.\nThey don\u2019t want to pay. Crazy fact: Workers compensation keeps the nearly a billion $ annually tax free. Does not want to pay. Bonuses doctors and anyone who will deny truly injured workers their compensation. \n#callthecopsifyousee_o-o_t_pac",
      "modified": "2025-08-12T01:02:51.771000",
      "created": "2025-07-13T01:30:40.917000",
      "tags": [
        "gtmtlfp4r",
        "utc gtmtlfp4r",
        "domains",
        "hashes",
        "reverse dns",
        "url https",
        "general full",
        "united",
        "security tls",
        "resource",
        "protocol h2",
        "software",
        "hash",
        "name value",
        "main",
        "spurlock",
        "carlos illescas",
        "wordpress",
        "denver post",
        "server nginx",
        "date sun",
        "gmt contenttype",
        "connection",
        "wordpress vip",
        "https",
        "link",
        "json",
        "contentencoding",
        "miss xrq",
        "value",
        "july",
        "variables",
        "osano function",
        "gpp function",
        "tcfapi function",
        "uspapi",
        "mg2 string",
        "bcclass",
        "dfmadmodslevel",
        "xblocker",
        "extraction",
        "data upload",
        "extrac",
        "included data",
        "review ious",
        "u excluded",
        "suggesteroo",
        "ony incude",
        "failed",
        "so type",
        "extra data",
        "includec review",
        "exclude suggest",
        "find s",
        "s type",
        "ur extraction",
        "extract",
        "included ic",
        "review ioc",
        "type no",
        "extri",
        "include review",
        "exclude sugges",
        "typ filel",
        "filet filet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1774,
        "FileHash-SHA256": 3808,
        "domain": 373,
        "FileHash-MD5": 155,
        "FileHash-SHA1": 135,
        "hostname": 1156
      },
      "indicator_count": 7401,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "251 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api.newsroom.bi",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api.newsroom.bi",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776685697.218405
}