{
  "type": "URL",
  "indicator": "https://api.skillgames-p2p.bet",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api.skillgames-p2p.bet",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4092304309,
      "indicator": "https://api.skillgames-p2p.bet",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "6952fbca42c1b0da7431e6a7",
          "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ",
          "description": "",
          "modified": "2025-12-29T22:08:10.280000",
          "created": "2025-12-29T22:08:10.280000",
          "tags": [
            "backdoor",
            "cyprus",
            "trojan",
            "mtb sep",
            "passive dns",
            "ddos",
            "mtb oct",
            "mtb aug",
            "ipv4 add",
            "smokeloader",
            "trojandropper",
            "extraction",
            "se extraction",
            "failed",
            "data upload",
            "enter s",
            "enter sc",
            "data u",
            "extrac please",
            "prop",
            "extre data",
            "type",
            "extr data",
            "include review",
            "exclude",
            "find s",
            "typ data",
            "source tir",
            "extri",
            "exclude sugges",
            "se type",
            "extra",
            "include data",
            "exclude review",
            "show",
            "showinil tvnes",
            "dom dom",
            "sc cat959",
            "drop",
            "pulse pulses",
            "worm",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "susp",
            "cyprus showing",
            "entries",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "date",
            "registrar",
            "se cre",
            "pul use",
            "url list",
            "status http",
            "linkid182227",
            "linkid151642",
            "first",
            "domain list",
            "ii llc",
            "sc data",
            "ukl extract",
            "hiloti style",
            "msle",
            "win3 data",
            "onio",
            "observea",
            "data data",
            "stop data",
            "monitored target",
            "tsara",
            "pegasus",
            "social engineering"
          ],
          "references": [
            "http://fakejuko.site40/",
            "pegacloud.net",
            "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "IDS: Win32/Ibashade CnC Beacon",
            "IDS: Win32.Scar.hhrw POST",
            "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
            "IDS: OnionDuke CnC Beacon 1",
            "IDS: Observed Suspicious UA (Mozilla/5.0)",
            "IDS: Data POST to an image file (jpg)",
            "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:WormX-gen [Wrm]",
              "display_name": "Win32:WormX-gen [Wrm]",
              "target": null
            },
            {
              "id": "Worm:Win32:Drolnux",
              "display_name": "Worm:Win32:Drolnux",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "6877422df67773a07ef450c2",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1630,
            "URL": 4078,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 246,
            "FileHash-SHA256": 2561,
            "CVE": 2,
            "domain": 1307,
            "email": 1
          },
          "indicator_count": 10070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "111 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6877422df67773a07ef450c2",
          "name": "Pegasus / Pegacloud - Infiltration",
          "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.",
          "modified": "2025-08-15T05:01:22.570000",
          "created": "2025-07-16T06:09:49.704000",
          "tags": [
            "backdoor",
            "cyprus",
            "trojan",
            "mtb sep",
            "passive dns",
            "ddos",
            "mtb oct",
            "mtb aug",
            "ipv4 add",
            "smokeloader",
            "trojandropper",
            "extraction",
            "se extraction",
            "failed",
            "data upload",
            "enter s",
            "enter sc",
            "data u",
            "extrac please",
            "prop",
            "extre data",
            "type",
            "extr data",
            "include review",
            "exclude",
            "find s",
            "typ data",
            "source tir",
            "extri",
            "exclude sugges",
            "se type",
            "extra",
            "include data",
            "exclude review",
            "show",
            "showinil tvnes",
            "dom dom",
            "sc cat959",
            "drop",
            "pulse pulses",
            "worm",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "susp",
            "cyprus showing",
            "entries",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "date",
            "registrar",
            "se cre",
            "pul use",
            "url list",
            "status http",
            "linkid182227",
            "linkid151642",
            "first",
            "domain list",
            "ii llc",
            "sc data",
            "ukl extract",
            "hiloti style",
            "msle",
            "win3 data",
            "onio",
            "observea",
            "data data",
            "stop data",
            "monitored target",
            "tsara",
            "pegasus",
            "social engineering"
          ],
          "references": [
            "http://fakejuko.site40/",
            "pegacloud.net",
            "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "IDS: Win32/Ibashade CnC Beacon",
            "IDS: Win32.Scar.hhrw POST",
            "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
            "IDS: OnionDuke CnC Beacon 1",
            "IDS: Observed Suspicious UA (Mozilla/5.0)",
            "IDS: Data POST to an image file (jpg)",
            "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:WormX-gen [Wrm]",
              "display_name": "Win32:WormX-gen [Wrm]",
              "target": null
            },
            {
              "id": "Worm:Win32:Drolnux",
              "display_name": "Worm:Win32:Drolnux",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1630,
            "URL": 4078,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 246,
            "FileHash-SHA256": 2561,
            "CVE": 2,
            "domain": 1307,
            "email": 1
          },
          "indicator_count": 10070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687605f986433ebf2673f0b8",
          "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring",
          "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}",
          "modified": "2025-08-14T07:05:00.239000",
          "created": "2025-07-15T07:40:41.180000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "entries",
            "gmt etag",
            "server",
            "ecacc",
            "serving ip",
            "address",
            "dom dom",
            "data upload",
            "extraction",
            "pdf report",
            "enter",
            "failed",
            "extraction data",
            "enter sc",
            "type",
            "extra data",
            "extri please",
            "review data",
            "excluded tous",
            "tui sugges",
            "find",
            "show",
            "at filer",
            "iocs",
            "levelbluelabs",
            "please",
            "included iocs",
            "excluded io",
            "find suggested",
            "types",
            "domain data",
            "search",
            "o please",
            "manually add",
            "c data",
            "o suggesteo",
            "include data",
            "review uus",
            "u exclude",
            "find s",
            "indicaok data",
            "dom doman",
            "filehash",
            "md5 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "copy",
            "push",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "ascii text",
            "size",
            "mitre att",
            "utf8",
            "null",
            "refresh",
            "body",
            "span",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "evasion att",
            "t1480 execution",
            "discovery att"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3597,
            "FileHash-MD5": 343,
            "domain": 547,
            "hostname": 1222,
            "FileHash-SHA1": 343,
            "FileHash-SHA256": 4464,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 10518,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "249 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IDS: Win32.Scar.hhrw POST",
        "http://fakejuko.site40/",
        "IDS: Data POST to an image file (jpg)",
        "IDS: Win32/Ibashade CnC Beacon",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "pegacloud.net"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win32:wormx-gen [wrm]",
            "Pegasus - mob-s0005",
            "Worm:win32:drolnux"
          ],
          "industries": [
            "Technology",
            "Government",
            "Telecommunications"
          ],
          "unique_indicators": 20607
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/skillgames-p2p.bet",
    "whois": "http://whois.domaintools.com/skillgames-p2p.bet",
    "domain": "skillgames-p2p.bet",
    "hostname": "api.skillgames-p2p.bet"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "6952fbca42c1b0da7431e6a7",
      "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ",
      "description": "",
      "modified": "2025-12-29T22:08:10.280000",
      "created": "2025-12-29T22:08:10.280000",
      "tags": [
        "backdoor",
        "cyprus",
        "trojan",
        "mtb sep",
        "passive dns",
        "ddos",
        "mtb oct",
        "mtb aug",
        "ipv4 add",
        "smokeloader",
        "trojandropper",
        "extraction",
        "se extraction",
        "failed",
        "data upload",
        "enter s",
        "enter sc",
        "data u",
        "extrac please",
        "prop",
        "extre data",
        "type",
        "extr data",
        "include review",
        "exclude",
        "find s",
        "typ data",
        "source tir",
        "extri",
        "exclude sugges",
        "se type",
        "extra",
        "include data",
        "exclude review",
        "show",
        "showinil tvnes",
        "dom dom",
        "sc cat959",
        "drop",
        "pulse pulses",
        "worm",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "susp",
        "cyprus showing",
        "entries",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "date",
        "registrar",
        "se cre",
        "pul use",
        "url list",
        "status http",
        "linkid182227",
        "linkid151642",
        "first",
        "domain list",
        "ii llc",
        "sc data",
        "ukl extract",
        "hiloti style",
        "msle",
        "win3 data",
        "onio",
        "observea",
        "data data",
        "stop data",
        "monitored target",
        "tsara",
        "pegasus",
        "social engineering"
      ],
      "references": [
        "http://fakejuko.site40/",
        "pegacloud.net",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Win32.Scar.hhrw POST",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Data POST to an image file (jpg)",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:WormX-gen [Wrm]",
          "display_name": "Win32:WormX-gen [Wrm]",
          "target": null
        },
        {
          "id": "Worm:Win32:Drolnux",
          "display_name": "Worm:Win32:Drolnux",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "6877422df67773a07ef450c2",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1630,
        "URL": 4078,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 246,
        "FileHash-SHA256": 2561,
        "CVE": 2,
        "domain": 1307,
        "email": 1
      },
      "indicator_count": 10070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "111 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6877422df67773a07ef450c2",
      "name": "Pegasus / Pegacloud - Infiltration",
      "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.",
      "modified": "2025-08-15T05:01:22.570000",
      "created": "2025-07-16T06:09:49.704000",
      "tags": [
        "backdoor",
        "cyprus",
        "trojan",
        "mtb sep",
        "passive dns",
        "ddos",
        "mtb oct",
        "mtb aug",
        "ipv4 add",
        "smokeloader",
        "trojandropper",
        "extraction",
        "se extraction",
        "failed",
        "data upload",
        "enter s",
        "enter sc",
        "data u",
        "extrac please",
        "prop",
        "extre data",
        "type",
        "extr data",
        "include review",
        "exclude",
        "find s",
        "typ data",
        "source tir",
        "extri",
        "exclude sugges",
        "se type",
        "extra",
        "include data",
        "exclude review",
        "show",
        "showinil tvnes",
        "dom dom",
        "sc cat959",
        "drop",
        "pulse pulses",
        "worm",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "susp",
        "cyprus showing",
        "entries",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "date",
        "registrar",
        "se cre",
        "pul use",
        "url list",
        "status http",
        "linkid182227",
        "linkid151642",
        "first",
        "domain list",
        "ii llc",
        "sc data",
        "ukl extract",
        "hiloti style",
        "msle",
        "win3 data",
        "onio",
        "observea",
        "data data",
        "stop data",
        "monitored target",
        "tsara",
        "pegasus",
        "social engineering"
      ],
      "references": [
        "http://fakejuko.site40/",
        "pegacloud.net",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Win32.Scar.hhrw POST",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Data POST to an image file (jpg)",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:WormX-gen [Wrm]",
          "display_name": "Win32:WormX-gen [Wrm]",
          "target": null
        },
        {
          "id": "Worm:Win32:Drolnux",
          "display_name": "Worm:Win32:Drolnux",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1630,
        "URL": 4078,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 246,
        "FileHash-SHA256": 2561,
        "CVE": 2,
        "domain": 1307,
        "email": 1
      },
      "indicator_count": 10070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687605f986433ebf2673f0b8",
      "name": "Win.Malware.Downloadguide-6803841-0 | Patient Monitoring",
      "description": "Part of an elaborate, unrelenting espionage campaign , multiple compromises, targeting.\n> alf:PUA:Win32/DownloadGuide \nLink below found in previous Pulse -[http://s0.patient.media/res/f91b97f6b547405cb4370cbb003dfea2-jquery-1.11.1.min.js.gzip]\n\u2022 Win.Malware.Downloadguide-6803841-0\nYara:\nresearch_pe_signed_outside_timestamp\n\u2022\nkernel32_dll_xor_exe_key_51_key_byte_encoded \u2022\nxor_0x33_kernel32_dll \u2022 \nConcerning: {Domain\tAddress\tRegistrar\tCountry\ns0.patient.media\n-\tGoDaddy.com, LLC\nOrganization: Egton Medical Information Systems Limited\nName Server: ns34.domaincontrol.com\nCreation Date: 2015-01-12T16:20:56}\n\n{https://www.anyxxxtube.net/search-porn/tsara-brashears/}\n{https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net}\n{wallpapers-nature.com}\n{https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian}",
      "modified": "2025-08-14T07:05:00.239000",
      "created": "2025-07-15T07:40:41.180000",
      "tags": [
        "url http",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "entries",
        "gmt etag",
        "server",
        "ecacc",
        "serving ip",
        "address",
        "dom dom",
        "data upload",
        "extraction",
        "pdf report",
        "enter",
        "failed",
        "extraction data",
        "enter sc",
        "type",
        "extra data",
        "extri please",
        "review data",
        "excluded tous",
        "tui sugges",
        "find",
        "show",
        "at filer",
        "iocs",
        "levelbluelabs",
        "please",
        "included iocs",
        "excluded io",
        "find suggested",
        "types",
        "domain data",
        "search",
        "o please",
        "manually add",
        "c data",
        "o suggesteo",
        "include data",
        "review uus",
        "u exclude",
        "find s",
        "indicaok data",
        "dom doman",
        "filehash",
        "md5 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "copy",
        "push",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "ascii text",
        "size",
        "mitre att",
        "utf8",
        "null",
        "refresh",
        "body",
        "span",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "evasion att",
        "t1480 execution",
        "discovery att"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3597,
        "FileHash-MD5": 343,
        "domain": 547,
        "hostname": 1222,
        "FileHash-SHA1": 343,
        "FileHash-SHA256": 4464,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 10518,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "249 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api.skillgames-p2p.bet",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api.skillgames-p2p.bet",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776685701.6260123
}