{
  "type": "URL",
  "indicator": "https://apps.db.ripe.net/db-web-ui/query",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://apps.db.ripe.net/db-web-ui/query",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "whitelist",
        "message": "Whitelisted domain ripe.net",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain ripe.net",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 2711595026,
      "indicator": "https://apps.db.ripe.net/db-web-ui/query",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 11,
      "pulses": [
        {
          "id": "69eb254f17eb4a2a990f07e5",
          "name": "LevelBlue - Open Threat Exchange",
          "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]",
          "modified": "2026-05-28T07:10:11.800000",
          "created": "2026-04-24T08:09:51.488000",
          "tags": [
            "pdfkit",
            "cve202225765",
            "exploit script",
            "github",
            "unicordev",
            "cves",
            "xml external",
            "entity",
            "pdfs",
            "knowledge base",
            "python",
            "mozilla",
            "virustotal",
            "cisa",
            "apple",
            "microsoft",
            "pdfkit ruby",
            "remote code",
            "execution",
            "urls",
            "malware",
            "raid",
            "caddywiper",
            "wipes",
            "cve202543529",
            "webkit",
            "february",
            "cve202620643",
            "bypass",
            "march",
            "webkit bug",
            "command",
            "control",
            "levelblue",
            "open threat"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wipes",
              "display_name": "Wipes",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1084,
            "FileHash-SHA1": 874,
            "FileHash-SHA256": 3052,
            "CVE": 36,
            "domain": 437,
            "hostname": 1086,
            "URL": 1411,
            "CIDR": 15,
            "email": 13
          },
          "indicator_count": 8008,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "3 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69ec8b61499d6a79bd3d6a14",
          "name": "Arin assigned Ripe Unmanaged Domain Expired Certificate Unsigned DNSSEC Daily Update",
          "description": "[full list of names and details for the RIPE website, which was created in the early hours of the morning of 10 October, 2021:-1-28 September.. and the following] Who is running Arin? Theres a problem. Reported to me: When a user asked them + IANA for help long ago they recieved worsening attacks. Why is there no governence for our internet registries. Certificate abuse is higher than ever, there should be grave concern over this. The RIPE intersect is a result of PA shortcomings. \"Null\" \"Unmanaged\" and \"ASNONE\" I find 100s of a day. This shortcoming and poor oversight can effectively compromise an entire country. Allegedly Targeting people who flag concerns in good faith with the website saying \"be nice\" is the least classy thing Ive ever seen. Make the internet great again.",
          "modified": "2026-05-25T09:01:47.653000",
          "created": "2026-04-25T09:37:37.473000",
          "tags": [
            "dmzhost descr",
            "assigned pa",
            "creation date",
            "unmanaged",
            "other address",
            "amsterdam",
            "abuse contact",
            "thumbprint",
            "ripe ncc",
            "ripe network",
            "nethandle",
            "organization",
            "ripe",
            "date",
            "please note",
            "ripe database",
            "resourcelink",
            "orgid",
            "as396073 city",
            "orgtechhandle",
            "address",
            "srl orgabuseref",
            "postalcode",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "issuer",
            "cncpanel",
            "authority cus",
            "validity",
            "subject public",
            "key info",
            "ascii text",
            "label unmanaged"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 3,
            "URL": 32,
            "domain": 10,
            "email": 6,
            "hostname": 99,
            "FileHash-SHA256": 10,
            "FileHash-SHA1": 11,
            "FileHash-MD5": 9,
            "URI": 2
          },
          "indicator_count": 182,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "6 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a11378a9eb9415f8a735969",
          "name": "VIP Keylogger \u2022 Snakelogger | VirusTotal -rpt: 1/1/25",
          "description": "[A full list of names and names for the RIPE NCC region has been published by the Royal Commission on Internet Relocation (RCC) on the website of the org, which is based in Amsterdam] < pretext",
          "modified": "2026-05-23T05:14:14.195000",
          "created": "2026-05-23T05:13:46.510000",
          "tags": [
            "please",
            "javascript",
            "cname",
            "data c",
            "accept",
            "file type",
            "file size",
            "mwdb",
            "bazaar",
            "sha3384",
            "ssdeep",
            "virtual address",
            "shutdown",
            "payload",
            "guard",
            "registers",
            "loads",
            "handle",
            "ripe ncc",
            "ripe network",
            "entity gcl1mnt",
            "whois lookup",
            "netrange",
            "nethandle",
            "organization",
            "ripe",
            "please note",
            "VIP keylogger",
            "Snake keylogger"
          ],
          "references": [
            "https://www.virustotal.com/gui/file/367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2/behavior",
            "https://vtbehaviour.commondatastorage.googleapis.com/367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779512523&Signature=C9LpDx0JzeruofyGcoAFQOA%2FmCTqKEqDqIL9Fp0hCnYCTxFLuUk%2FpGIqciRlTgjrB%2BTeI9AnQxzk9I6epfDw4Eo%2FBc7mmNCkKwIGqMsg1Wom7ZaYr%2FmojnD50m%2FfzOQArTw%2FA0ZNmNoifJWyv3K6zy2uCFA3FEHY52eaPqEBAzhp%2BxF%2Fku65SsHd8iGD4wDz6meymunlFzS4p%2F9B4rBqTM78GTgNcIewny3SHsiQdB"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1486",
              "name": "Data Encrypted for Impact",
              "display_name": "T1486 - Data Encrypted for Impact"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1552",
              "name": "Unsecured Credentials",
              "display_name": "T1552 - Unsecured Credentials"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 24,
            "FileHash-MD5": 9,
            "FileHash-SHA1": 11,
            "FileHash-SHA256": 4,
            "URL": 32,
            "domain": 3,
            "hostname": 46,
            "CIDR": 1
          },
          "indicator_count": 130,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "8 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0531d9bdfbde0596b60e7f",
          "name": "Malicious IP",
          "description": "194.33.45.197",
          "modified": "2026-05-14T02:31:24.705000",
          "created": "2026-05-14T02:22:17.834000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 3,
            "CIDR": 4,
            "URL": 41,
            "email": 4,
            "hostname": 14
          },
          "indicator_count": 66,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "17 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fdc02a184d8d0f3370b069",
          "name": "ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.",
          "description": "interesting. 2000-06-05T14:09:35Z\nDNSSEC: unsigned\nDomain Name: GOTOCFR.COM\nDomain Status:  https://icann.org/epp#clientTransferProhibited\nName Server: NS37.WORLDNIC.COM\nName Server: NS38.WORLDNIC.COM\nRegistrant City: 3f16518cc21288a8\nRegistrant Country: US\nRegistrant Email: a07a5df6ca9e975bs@gotocfr.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: b3c25287c0f8ed51\nRegistrant Name: 3432650ec337c945\nRegistrant Organization: 3432650ec337c945\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: a8108981ed146828\nRegistrant Postal Code: 22ba98fa33e9a7d1\nRegistrant State/Province: 2f0a6dc5401e8a9a\nRegistrant Street: c4d735c293d4e708\nRegistrar Abuse Contact Email: domain.operations@web.com\nRegistrar Abuse Contact Phone: +1.8777228662\nRegistrar IANA ID: 2\nRegistrar URL: http://networksolutions.com\nRegistrar WHOIS Server: whois.networksolutions.com\nRegistrar: Network Solutions, LLC\nRegistry Domain ID: 28566423_DOMAIN_COM-VRSN\nUpdated Date: 2026-04-06T06:20:14Z",
          "modified": "2026-05-09T07:30:09.404000",
          "created": "2026-05-08T10:51:22.795000",
          "tags": [
            "msie",
            "chrome",
            "passive dns",
            "date",
            "urls",
            "fabricating and",
            "type",
            "media type",
            "gmt content",
            "certificate",
            "title",
            "body",
            "encrypt",
            "graph summary",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "code",
            "email",
            "server",
            "admin country",
            "registrant name",
            "and repair",
            "expiration date",
            "registry domain",
            "registrar iana",
            "creation date",
            "admin city",
            "key algorithm",
            "registrar abuse",
            "dnssec",
            "domain name",
            "status",
            "city",
            "us registrant",
            "registrant fax",
            "marshfield ssl",
            "common name",
            "issued",
            "supporte",
            "charter",
            "llc united",
            "statesunited",
            "new london",
            "i20100 may",
            "diesel",
            "ripe ncc",
            "ripe network",
            "abuse contact",
            "orgid",
            "orgtechhandle",
            "address",
            "orgabuseref",
            "postalcode",
            "ripe",
            "cidr",
            "ripe database",
            "orgabuseemail",
            "orgabusehandle",
            "nethandle",
            "thumbprint",
            "handle",
            "address range",
            "network name",
            "allocation type",
            "allocated pa",
            "whois server",
            "organization",
            "please note",
            "ip address",
            "google",
            "redacted for",
            "privacy admin",
            "privacy",
            "privacy tech",
            "street",
            "stateprovince",
            "form",
            "tech"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 45,
            "IPv4": 32,
            "URL": 932,
            "domain": 51,
            "email": 9,
            "hostname": 186,
            "FileHash-SHA256": 43,
            "FileHash-MD5": 3,
            "CIDR": 3
          },
          "indicator_count": 1304,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "22 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fdc02bea1e4ec923b01688",
          "name": "ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.",
          "description": "interesting. 2000-06-05T14:09:35Z\nDNSSEC: unsigned\nDomain Name: GOTOCFR.COM\nDomain Status:  https://icann.org/epp#clientTransferProhibited\nName Server: NS37.WORLDNIC.COM\nName Server: NS38.WORLDNIC.COM\nRegistrant City: 3f16518cc21288a8\nRegistrant Country: US\nRegistrant Email: a07a5df6ca9e975bs@gotocfr.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: b3c25287c0f8ed51\nRegistrant Name: 3432650ec337c945\nRegistrant Organization: 3432650ec337c945\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: a8108981ed146828\nRegistrant Postal Code: 22ba98fa33e9a7d1\nRegistrant State/Province: 2f0a6dc5401e8a9a\nRegistrant Street: c4d735c293d4e708\nRegistrar Abuse Contact Email: domain.operations@web.com\nRegistrar Abuse Contact Phone: +1.8777228662\nRegistrar IANA ID: 2\nRegistrar URL: http://networksolutions.com\nRegistrar WHOIS Server: whois.networksolutions.com\nRegistrar: Network Solutions, LLC\nRegistry Domain ID: 28566423_DOMAIN_COM-VRSN\nUpdated Date: 2026-04-06T06:20:14Z",
          "modified": "2026-05-09T03:07:39.308000",
          "created": "2026-05-08T10:51:23.184000",
          "tags": [
            "msie",
            "chrome",
            "passive dns",
            "date",
            "urls",
            "fabricating and",
            "type",
            "media type",
            "gmt content",
            "certificate",
            "title",
            "body",
            "encrypt",
            "graph summary",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus olet",
            "encrypt cnr12",
            "validity",
            "subject public",
            "key info",
            "code",
            "email",
            "server",
            "admin country",
            "registrant name",
            "and repair",
            "expiration date",
            "registry domain",
            "registrar iana",
            "creation date",
            "admin city",
            "key algorithm",
            "registrar abuse",
            "dnssec",
            "domain name",
            "status",
            "city",
            "us registrant",
            "registrant fax",
            "marshfield ssl",
            "common name",
            "issued",
            "supporte",
            "charter",
            "llc united",
            "statesunited",
            "new london",
            "i20100 may",
            "diesel",
            "ripe ncc",
            "ripe network",
            "abuse contact",
            "orgid",
            "orgtechhandle",
            "address",
            "orgabuseref",
            "postalcode",
            "ripe",
            "cidr",
            "ripe database",
            "orgabuseemail",
            "orgabusehandle",
            "nethandle",
            "thumbprint",
            "handle",
            "address range",
            "network name",
            "allocation type",
            "allocated pa",
            "whois server",
            "organization",
            "please note",
            "ip address",
            "google",
            "redacted for",
            "privacy admin",
            "privacy",
            "privacy tech",
            "street",
            "stateprovince",
            "form",
            "tech"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 236,
            "IPv4": 315,
            "URL": 932,
            "domain": 1040,
            "email": 65,
            "hostname": 1049,
            "FileHash-SHA256": 960,
            "FileHash-MD5": 301,
            "CIDR": 39,
            "IPv6": 68,
            "CVE": 890,
            "SSLCertFingerprint": 16
          },
          "indicator_count": 5911,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "22 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69fd8fcf280068179ca6d174",
          "name": "Over 1 Million Comm. Files. 158 referring malic tagged.",
          "description": "0befb3ee094b270c981816a69da00a000572f38d71772578cd7e2001d, as part of a series of events.\nacroipm2.adobe.[com]\nadobe.[com]",
          "modified": "2026-05-08T07:59:04.198000",
          "created": "2026-05-08T07:25:03.312000",
          "tags": [
            "win32 dll",
            "win32 exe",
            "com laude",
            "readermessages",
            "microsoft",
            "ltd dba",
            "nomiq",
            "network capture",
            "text",
            "gzip",
            "first",
            "thumbprint",
            "code",
            "email",
            "san jose",
            "server",
            "registrar abuse",
            "admin country",
            "expiration date",
            "registry domain",
            "registrar iana",
            "date",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "cname",
            "aaaa",
            "ttl value",
            "key identifier",
            "full name",
            "v3 serial",
            "number",
            "cus odigicert",
            "inc cndigicert",
            "global g3",
            "tls ecc",
            "sha384",
            "ca1 validity",
            "info",
            "domain",
            "expiry date",
            "united",
            "update date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 145,
            "FileHash-SHA1": 159,
            "FileHash-SHA256": 546,
            "IPv4": 314,
            "URL": 164,
            "domain": 52,
            "hostname": 210,
            "email": 6,
            "IPv6": 2,
            "CIDR": 6
          },
          "indicator_count": 1604,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "23 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f97a905451e3304319988b",
          "name": ".may 4 clone own on may 5",
          "description": "",
          "modified": "2026-05-07T02:57:38.229000",
          "created": "2026-05-05T05:05:20.493000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "69f7fa1a282840a6e0aa370c",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 341,
            "FileHash-SHA1": 368,
            "FileHash-SHA256": 3143,
            "hostname": 2037,
            "IPv4": 186,
            "URL": 3288,
            "CIDR": 12,
            "email": 43,
            "domain": 1645,
            "URI": 1,
            "SSLCertFingerprint": 18,
            "CVE": 1
          },
          "indicator_count": 11083,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "24 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f7fa1a282840a6e0aa370c",
          "name": "May the 4th be with... every destructed file that never died",
          "description": "[undreds of thousands of people have been signing a petition calling for the removal of the president, Barack Obama, from the White House and the UK's prime minister, Theresa May, to be remove] The wording here. Its also May3rd not May 4th.",
          "modified": "2026-05-05T05:04:02.911000",
          "created": "2026-05-04T01:44:57.811000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 341,
            "FileHash-SHA1": 368,
            "FileHash-SHA256": 3142,
            "hostname": 1890,
            "IPv4": 162,
            "URL": 3241,
            "CIDR": 12,
            "email": 37,
            "domain": 1616,
            "URI": 1,
            "SSLCertFingerprint": 18
          },
          "indicator_count": 10828,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "26 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69b7c1b4a66f8f37f4a479eb",
          "name": "Bunny \"Bot\".. ahem.",
          "description": "recomend blacklist: bunnybot.ru\nbunnybots.ru",
          "modified": "2026-04-15T09:12:52.422000",
          "created": "2026-03-16T08:39:16.304000",
          "tags": [
            "strings http",
            "community score"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 79,
            "FileHash-MD5": 72,
            "FileHash-SHA1": 73,
            "FileHash-SHA256": 93,
            "domain": 7,
            "hostname": 41,
            "CIDR": 8,
            "email": 8
          },
          "indicator_count": 381,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "46 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a185462e3c17c346bcdf79",
          "name": "The Trans-Pacific Mesh & Starfield Pipeline Subversion",
          "description": "The September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirm an advanced architectural alignment targeting the Hillsboro \"Silicon Forest\" ring and the TallComponents (.NET) document pipeline. By nesting an unauthorized clientAuth extension within a legitimate Starfield (Mesh Digital) signature, the operative successfully bridged the gap between web traffic and hardware-level telematics.\nThis campaign weaponized the 159,942 Majestic Trust Flow to validate a Serial 1 SOA shadow zone, neutralizing filters while executing ASP.NET Core (Kestrel) request smuggling via the 13.32.205.51 node. This subversion is evidenced by the 60-second TTL oscillation of 3.169.202.x clusters, creating a detectable \"fast-flux\" latency at the HIO52 (Hillsboro) edge. Finally, the Mesh Digital registrant pivot to hex-encoded 34326... and 1f8f41... identifiers secures the Tallfield Pipeline\u2014a hijacked Azure-hosted backend for identity packaging of Amex and UGA credentials.",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T11:51:34.696000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 710,
            "URL": 355,
            "hostname": 252,
            "CVE": 4,
            "CIDR": 6,
            "FileHash-MD5": 615,
            "FileHash-SHA1": 585,
            "email": 21,
            "FileHash-SHA256": 4316,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 6866,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "60 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://vtbehaviour.commondatastorage.googleapis.com/367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779512523&Signature=C9LpDx0JzeruofyGcoAFQOA%2FmCTqKEqDqIL9Fp0hCnYCTxFLuUk%2FpGIqciRlTgjrB%2BTeI9AnQxzk9I6epfDw4Eo%2FBc7mmNCkKwIGqMsg1Wom7ZaYr%2FmojnD50m%2FfzOQArTw%2FA0ZNmNoifJWyv3K6zy2uCFA3FEHY52eaPqEBAzhp%2BxF%2Fku65SsHd8iGD4wDz6meymunlFzS4p%2F9B4rBqTM78GTgNcIewny3SHsiQdB",
        "https://www.virustotal.com/gui/file/367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2/behavior",
        "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Wipes"
          ],
          "industries": [],
          "unique_indicators": 18377
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/ripe.net",
    "whois": "http://whois.domaintools.com/ripe.net",
    "domain": "ripe.net",
    "hostname": "apps.db.ripe.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 11,
  "pulses": [
    {
      "id": "69eb254f17eb4a2a990f07e5",
      "name": "LevelBlue - Open Threat Exchange",
      "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]",
      "modified": "2026-05-28T07:10:11.800000",
      "created": "2026-04-24T08:09:51.488000",
      "tags": [
        "pdfkit",
        "cve202225765",
        "exploit script",
        "github",
        "unicordev",
        "cves",
        "xml external",
        "entity",
        "pdfs",
        "knowledge base",
        "python",
        "mozilla",
        "virustotal",
        "cisa",
        "apple",
        "microsoft",
        "pdfkit ruby",
        "remote code",
        "execution",
        "urls",
        "malware",
        "raid",
        "caddywiper",
        "wipes",
        "cve202543529",
        "webkit",
        "february",
        "cve202620643",
        "bypass",
        "march",
        "webkit bug",
        "command",
        "control",
        "levelblue",
        "open threat"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wipes",
          "display_name": "Wipes",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1084,
        "FileHash-SHA1": 874,
        "FileHash-SHA256": 3052,
        "CVE": 36,
        "domain": 437,
        "hostname": 1086,
        "URL": 1411,
        "CIDR": 15,
        "email": 13
      },
      "indicator_count": 8008,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 70,
      "modified_text": "3 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69ec8b61499d6a79bd3d6a14",
      "name": "Arin assigned Ripe Unmanaged Domain Expired Certificate Unsigned DNSSEC Daily Update",
      "description": "[full list of names and details for the RIPE website, which was created in the early hours of the morning of 10 October, 2021:-1-28 September.. and the following] Who is running Arin? Theres a problem. Reported to me: When a user asked them + IANA for help long ago they recieved worsening attacks. Why is there no governence for our internet registries. Certificate abuse is higher than ever, there should be grave concern over this. The RIPE intersect is a result of PA shortcomings. \"Null\" \"Unmanaged\" and \"ASNONE\" I find 100s of a day. This shortcoming and poor oversight can effectively compromise an entire country. Allegedly Targeting people who flag concerns in good faith with the website saying \"be nice\" is the least classy thing Ive ever seen. Make the internet great again.",
      "modified": "2026-05-25T09:01:47.653000",
      "created": "2026-04-25T09:37:37.473000",
      "tags": [
        "dmzhost descr",
        "assigned pa",
        "creation date",
        "unmanaged",
        "other address",
        "amsterdam",
        "abuse contact",
        "thumbprint",
        "ripe ncc",
        "ripe network",
        "nethandle",
        "organization",
        "ripe",
        "date",
        "please note",
        "ripe database",
        "resourcelink",
        "orgid",
        "as396073 city",
        "orgtechhandle",
        "address",
        "srl orgabuseref",
        "postalcode",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "issuer",
        "cncpanel",
        "authority cus",
        "validity",
        "subject public",
        "key info",
        "ascii text",
        "label unmanaged"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 3,
        "URL": 32,
        "domain": 10,
        "email": 6,
        "hostname": 99,
        "FileHash-SHA256": 10,
        "FileHash-SHA1": 11,
        "FileHash-MD5": 9,
        "URI": 2
      },
      "indicator_count": 182,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "6 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a11378a9eb9415f8a735969",
      "name": "VIP Keylogger \u2022 Snakelogger | VirusTotal -rpt: 1/1/25",
      "description": "[A full list of names and names for the RIPE NCC region has been published by the Royal Commission on Internet Relocation (RCC) on the website of the org, which is based in Amsterdam] < pretext",
      "modified": "2026-05-23T05:14:14.195000",
      "created": "2026-05-23T05:13:46.510000",
      "tags": [
        "please",
        "javascript",
        "cname",
        "data c",
        "accept",
        "file type",
        "file size",
        "mwdb",
        "bazaar",
        "sha3384",
        "ssdeep",
        "virtual address",
        "shutdown",
        "payload",
        "guard",
        "registers",
        "loads",
        "handle",
        "ripe ncc",
        "ripe network",
        "entity gcl1mnt",
        "whois lookup",
        "netrange",
        "nethandle",
        "organization",
        "ripe",
        "please note",
        "VIP keylogger",
        "Snake keylogger"
      ],
      "references": [
        "https://www.virustotal.com/gui/file/367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2/behavior",
        "https://vtbehaviour.commondatastorage.googleapis.com/367f6f714a6eea148124d4669325471bb9bbd657920d148bfa7a31bc0646aaf2_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1779512523&Signature=C9LpDx0JzeruofyGcoAFQOA%2FmCTqKEqDqIL9Fp0hCnYCTxFLuUk%2FpGIqciRlTgjrB%2BTeI9AnQxzk9I6epfDw4Eo%2FBc7mmNCkKwIGqMsg1Wom7ZaYr%2FmojnD50m%2FfzOQArTw%2FA0ZNmNoifJWyv3K6zy2uCFA3FEHY52eaPqEBAzhp%2BxF%2Fku65SsHd8iGD4wDz6meymunlFzS4p%2F9B4rBqTM78GTgNcIewny3SHsiQdB"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1486",
          "name": "Data Encrypted for Impact",
          "display_name": "T1486 - Data Encrypted for Impact"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1552",
          "name": "Unsecured Credentials",
          "display_name": "T1552 - Unsecured Credentials"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 24,
        "FileHash-MD5": 9,
        "FileHash-SHA1": 11,
        "FileHash-SHA256": 4,
        "URL": 32,
        "domain": 3,
        "hostname": 46,
        "CIDR": 1
      },
      "indicator_count": 130,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "8 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0531d9bdfbde0596b60e7f",
      "name": "Malicious IP",
      "description": "194.33.45.197",
      "modified": "2026-05-14T02:31:24.705000",
      "created": "2026-05-14T02:22:17.834000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 3,
        "CIDR": 4,
        "URL": 41,
        "email": 4,
        "hostname": 14
      },
      "indicator_count": 66,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "17 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fdc02a184d8d0f3370b069",
      "name": "ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.",
      "description": "interesting. 2000-06-05T14:09:35Z\nDNSSEC: unsigned\nDomain Name: GOTOCFR.COM\nDomain Status:  https://icann.org/epp#clientTransferProhibited\nName Server: NS37.WORLDNIC.COM\nName Server: NS38.WORLDNIC.COM\nRegistrant City: 3f16518cc21288a8\nRegistrant Country: US\nRegistrant Email: a07a5df6ca9e975bs@gotocfr.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: b3c25287c0f8ed51\nRegistrant Name: 3432650ec337c945\nRegistrant Organization: 3432650ec337c945\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: a8108981ed146828\nRegistrant Postal Code: 22ba98fa33e9a7d1\nRegistrant State/Province: 2f0a6dc5401e8a9a\nRegistrant Street: c4d735c293d4e708\nRegistrar Abuse Contact Email: domain.operations@web.com\nRegistrar Abuse Contact Phone: +1.8777228662\nRegistrar IANA ID: 2\nRegistrar URL: http://networksolutions.com\nRegistrar WHOIS Server: whois.networksolutions.com\nRegistrar: Network Solutions, LLC\nRegistry Domain ID: 28566423_DOMAIN_COM-VRSN\nUpdated Date: 2026-04-06T06:20:14Z",
      "modified": "2026-05-09T07:30:09.404000",
      "created": "2026-05-08T10:51:22.795000",
      "tags": [
        "msie",
        "chrome",
        "passive dns",
        "date",
        "urls",
        "fabricating and",
        "type",
        "media type",
        "gmt content",
        "certificate",
        "title",
        "body",
        "encrypt",
        "graph summary",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "code",
        "email",
        "server",
        "admin country",
        "registrant name",
        "and repair",
        "expiration date",
        "registry domain",
        "registrar iana",
        "creation date",
        "admin city",
        "key algorithm",
        "registrar abuse",
        "dnssec",
        "domain name",
        "status",
        "city",
        "us registrant",
        "registrant fax",
        "marshfield ssl",
        "common name",
        "issued",
        "supporte",
        "charter",
        "llc united",
        "statesunited",
        "new london",
        "i20100 may",
        "diesel",
        "ripe ncc",
        "ripe network",
        "abuse contact",
        "orgid",
        "orgtechhandle",
        "address",
        "orgabuseref",
        "postalcode",
        "ripe",
        "cidr",
        "ripe database",
        "orgabuseemail",
        "orgabusehandle",
        "nethandle",
        "thumbprint",
        "handle",
        "address range",
        "network name",
        "allocation type",
        "allocated pa",
        "whois server",
        "organization",
        "please note",
        "ip address",
        "google",
        "redacted for",
        "privacy admin",
        "privacy",
        "privacy tech",
        "street",
        "stateprovince",
        "form",
        "tech"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 45,
        "IPv4": 32,
        "URL": 932,
        "domain": 51,
        "email": 9,
        "hostname": 186,
        "FileHash-SHA256": 43,
        "FileHash-MD5": 3,
        "CIDR": 3
      },
      "indicator_count": 1304,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "22 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fdc02bea1e4ec923b01688",
      "name": "ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.",
      "description": "interesting. 2000-06-05T14:09:35Z\nDNSSEC: unsigned\nDomain Name: GOTOCFR.COM\nDomain Status:  https://icann.org/epp#clientTransferProhibited\nName Server: NS37.WORLDNIC.COM\nName Server: NS38.WORLDNIC.COM\nRegistrant City: 3f16518cc21288a8\nRegistrant Country: US\nRegistrant Email: a07a5df6ca9e975bs@gotocfr.com\nRegistrant Fax Ext: 3432650ec337c945\nRegistrant Fax: b3c25287c0f8ed51\nRegistrant Name: 3432650ec337c945\nRegistrant Organization: 3432650ec337c945\nRegistrant Phone Ext: 3432650ec337c945\nRegistrant Phone: a8108981ed146828\nRegistrant Postal Code: 22ba98fa33e9a7d1\nRegistrant State/Province: 2f0a6dc5401e8a9a\nRegistrant Street: c4d735c293d4e708\nRegistrar Abuse Contact Email: domain.operations@web.com\nRegistrar Abuse Contact Phone: +1.8777228662\nRegistrar IANA ID: 2\nRegistrar URL: http://networksolutions.com\nRegistrar WHOIS Server: whois.networksolutions.com\nRegistrar: Network Solutions, LLC\nRegistry Domain ID: 28566423_DOMAIN_COM-VRSN\nUpdated Date: 2026-04-06T06:20:14Z",
      "modified": "2026-05-09T03:07:39.308000",
      "created": "2026-05-08T10:51:23.184000",
      "tags": [
        "msie",
        "chrome",
        "passive dns",
        "date",
        "urls",
        "fabricating and",
        "type",
        "media type",
        "gmt content",
        "certificate",
        "title",
        "body",
        "encrypt",
        "graph summary",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus olet",
        "encrypt cnr12",
        "validity",
        "subject public",
        "key info",
        "code",
        "email",
        "server",
        "admin country",
        "registrant name",
        "and repair",
        "expiration date",
        "registry domain",
        "registrar iana",
        "creation date",
        "admin city",
        "key algorithm",
        "registrar abuse",
        "dnssec",
        "domain name",
        "status",
        "city",
        "us registrant",
        "registrant fax",
        "marshfield ssl",
        "common name",
        "issued",
        "supporte",
        "charter",
        "llc united",
        "statesunited",
        "new london",
        "i20100 may",
        "diesel",
        "ripe ncc",
        "ripe network",
        "abuse contact",
        "orgid",
        "orgtechhandle",
        "address",
        "orgabuseref",
        "postalcode",
        "ripe",
        "cidr",
        "ripe database",
        "orgabuseemail",
        "orgabusehandle",
        "nethandle",
        "thumbprint",
        "handle",
        "address range",
        "network name",
        "allocation type",
        "allocated pa",
        "whois server",
        "organization",
        "please note",
        "ip address",
        "google",
        "redacted for",
        "privacy admin",
        "privacy",
        "privacy tech",
        "street",
        "stateprovince",
        "form",
        "tech"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 236,
        "IPv4": 315,
        "URL": 932,
        "domain": 1040,
        "email": 65,
        "hostname": 1049,
        "FileHash-SHA256": 960,
        "FileHash-MD5": 301,
        "CIDR": 39,
        "IPv6": 68,
        "CVE": 890,
        "SSLCertFingerprint": 16
      },
      "indicator_count": 5911,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "22 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69fd8fcf280068179ca6d174",
      "name": "Over 1 Million Comm. Files. 158 referring malic tagged.",
      "description": "0befb3ee094b270c981816a69da00a000572f38d71772578cd7e2001d, as part of a series of events.\nacroipm2.adobe.[com]\nadobe.[com]",
      "modified": "2026-05-08T07:59:04.198000",
      "created": "2026-05-08T07:25:03.312000",
      "tags": [
        "win32 dll",
        "win32 exe",
        "com laude",
        "readermessages",
        "microsoft",
        "ltd dba",
        "nomiq",
        "network capture",
        "text",
        "gzip",
        "first",
        "thumbprint",
        "code",
        "email",
        "san jose",
        "server",
        "registrar abuse",
        "admin country",
        "expiration date",
        "registry domain",
        "registrar iana",
        "date",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "cname",
        "aaaa",
        "ttl value",
        "key identifier",
        "full name",
        "v3 serial",
        "number",
        "cus odigicert",
        "inc cndigicert",
        "global g3",
        "tls ecc",
        "sha384",
        "ca1 validity",
        "info",
        "domain",
        "expiry date",
        "united",
        "update date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 145,
        "FileHash-SHA1": 159,
        "FileHash-SHA256": 546,
        "IPv4": 314,
        "URL": 164,
        "domain": 52,
        "hostname": 210,
        "email": 6,
        "IPv6": 2,
        "CIDR": 6
      },
      "indicator_count": 1604,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "23 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f97a905451e3304319988b",
      "name": ".may 4 clone own on may 5",
      "description": "",
      "modified": "2026-05-07T02:57:38.229000",
      "created": "2026-05-05T05:05:20.493000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "69f7fa1a282840a6e0aa370c",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 341,
        "FileHash-SHA1": 368,
        "FileHash-SHA256": 3143,
        "hostname": 2037,
        "IPv4": 186,
        "URL": 3288,
        "CIDR": 12,
        "email": 43,
        "domain": 1645,
        "URI": 1,
        "SSLCertFingerprint": 18,
        "CVE": 1
      },
      "indicator_count": 11083,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "24 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f7fa1a282840a6e0aa370c",
      "name": "May the 4th be with... every destructed file that never died",
      "description": "[undreds of thousands of people have been signing a petition calling for the removal of the president, Barack Obama, from the White House and the UK's prime minister, Theresa May, to be remove] The wording here. Its also May3rd not May 4th.",
      "modified": "2026-05-05T05:04:02.911000",
      "created": "2026-05-04T01:44:57.811000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 341,
        "FileHash-SHA1": 368,
        "FileHash-SHA256": 3142,
        "hostname": 1890,
        "IPv4": 162,
        "URL": 3241,
        "CIDR": 12,
        "email": 37,
        "domain": 1616,
        "URI": 1,
        "SSLCertFingerprint": 18
      },
      "indicator_count": 10828,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "26 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69b7c1b4a66f8f37f4a479eb",
      "name": "Bunny \"Bot\".. ahem.",
      "description": "recomend blacklist: bunnybot.ru\nbunnybots.ru",
      "modified": "2026-04-15T09:12:52.422000",
      "created": "2026-03-16T08:39:16.304000",
      "tags": [
        "strings http",
        "community score"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 79,
        "FileHash-MD5": 72,
        "FileHash-SHA1": 73,
        "FileHash-SHA256": 93,
        "domain": 7,
        "hostname": 41,
        "CIDR": 8,
        "email": 8
      },
      "indicator_count": 381,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "46 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://apps.db.ripe.net/db-web-ui/query",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://apps.db.ripe.net/db-web-ui/query",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780225679.757487
}