{
  "type": "URL",
  "indicator": "https://b2b.twisttango.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://b2b.twisttango.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3778908473,
      "indicator": "https://b2b.twisttango.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68bbf3e40e3ce8a74aa89545",
          "name": "HCPF \u2022 The intricate relationships between the FIN7 group and members of the Conti gang",
          "description": "",
          "modified": "2025-10-06T08:03:23.285000",
          "created": "2025-09-06T08:42:12.787000",
          "tags": [
            "present feb",
            "united",
            "a domains",
            "present dec",
            "passive dns",
            "moved",
            "script domains",
            "script urls",
            "search",
            "title",
            "date",
            "http traffic",
            "http get",
            "match info",
            "downloads",
            "info",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "protocol t1095",
            "get http",
            "dns resolutions",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cnamazon rsa",
            "m03 oamazon",
            "thumbprint",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "ascii text",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "malware",
            "roboto",
            "android",
            "known exploited",
            "google",
            "salesloft drift",
            "sap s4hana",
            "cve202542957",
            "cisa",
            "sitecore",
            "linux",
            "france",
            "meta",
            "rokrat",
            "lizar",
            "project nemesis",
            "carbanak",
            "cobalt strike",
            "domino",
            "yara detections",
            "contacted",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious ids",
            "detections tls",
            "indicator role",
            "title added",
            "active related",
            "entries",
            "role title",
            "added active",
            "filehashmd5",
            "ipv4"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lizar",
              "display_name": "Lizar",
              "target": null
            },
            {
              "id": "Project Nemesis",
              "display_name": "Project Nemesis",
              "target": null
            },
            {
              "id": "Carbanak",
              "display_name": "Carbanak",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Domino",
              "display_name": "Domino",
              "target": null
            },
            {
              "id": "RokRAT",
              "display_name": "RokRAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [
            "Hospitality",
            "Financial"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 539,
            "FileHash-SHA1": 389,
            "FileHash-SHA256": 3386,
            "domain": 862,
            "hostname": 1155,
            "URL": 4091,
            "CVE": 3,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 10430,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "238 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65463631b46319b3aa1d071f",
          "name": "Qausar RAT - aig.com |",
          "description": "Compilation of research identifilocates aig.com Defense Division of Workers Compensation. \nMalicious & invasive tactics remain. Target seem to have been removed from, revenge porn campaign targeted name no longer auto populates, registrant seems poised for campaign.\nTactics include phishing, tracking, geotracking, device location, monitoring, side loading apps and remote access. \n\nQausar Rat identified:\nAlso known by the names CinaRAT or Yggdrasil, Quasar RAT is a C#-based remote administration tool capable of gathering system information, a list of running applications, files, keystrokes, screenshots, and executing arbitrary shell commands.",
          "modified": "2023-12-04T11:01:36.202000",
          "created": "2023-11-04T12:16:49.600000",
          "tags": [
            "general full",
            "url https",
            "reverse dns",
            "security tls",
            "protocol h2",
            "name value",
            "resource",
            "united",
            "asn16509",
            "amazon02",
            "main",
            "facebook",
            "http",
            "request chain",
            "november",
            "de page",
            "url history",
            "javascript",
            "meta",
            "page url",
            "redirected",
            "http redirect",
            "value",
            "mime type",
            "variables",
            "contexthub",
            "visitor object",
            "cq function",
            "sanitize object",
            "elqq",
            "domainpath name",
            "link",
            "property",
            "workers",
            "compensation",
            "login myaig",
            "liability",
            "contact",
            "a claim",
            "commercial auto",
            "login aig",
            "form",
            "cyber",
            "find",
            "team",
            "defense",
            "crime",
            "ransom",
            "energy",
            "cargo",
            "life",
            "media",
            "enterprise",
            "american international",
            "frankfurt",
            "germany",
            "october",
            "domains",
            "asn20940",
            "cisco",
            "umbrella rank",
            "domain",
            "de summary",
            "ssl certificate",
            "whois record",
            "whois whois",
            "malware",
            "network mooooda",
            "and china",
            "filter https",
            "dsp1",
            "keepaliveyes",
            "p11642963562",
            "quasar",
            "metro",
            "android",
            "djvu",
            "win32 exe",
            "win32 dll",
            "ms excel",
            "dao360",
            "spreadsheet",
            "files",
            "detections type",
            "name",
            "phishing",
            "tulach exploits",
            "falcon sandbox",
            "pattern match",
            "file",
            "script",
            "indicator",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "date",
            "unknown",
            "body",
            "error",
            "span",
            "class",
            "generator",
            "critical",
            "refresh",
            "open",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "suricata"
          ],
          "references": [
            "aig.com",
            "https://urlscan.io",
            "https://www.slatergordon.com.au/blog/revenge-porn-laws",
            "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1",
            "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311",
            "remoteaccess.aig.com",
            "https://remote.goeaston.net",
            "window.location.search",
            "location.search",
            "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk",
            "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net",
            "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
            "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/"
          ],
          "public": 1,
          "adversary": "American International",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "American International",
              "display_name": "American International",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [
            "Reinsurance",
            "Travel"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 117,
            "FileHash-SHA256": 1962,
            "domain": 575,
            "hostname": 1623,
            "FileHash-MD5": 123,
            "URL": 3670,
            "CVE": 2
          },
          "indicator_count": 8072,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "910 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "location.search",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "https://remote.goeaston.net",
        "remoteaccess.aig.com",
        "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net",
        "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk",
        "window.location.search",
        "https://www.slatergordon.com.au/blog/revenge-porn-laws",
        "aig.com",
        "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1",
        "https://urlscan.io",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "American International"
          ],
          "malware_families": [
            "Quasar rat",
            "Domino",
            "Ransomware",
            "Carbanak",
            "Rokrat",
            "American international",
            "Cobalt strike",
            "Lizar",
            "Project nemesis"
          ],
          "industries": [
            "Reinsurance",
            "Financial",
            "Hospitality",
            "Travel"
          ],
          "unique_indicators": 18805
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/twisttango.com",
    "whois": "http://whois.domaintools.com/twisttango.com",
    "domain": "twisttango.com",
    "hostname": "b2b.twisttango.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68bbf3e40e3ce8a74aa89545",
      "name": "HCPF \u2022 The intricate relationships between the FIN7 group and members of the Conti gang",
      "description": "",
      "modified": "2025-10-06T08:03:23.285000",
      "created": "2025-09-06T08:42:12.787000",
      "tags": [
        "present feb",
        "united",
        "a domains",
        "present dec",
        "passive dns",
        "moved",
        "script domains",
        "script urls",
        "search",
        "title",
        "date",
        "http traffic",
        "http get",
        "match info",
        "downloads",
        "info",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "protocol t1095",
        "get http",
        "dns resolutions",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cnamazon rsa",
        "m03 oamazon",
        "thumbprint",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "ascii text",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "malware",
        "roboto",
        "android",
        "known exploited",
        "google",
        "salesloft drift",
        "sap s4hana",
        "cve202542957",
        "cisa",
        "sitecore",
        "linux",
        "france",
        "meta",
        "rokrat",
        "lizar",
        "project nemesis",
        "carbanak",
        "cobalt strike",
        "domino",
        "yara detections",
        "contacted",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious ids",
        "detections tls",
        "indicator role",
        "title added",
        "active related",
        "entries",
        "role title",
        "added active",
        "filehashmd5",
        "ipv4"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lizar",
          "display_name": "Lizar",
          "target": null
        },
        {
          "id": "Project Nemesis",
          "display_name": "Project Nemesis",
          "target": null
        },
        {
          "id": "Carbanak",
          "display_name": "Carbanak",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Domino",
          "display_name": "Domino",
          "target": null
        },
        {
          "id": "RokRAT",
          "display_name": "RokRAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [
        "Hospitality",
        "Financial"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 539,
        "FileHash-SHA1": 389,
        "FileHash-SHA256": 3386,
        "domain": 862,
        "hostname": 1155,
        "URL": 4091,
        "CVE": 3,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 10430,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "238 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65463631b46319b3aa1d071f",
      "name": "Qausar RAT - aig.com |",
      "description": "Compilation of research identifilocates aig.com Defense Division of Workers Compensation. \nMalicious & invasive tactics remain. Target seem to have been removed from, revenge porn campaign targeted name no longer auto populates, registrant seems poised for campaign.\nTactics include phishing, tracking, geotracking, device location, monitoring, side loading apps and remote access. \n\nQausar Rat identified:\nAlso known by the names CinaRAT or Yggdrasil, Quasar RAT is a C#-based remote administration tool capable of gathering system information, a list of running applications, files, keystrokes, screenshots, and executing arbitrary shell commands.",
      "modified": "2023-12-04T11:01:36.202000",
      "created": "2023-11-04T12:16:49.600000",
      "tags": [
        "general full",
        "url https",
        "reverse dns",
        "security tls",
        "protocol h2",
        "name value",
        "resource",
        "united",
        "asn16509",
        "amazon02",
        "main",
        "facebook",
        "http",
        "request chain",
        "november",
        "de page",
        "url history",
        "javascript",
        "meta",
        "page url",
        "redirected",
        "http redirect",
        "value",
        "mime type",
        "variables",
        "contexthub",
        "visitor object",
        "cq function",
        "sanitize object",
        "elqq",
        "domainpath name",
        "link",
        "property",
        "workers",
        "compensation",
        "login myaig",
        "liability",
        "contact",
        "a claim",
        "commercial auto",
        "login aig",
        "form",
        "cyber",
        "find",
        "team",
        "defense",
        "crime",
        "ransom",
        "energy",
        "cargo",
        "life",
        "media",
        "enterprise",
        "american international",
        "frankfurt",
        "germany",
        "october",
        "domains",
        "asn20940",
        "cisco",
        "umbrella rank",
        "domain",
        "de summary",
        "ssl certificate",
        "whois record",
        "whois whois",
        "malware",
        "network mooooda",
        "and china",
        "filter https",
        "dsp1",
        "keepaliveyes",
        "p11642963562",
        "quasar",
        "metro",
        "android",
        "djvu",
        "win32 exe",
        "win32 dll",
        "ms excel",
        "dao360",
        "spreadsheet",
        "files",
        "detections type",
        "name",
        "phishing",
        "tulach exploits",
        "falcon sandbox",
        "pattern match",
        "file",
        "script",
        "indicator",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "date",
        "unknown",
        "body",
        "error",
        "span",
        "class",
        "generator",
        "critical",
        "refresh",
        "open",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "suricata"
      ],
      "references": [
        "aig.com",
        "https://urlscan.io",
        "https://www.slatergordon.com.au/blog/revenge-porn-laws",
        "https://thehackernews.com/2023/10/quasar-rat-leverages-dll-side-loading.html?m=1",
        "https://hybrid-analysis.com/sample/6f4fb33ffb44474e86928549ef3f1a51d0f3e9e8c8d7a08b71b2b59b5921d311",
        "remoteaccess.aig.com",
        "https://remote.goeaston.net",
        "window.location.search",
        "location.search",
        "https://s3.rexdl.com/android/game/Desktop-Dungeons-v11-Mod-www.Rexdl.com.apk",
        "ghb-unoadsrv-com.geodns.me.1.1.11cec3ef.roksit.net",
        "m.pornsexer.xxx.3.1.adiosfil.roksit.net",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/"
      ],
      "public": 1,
      "adversary": "American International",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "American International",
          "display_name": "American International",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        }
      ],
      "industries": [
        "Reinsurance",
        "Travel"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 117,
        "FileHash-SHA256": 1962,
        "domain": 575,
        "hostname": 1623,
        "FileHash-MD5": 123,
        "URL": 3670,
        "CVE": 2
      },
      "indicator_count": 8072,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "910 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://b2b.twisttango.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://b2b.twisttango.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780338290.451309
}