{
  "type": "URL",
  "indicator": "https://breached.vc/User-SnakeSplitter",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://breached.vc/User-SnakeSplitter",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3635657018,
      "indicator": "https://breached.vc/User-SnakeSplitter",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "655b9a90e44a70d0fbbde981",
          "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
          "description": "Domain stated ' SEIZED' by Departing Homeland Security\nSeizure links below seem a bit questionable: \n\nhttp://server3.elgenero.com/iprc_seized_banner.png\nhttp://kickass.to/IPRC_Seized_2016_kat.jpg\nhttp://kickass.to/the-adventures-of-tom-sawyer-t2068537.html\t\nhttp://bludv.tv/iprc_seized_banner.png\nhttp://z-lib.org/iprc_seized_banner.png\nIPRC_Seized_2016_kat.jpg\n... just banners? Moved and continue? Okay.\nListed below also listed in seized domain. Domains,URL's and Botnetwork Hosts still seem to exist.\nhttp://alohatube.xyz/search/tsara-brashears\nalohatube.xyz\nhttps://alohatube.xyz/search/tsara-brashears\nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/\nhttp://45.159.189.105/bot/regex\t\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbia\t\nnr-data.net",
          "modified": "2023-12-20T17:01:34.161000",
          "created": "2023-11-20T17:42:40.771000",
          "tags": [
            "safe site",
            "million",
            "cisco umbrella",
            "alexa top",
            "site",
            "tag count",
            "tld count",
            "jul jan",
            "team alexa",
            "count blacklist",
            "maltiverse",
            "redirme",
            "cronup threat",
            "intel malware",
            "malicious site",
            "malware",
            "no data",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "united",
            "cyber threat",
            "engineering",
            "team",
            "malware site",
            "covid19",
            "phishing site",
            "phishing",
            "phishtank",
            "bank",
            "zbot",
            "malicious",
            "download",
            "suppobox",
            "zeus",
            "nymaim",
            "matsnu",
            "artemis",
            "virut",
            "panama",
            "smsspy",
            "cobalt strike",
            "emotet",
            "bradesco",
            "stealer",
            "facebook",
            "service",
            "simda",
            "runescape",
            "cutwail",
            "unruy",
            "bandoo",
            "tinba",
            "pykspa",
            "domaiq",
            "ave maria",
            "citadel",
            "pony",
            "keitaro",
            "ponmocup",
            "ransomware",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha256",
            "sha1",
            "ascii text",
            "date",
            "unknown",
            "body",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "malicious url",
            "union",
            "unsafe",
            "node tcp",
            "traffic",
            "tor known",
            "tor relayrouter",
            "spammer",
            "threats et",
            "ssl certificate",
            "contacted",
            "whois record",
            "whois whois",
            "historical ssl",
            "apple ios",
            "resolutions",
            "bundled",
            "referrer",
            "collections",
            "android",
            "banker",
            "keylogger",
            "generic malware",
            "generic",
            "blacklist http",
            "ac32a",
            "heur",
            "alexa",
            "xtrat",
            "iframe",
            "installcore",
            "win64",
            "crack",
            "xrat",
            "nircmd",
            "swrort",
            "agent",
            "filetour",
            "cleaner",
            "patcher",
            "adload",
            "wacatac",
            "riskware",
            "acint",
            "conduit",
            "fakealert",
            "opencandy",
            "xtreme",
            "downldr",
            "outbreak",
            "iobit",
            "rostpay",
            "dropper",
            "mediaget",
            "installpack",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "presenoker",
            "fusioncore",
            "exploit",
            "filerepmetagen",
            "download json",
            "hostname",
            "hostnames",
            "mail spammer",
            "anonymizer",
            "firehol proxy",
            "asyncrat",
            "genkryptik",
            "fuery",
            "webtoolbar",
            "trojanspy",
            "dropped",
            "execution",
            "contacted urls",
            "http spammer",
            "host",
            "ip address",
            "site top",
            "site safe",
            "blacklist https",
            "tsara brashears",
            "kgs0",
            "kls0",
            "critical risk",
            "attack",
            "hacktool",
            "installer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Latvia",
            "Poland",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 46,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1117,
            "FileHash-SHA1": 664,
            "FileHash-SHA256": 3426,
            "domain": 977,
            "hostname": 2269,
            "URL": 5554,
            "CVE": 23,
            "URI": 8,
            "Mutex": 1
          },
          "indicator_count": 14039,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656a9c2eeebaf7b69d0e12ba",
          "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
          "description": "",
          "modified": "2023-12-20T17:01:34.161000",
          "created": "2023-12-02T02:53:34.585000",
          "tags": [
            "safe site",
            "million",
            "cisco umbrella",
            "alexa top",
            "site",
            "tag count",
            "tld count",
            "jul jan",
            "team alexa",
            "count blacklist",
            "maltiverse",
            "redirme",
            "cronup threat",
            "intel malware",
            "malicious site",
            "malware",
            "no data",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist",
            "united",
            "cyber threat",
            "engineering",
            "team",
            "malware site",
            "covid19",
            "phishing site",
            "phishing",
            "phishtank",
            "bank",
            "zbot",
            "malicious",
            "download",
            "suppobox",
            "zeus",
            "nymaim",
            "matsnu",
            "artemis",
            "virut",
            "panama",
            "smsspy",
            "cobalt strike",
            "emotet",
            "bradesco",
            "stealer",
            "facebook",
            "service",
            "simda",
            "runescape",
            "cutwail",
            "unruy",
            "bandoo",
            "tinba",
            "pykspa",
            "domaiq",
            "ave maria",
            "citadel",
            "pony",
            "keitaro",
            "ponmocup",
            "ransomware",
            "pattern match",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "misc attack",
            "sha256",
            "sha1",
            "ascii text",
            "date",
            "unknown",
            "body",
            "error",
            "class",
            "generator",
            "critical",
            "meta",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "malicious url",
            "union",
            "unsafe",
            "node tcp",
            "traffic",
            "tor known",
            "tor relayrouter",
            "spammer",
            "threats et",
            "ssl certificate",
            "contacted",
            "whois record",
            "whois whois",
            "historical ssl",
            "apple ios",
            "resolutions",
            "bundled",
            "referrer",
            "collections",
            "android",
            "banker",
            "keylogger",
            "generic malware",
            "generic",
            "blacklist http",
            "ac32a",
            "heur",
            "alexa",
            "xtrat",
            "iframe",
            "installcore",
            "win64",
            "crack",
            "xrat",
            "nircmd",
            "swrort",
            "agent",
            "filetour",
            "cleaner",
            "patcher",
            "adload",
            "wacatac",
            "riskware",
            "acint",
            "conduit",
            "fakealert",
            "opencandy",
            "xtreme",
            "downldr",
            "outbreak",
            "iobit",
            "rostpay",
            "dropper",
            "mediaget",
            "installpack",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "floxif",
            "presenoker",
            "fusioncore",
            "exploit",
            "filerepmetagen",
            "download json",
            "hostname",
            "hostnames",
            "mail spammer",
            "anonymizer",
            "firehol proxy",
            "asyncrat",
            "genkryptik",
            "fuery",
            "webtoolbar",
            "trojanspy",
            "dropped",
            "execution",
            "contacted urls",
            "http spammer",
            "host",
            "ip address",
            "site top",
            "site safe",
            "blacklist https",
            "tsara brashears",
            "kgs0",
            "kls0",
            "critical risk",
            "attack",
            "hacktool",
            "installer"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Latvia",
            "Poland",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655b9a90e44a70d0fbbde981",
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1117,
            "FileHash-SHA1": 664,
            "FileHash-SHA256": 3426,
            "domain": 977,
            "hostname": 2269,
            "URL": 5554,
            "CVE": 23,
            "URI": 8,
            "Mutex": 1
          },
          "indicator_count": 14039,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570974f872f3ad80a8b32c7",
          "name": "TarD5B7.tmp - and all using its ioc's",
          "description": "",
          "modified": "2023-12-06T15:46:23.604000",
          "created": "2023-12-06T15:46:23.604000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6924,
            "CVE": 4,
            "FileHash-SHA256": 24687,
            "URL": 23965,
            "domain": 6830,
            "FileHash-MD5": 943,
            "FileHash-SHA1": 395,
            "email": 67
          },
          "indicator_count": 63815,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 113,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63f4e8f331fad5e54c0bed1e",
          "name": "TarD5B7.tmp - and all using its ioc's",
          "description": "TarD5B7.tmp\nc0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd",
          "modified": "2023-03-23T00:00:46.897000",
          "created": "2023-02-21T15:53:23.273000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "TarD5B7.tmp"
          ],
          "references": [
            "TarD587.tmp - c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd",
            "https://hybrid-analysis.com/sample/c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 23965,
            "hostname": 6924,
            "FileHash-SHA256": 24687,
            "domain": 6830,
            "CVE": 4,
            "email": 67,
            "FileHash-MD5": 943,
            "FileHash-SHA1": 395
          },
          "indicator_count": 63815,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 94,
          "modified_text": "1125 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://hybrid-analysis.com/sample/c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd",
        "TarD587.tmp - c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Generic",
            "Webtoolbar"
          ],
          "industries": [],
          "unique_indicators": 78457
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/breached.vc",
    "whois": "http://whois.domaintools.com/breached.vc",
    "domain": "breached.vc",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "655b9a90e44a70d0fbbde981",
      "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
      "description": "Domain stated ' SEIZED' by Departing Homeland Security\nSeizure links below seem a bit questionable: \n\nhttp://server3.elgenero.com/iprc_seized_banner.png\nhttp://kickass.to/IPRC_Seized_2016_kat.jpg\nhttp://kickass.to/the-adventures-of-tom-sawyer-t2068537.html\t\nhttp://bludv.tv/iprc_seized_banner.png\nhttp://z-lib.org/iprc_seized_banner.png\nIPRC_Seized_2016_kat.jpg\n... just banners? Moved and continue? Okay.\nListed below also listed in seized domain. Domains,URL's and Botnetwork Hosts still seem to exist.\nhttp://alohatube.xyz/search/tsara-brashears\nalohatube.xyz\nhttps://alohatube.xyz/search/tsara-brashears\nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/\nhttp://45.159.189.105/bot/regex\t\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbia\t\nnr-data.net",
      "modified": "2023-12-20T17:01:34.161000",
      "created": "2023-11-20T17:42:40.771000",
      "tags": [
        "safe site",
        "million",
        "cisco umbrella",
        "alexa top",
        "site",
        "tag count",
        "tld count",
        "jul jan",
        "team alexa",
        "count blacklist",
        "maltiverse",
        "redirme",
        "cronup threat",
        "intel malware",
        "malicious site",
        "malware",
        "no data",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "united",
        "cyber threat",
        "engineering",
        "team",
        "malware site",
        "covid19",
        "phishing site",
        "phishing",
        "phishtank",
        "bank",
        "zbot",
        "malicious",
        "download",
        "suppobox",
        "zeus",
        "nymaim",
        "matsnu",
        "artemis",
        "virut",
        "panama",
        "smsspy",
        "cobalt strike",
        "emotet",
        "bradesco",
        "stealer",
        "facebook",
        "service",
        "simda",
        "runescape",
        "cutwail",
        "unruy",
        "bandoo",
        "tinba",
        "pykspa",
        "domaiq",
        "ave maria",
        "citadel",
        "pony",
        "keitaro",
        "ponmocup",
        "ransomware",
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha256",
        "sha1",
        "ascii text",
        "date",
        "unknown",
        "body",
        "error",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "malicious url",
        "union",
        "unsafe",
        "node tcp",
        "traffic",
        "tor known",
        "tor relayrouter",
        "spammer",
        "threats et",
        "ssl certificate",
        "contacted",
        "whois record",
        "whois whois",
        "historical ssl",
        "apple ios",
        "resolutions",
        "bundled",
        "referrer",
        "collections",
        "android",
        "banker",
        "keylogger",
        "generic malware",
        "generic",
        "blacklist http",
        "ac32a",
        "heur",
        "alexa",
        "xtrat",
        "iframe",
        "installcore",
        "win64",
        "crack",
        "xrat",
        "nircmd",
        "swrort",
        "agent",
        "filetour",
        "cleaner",
        "patcher",
        "adload",
        "wacatac",
        "riskware",
        "acint",
        "conduit",
        "fakealert",
        "opencandy",
        "xtreme",
        "downldr",
        "outbreak",
        "iobit",
        "rostpay",
        "dropper",
        "mediaget",
        "installpack",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "floxif",
        "presenoker",
        "fusioncore",
        "exploit",
        "filerepmetagen",
        "download json",
        "hostname",
        "hostnames",
        "mail spammer",
        "anonymizer",
        "firehol proxy",
        "asyncrat",
        "genkryptik",
        "fuery",
        "webtoolbar",
        "trojanspy",
        "dropped",
        "execution",
        "contacted urls",
        "http spammer",
        "host",
        "ip address",
        "site top",
        "site safe",
        "blacklist https",
        "tsara brashears",
        "kgs0",
        "kls0",
        "critical risk",
        "attack",
        "hacktool",
        "installer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Latvia",
        "Poland",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 46,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1117,
        "FileHash-SHA1": 664,
        "FileHash-SHA256": 3426,
        "domain": 977,
        "hostname": 2269,
        "URL": 5554,
        "CVE": 23,
        "URI": 8,
        "Mutex": 1
      },
      "indicator_count": 14039,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656a9c2eeebaf7b69d0e12ba",
      "name": "Domain Seized - http://server3.elgenero.com/cgi-bin/xdown.cgi",
      "description": "",
      "modified": "2023-12-20T17:01:34.161000",
      "created": "2023-12-02T02:53:34.585000",
      "tags": [
        "safe site",
        "million",
        "cisco umbrella",
        "alexa top",
        "site",
        "tag count",
        "tld count",
        "jul jan",
        "team alexa",
        "count blacklist",
        "maltiverse",
        "redirme",
        "cronup threat",
        "intel malware",
        "malicious site",
        "malware",
        "no data",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist",
        "united",
        "cyber threat",
        "engineering",
        "team",
        "malware site",
        "covid19",
        "phishing site",
        "phishing",
        "phishtank",
        "bank",
        "zbot",
        "malicious",
        "download",
        "suppobox",
        "zeus",
        "nymaim",
        "matsnu",
        "artemis",
        "virut",
        "panama",
        "smsspy",
        "cobalt strike",
        "emotet",
        "bradesco",
        "stealer",
        "facebook",
        "service",
        "simda",
        "runescape",
        "cutwail",
        "unruy",
        "bandoo",
        "tinba",
        "pykspa",
        "domaiq",
        "ave maria",
        "citadel",
        "pony",
        "keitaro",
        "ponmocup",
        "ransomware",
        "pattern match",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "misc attack",
        "sha256",
        "sha1",
        "ascii text",
        "date",
        "unknown",
        "body",
        "error",
        "class",
        "generator",
        "critical",
        "meta",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "malicious url",
        "union",
        "unsafe",
        "node tcp",
        "traffic",
        "tor known",
        "tor relayrouter",
        "spammer",
        "threats et",
        "ssl certificate",
        "contacted",
        "whois record",
        "whois whois",
        "historical ssl",
        "apple ios",
        "resolutions",
        "bundled",
        "referrer",
        "collections",
        "android",
        "banker",
        "keylogger",
        "generic malware",
        "generic",
        "blacklist http",
        "ac32a",
        "heur",
        "alexa",
        "xtrat",
        "iframe",
        "installcore",
        "win64",
        "crack",
        "xrat",
        "nircmd",
        "swrort",
        "agent",
        "filetour",
        "cleaner",
        "patcher",
        "adload",
        "wacatac",
        "riskware",
        "acint",
        "conduit",
        "fakealert",
        "opencandy",
        "xtreme",
        "downldr",
        "outbreak",
        "iobit",
        "rostpay",
        "dropper",
        "mediaget",
        "installpack",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "floxif",
        "presenoker",
        "fusioncore",
        "exploit",
        "filerepmetagen",
        "download json",
        "hostname",
        "hostnames",
        "mail spammer",
        "anonymizer",
        "firehol proxy",
        "asyncrat",
        "genkryptik",
        "fuery",
        "webtoolbar",
        "trojanspy",
        "dropped",
        "execution",
        "contacted urls",
        "http spammer",
        "host",
        "ip address",
        "site top",
        "site safe",
        "blacklist https",
        "tsara brashears",
        "kgs0",
        "kls0",
        "critical risk",
        "attack",
        "hacktool",
        "installer"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Latvia",
        "Poland",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655b9a90e44a70d0fbbde981",
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1117,
        "FileHash-SHA1": 664,
        "FileHash-SHA256": 3426,
        "domain": 977,
        "hostname": 2269,
        "URL": 5554,
        "CVE": 23,
        "URI": 8,
        "Mutex": 1
      },
      "indicator_count": 14039,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570974f872f3ad80a8b32c7",
      "name": "TarD5B7.tmp - and all using its ioc's",
      "description": "",
      "modified": "2023-12-06T15:46:23.604000",
      "created": "2023-12-06T15:46:23.604000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6924,
        "CVE": 4,
        "FileHash-SHA256": 24687,
        "URL": 23965,
        "domain": 6830,
        "FileHash-MD5": 943,
        "FileHash-SHA1": 395,
        "email": 67
      },
      "indicator_count": 63815,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 113,
      "modified_text": "866 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "63f4e8f331fad5e54c0bed1e",
      "name": "TarD5B7.tmp - and all using its ioc's",
      "description": "TarD5B7.tmp\nc0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd",
      "modified": "2023-03-23T00:00:46.897000",
      "created": "2023-02-21T15:53:23.273000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "TarD5B7.tmp"
      ],
      "references": [
        "TarD587.tmp - c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd",
        "https://hybrid-analysis.com/sample/c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 23965,
        "hostname": 6924,
        "FileHash-SHA256": 24687,
        "domain": 6830,
        "CVE": 4,
        "email": 67,
        "FileHash-MD5": 943,
        "FileHash-SHA1": 395
      },
      "indicator_count": 63815,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 94,
      "modified_text": "1125 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://breached.vc/User-SnakeSplitter",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://breached.vc/User-SnakeSplitter",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776738474.296922
}