{
  "type": "URL",
  "indicator": "https://cloud.entroserv.de",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cloud.entroserv.de",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3833890373,
      "indicator": "https://cloud.entroserv.de",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "693b7dc3cf1996347652ef92",
          "name": "Google Site Redirector - Tesla Hackers",
          "description": "Silencing. By Tesla hackers. Awful example of how any victim of a crime; can become a target of the government..\nThis is especially true when the actual perpetrators work for the government are government affiliated, very wealthy, a celebrity or someone who is deemed important. In this instance the Quasi government sought to keep target seeking and obtaining life saving medical treatment, financial settlement that she was entitled to from assault, injuries from assault, false imprisonment, punitive damgages, pain and suffering, humiliation, premise liability, permanent (whole body disability @MMI ), many other crimes. The victims suffered from a great sadness and betrayal. \n\nObviously racist Elon Musk and crew have access to all government tools. Musk, All things cyber are at his disposal as \ncontinues to abuse privilege.\n They keep  playing a God  they  don\u2019t believe in. God is the Ultimate Avenger.",
          "modified": "2026-01-11T00:03:08.581000",
          "created": "2025-12-12T02:28:19.107000",
          "tags": [
            "compromised_site_redirector_fromcharcode",
            "site_redirector",
            "string",
            "regexp",
            "error",
            "number",
            "sxa0",
            "amptoken",
            "optout",
            "retrieving",
            "notfound",
            "write",
            "form",
            "flash",
            "vd",
            "tesla hackers",
            "nxdomain",
            "passive dns",
            "ip address",
            "domain",
            "a nxdomain",
            "urls",
            "files",
            "ip related",
            "pulses otx",
            "google",
            "unknown",
            "oracle",
            "dynamicloader",
            "medium",
            "high",
            "windows",
            "rndhex",
            "write c",
            "rndchar",
            "displayname",
            "tofsee",
            "yara rule",
            "stream",
            "strings",
            "push",
            "lte all",
            "search otx",
            "ource url",
            "or text",
            "paste",
            "data upload",
            "extraction",
            "elon musk",
            "indicator role",
            "active related",
            "ipv4",
            "exploitsource",
            "url https",
            "url http",
            "desktopinternet",
            "title added",
            "pulses ipv4",
            "less see",
            "ids detections",
            "vuze bt",
            "udp connection",
            "contacted",
            "filehash",
            "av detections",
            "yara detections",
            "alerts",
            "0x8aa42",
            "0xe3107",
            "upnp",
            "http request",
            "bittorrent",
            "file",
            "module load",
            "t1129",
            "post http",
            "install",
            "execution",
            "malware",
            "hostile",
            "crawl",
            "windows nt",
            "wow64",
            "get zona",
            "get httpget",
            "hash",
            "entries",
            "read c",
            "suspicious",
            "next",
            "united"
          ],
          "references": [
            "Tesla Hackers  | https://www.teslarati.com/spacex",
            "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
            "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
            "IDS Detections Win32/ZonaInstaller Install Beacon",
            "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
            "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
            "https://www.google-analytics.com/debug/bootstrap?id=\\",
            "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
            "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
            "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
            "This is why our team tells a back story. It can and does happen to anyone.",
            "We apologize for so may typos and errors. We strive to do better at that."
          ],
          "public": 1,
          "adversary": "Tesla Hackers",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Vd",
              "display_name": "Vd",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Tofsee.T",
              "display_name": "Backdoor:Win32/Tofsee.T",
              "target": "/malware/Backdoor:Win32/Tofsee.T"
            },
            {
              "id": "Win.Trojan.12382640-1",
              "display_name": "Win.Trojan.12382640-1",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 65,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 2032,
            "URL": 4921,
            "domain": 567,
            "hostname": 1586,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "99 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "682f52de68ac467c666c8ee0",
          "name": "23.219.89.169  dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
          "description": "https://www.virustotal.com/gui/file/191475f518a3563c8bbe32e742cc9106c0c968e2e3b9ce12aa12b5f018cbac42/relations\nhttps://www.virustotal.com/gui/ip-address/23.219.89.169/relations",
          "modified": "2025-06-21T16:02:45.537000",
          "created": "2025-05-22T16:37:50.568000",
          "tags": [
            "trojan",
            "virus",
            "md5 time",
            "action payload",
            "type malicious",
            "trojan injector",
            "trojan zloader",
            "adware",
            "parent",
            "diff",
            "drop",
            "trustcor",
            "vhash",
            "ssdeep"
          ],
          "references": [
            "https://res.public.onecdn.static.microsoft/midgard/versionless/dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
            "https://feedback.us1.glint.cloud.microsoft/chemtrade/q2/questionnaire/5b77004c-9458-414f-8b63-a10eeff2ea13",
            "svc.ha-teams.office.com",
            "s-0005.dual-s-msedge.net",
            "mira-tmc.tm-4.office.com",
            "ecs-office.s-0005.dual-s-msedge.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 63,
            "FileHash-SHA256": 451,
            "FileHash-MD5": 200,
            "hostname": 639,
            "domain": 109,
            "URL": 572
          },
          "indicator_count": 2034,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "302 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6774a3ec9b253daddfc902a3",
          "name": "Sample_5adcc978b45f6a54af936c48.exe  MD5 1f37eebe61bc9252bd72e643f4223896",
          "description": "Names\n1f37eebe61bc9252bd72e643f4223896\nSample_5adcc978b45f6a54af936c48.exe\nAutoTRON.exe\nc28961e7a22e2d5c5bce189214974a91faa11275\n17abbc9e2cd58563aba1d2f3ceb539eced16ec950ddcc3f8e068f9d0c5441096._exe",
          "modified": "2025-01-31T02:00:02.600000",
          "created": "2025-01-01T02:09:48.512000",
          "tags": [
            "sha256",
            "pejzasz",
            "wersja pliku",
            "v2 dokument",
            "tekst ascii",
            "z terminatorami",
            "crlf",
            "tekst w",
            "ascii",
            "zgodny z",
            "user",
            "settings",
            "autoit",
            "sangfor zsand",
            "tencent habo",
            "zenbox",
            "rules not",
            "c2 server",
            "memory pattern",
            "analysis date",
            "malware",
            "stealer",
            "ransom",
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 75,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 144,
            "URL": 260,
            "domain": 51,
            "hostname": 110
          },
          "indicator_count": 642,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "443 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://res.public.onecdn.static.microsoft/midgard/versionless/dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
        "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
        "We apologize for so may typos and errors. We strive to do better at that.",
        "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
        "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
        "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
        "https://feedback.us1.glint.cloud.microsoft/chemtrade/q2/questionnaire/5b77004c-9458-414f-8b63-a10eeff2ea13",
        "https://www.google-analytics.com/debug/bootstrap?id=\\",
        "svc.ha-teams.office.com",
        "s-0005.dual-s-msedge.net",
        "mira-tmc.tm-4.office.com",
        "ecs-office.s-0005.dual-s-msedge.net",
        "IDS Detections Win32/ZonaInstaller Install Beacon",
        "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
        "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
        "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
        "This is why our team tells a back story. It can and does happen to anyone.",
        "Tesla Hackers  | https://www.teslarati.com/spacex"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Tesla Hackers"
          ],
          "malware_families": [
            "Vd",
            "Win.trojan.12382640-1",
            "Backdoor:win32/tofsee.t"
          ],
          "industries": [],
          "unique_indicators": 27691
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/entroserv.de",
    "whois": "http://whois.domaintools.com/entroserv.de",
    "domain": "entroserv.de",
    "hostname": "cloud.entroserv.de"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "693b7dc3cf1996347652ef92",
      "name": "Google Site Redirector - Tesla Hackers",
      "description": "Silencing. By Tesla hackers. Awful example of how any victim of a crime; can become a target of the government..\nThis is especially true when the actual perpetrators work for the government are government affiliated, very wealthy, a celebrity or someone who is deemed important. In this instance the Quasi government sought to keep target seeking and obtaining life saving medical treatment, financial settlement that she was entitled to from assault, injuries from assault, false imprisonment, punitive damgages, pain and suffering, humiliation, premise liability, permanent (whole body disability @MMI ), many other crimes. The victims suffered from a great sadness and betrayal. \n\nObviously racist Elon Musk and crew have access to all government tools. Musk, All things cyber are at his disposal as \ncontinues to abuse privilege.\n They keep  playing a God  they  don\u2019t believe in. God is the Ultimate Avenger.",
      "modified": "2026-01-11T00:03:08.581000",
      "created": "2025-12-12T02:28:19.107000",
      "tags": [
        "compromised_site_redirector_fromcharcode",
        "site_redirector",
        "string",
        "regexp",
        "error",
        "number",
        "sxa0",
        "amptoken",
        "optout",
        "retrieving",
        "notfound",
        "write",
        "form",
        "flash",
        "vd",
        "tesla hackers",
        "nxdomain",
        "passive dns",
        "ip address",
        "domain",
        "a nxdomain",
        "urls",
        "files",
        "ip related",
        "pulses otx",
        "google",
        "unknown",
        "oracle",
        "dynamicloader",
        "medium",
        "high",
        "windows",
        "rndhex",
        "write c",
        "rndchar",
        "displayname",
        "tofsee",
        "yara rule",
        "stream",
        "strings",
        "push",
        "lte all",
        "search otx",
        "ource url",
        "or text",
        "paste",
        "data upload",
        "extraction",
        "elon musk",
        "indicator role",
        "active related",
        "ipv4",
        "exploitsource",
        "url https",
        "url http",
        "desktopinternet",
        "title added",
        "pulses ipv4",
        "less see",
        "ids detections",
        "vuze bt",
        "udp connection",
        "contacted",
        "filehash",
        "av detections",
        "yara detections",
        "alerts",
        "0x8aa42",
        "0xe3107",
        "upnp",
        "http request",
        "bittorrent",
        "file",
        "module load",
        "t1129",
        "post http",
        "install",
        "execution",
        "malware",
        "hostile",
        "crawl",
        "windows nt",
        "wow64",
        "get zona",
        "get httpget",
        "hash",
        "entries",
        "read c",
        "suspicious",
        "next",
        "united"
      ],
      "references": [
        "Tesla Hackers  | https://www.teslarati.com/spacex",
        "Yara Detections :compromised_site_redirector_fromcharcode Alerts network_icmp js_eval recon_fingerprint",
        "142.250.74.142.250.74.138 _exploit_source | 142.250.74.138 _exploit_source | 142.250.74.142_exploit_source",
        "IDS Detections Win32/ZonaInstaller Install Beacon",
        "https://www.google \u2022  https://ampcid.google.com/v1/publisher \u2022\u2019https://ampcid.google.com/v1/publisher:getClientId\\",
        "https://tagassistant.google.com/ \u2022  https://www.google-analytics.com/debug/bootstrap?id=",
        "https://www.google-analytics.com/debug/bootstrap?id=\\",
        "https://stats.g.doubleclick.net/j/collect\\ \u2022 https://tagassistant.google.com/ \u2022 https://www.google.com/ads/ga",
        "https://www.google-analytics.com/gtm/js?id=\\  \u2022 https://www.googletagmanager.com/gtag/js?id= \u2022",
        "https://www.googletagmanager.com/gtag/js?id=\\ \u2022 https://www.google-analytics.com/gtm/js?id=",
        "This is why our team tells a back story. It can and does happen to anyone.",
        "We apologize for so may typos and errors. We strive to do better at that."
      ],
      "public": 1,
      "adversary": "Tesla Hackers",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Vd",
          "display_name": "Vd",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Tofsee.T",
          "display_name": "Backdoor:Win32/Tofsee.T",
          "target": "/malware/Backdoor:Win32/Tofsee.T"
        },
        {
          "id": "Win.Trojan.12382640-1",
          "display_name": "Win.Trojan.12382640-1",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 65,
        "FileHash-SHA1": 34,
        "FileHash-SHA256": 2032,
        "URL": 4921,
        "domain": 567,
        "hostname": 1586,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "99 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "682f52de68ac467c666c8ee0",
      "name": "23.219.89.169  dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
      "description": "https://www.virustotal.com/gui/file/191475f518a3563c8bbe32e742cc9106c0c968e2e3b9ce12aa12b5f018cbac42/relations\nhttps://www.virustotal.com/gui/ip-address/23.219.89.169/relations",
      "modified": "2025-06-21T16:02:45.537000",
      "created": "2025-05-22T16:37:50.568000",
      "tags": [
        "trojan",
        "virus",
        "md5 time",
        "action payload",
        "type malicious",
        "trojan injector",
        "trojan zloader",
        "adware",
        "parent",
        "diff",
        "drop",
        "trustcor",
        "vhash",
        "ssdeep"
      ],
      "references": [
        "https://res.public.onecdn.static.microsoft/midgard/versionless/dty-274d7ae9-e5e0-48eb-80db-f8daf26a8d1b-default-prod-64333_23af6e1645db3b350058.js",
        "https://feedback.us1.glint.cloud.microsoft/chemtrade/q2/questionnaire/5b77004c-9458-414f-8b63-a10eeff2ea13",
        "svc.ha-teams.office.com",
        "s-0005.dual-s-msedge.net",
        "mira-tmc.tm-4.office.com",
        "ecs-office.s-0005.dual-s-msedge.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 63,
        "FileHash-SHA256": 451,
        "FileHash-MD5": 200,
        "hostname": 639,
        "domain": 109,
        "URL": 572
      },
      "indicator_count": 2034,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "302 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6774a3ec9b253daddfc902a3",
      "name": "Sample_5adcc978b45f6a54af936c48.exe  MD5 1f37eebe61bc9252bd72e643f4223896",
      "description": "Names\n1f37eebe61bc9252bd72e643f4223896\nSample_5adcc978b45f6a54af936c48.exe\nAutoTRON.exe\nc28961e7a22e2d5c5bce189214974a91faa11275\n17abbc9e2cd58563aba1d2f3ceb539eced16ec950ddcc3f8e068f9d0c5441096._exe",
      "modified": "2025-01-31T02:00:02.600000",
      "created": "2025-01-01T02:09:48.512000",
      "tags": [
        "sha256",
        "pejzasz",
        "wersja pliku",
        "v2 dokument",
        "tekst ascii",
        "z terminatorami",
        "crlf",
        "tekst w",
        "ascii",
        "zgodny z",
        "user",
        "settings",
        "autoit",
        "sangfor zsand",
        "tencent habo",
        "zenbox",
        "rules not",
        "c2 server",
        "memory pattern",
        "analysis date",
        "malware",
        "stealer",
        "ransom",
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 75,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 144,
        "URL": 260,
        "domain": 51,
        "hostname": 110
      },
      "indicator_count": 642,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 122,
      "modified_text": "443 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cloud.entroserv.de",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cloud.entroserv.de",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776644833.3442233
}