{
  "type": "URL",
  "indicator": "https://cms.gold360.com.br",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cms.gold360.com.br",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2949980274,
      "indicator": "https://cms.gold360.com.br",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "688e31b80edd775fe5d2f34f",
          "name": "Social Engineering led to -#Lowfi:HSTR:Win32/iWin.B",
          "description": "Likely: Phone referral led to an in person meeting, financial transaction, telephone numbers exchange, website click, in home service call. The alternative is compromised target was redirected to malicious host or service provider became compromised by targeted persons issue.\nThere are several targeted people. This person is closely associated with a target.(idk -malicious)\nMitre: T1055.015\tListPlanting\t\nDefense Evasion\nPrivilege Escalation\nAdversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.",
          "modified": "2025-09-01T15:02:58.791000",
          "created": "2025-08-02T15:41:44.319000",
          "tags": [
            "united",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "gmt server",
            "gmt content",
            "certificate",
            "apache",
            "encrypt",
            "gmt path",
            "set cookie",
            "httponly",
            "passive dns",
            "urls",
            "address",
            "meta",
            "dynamicloader",
            "write c",
            "medium",
            "tlsv1",
            "show",
            "entries",
            "high",
            "http",
            "copy",
            "upatre",
            "write",
            "unknown",
            "asn15169",
            "google",
            "asn46606",
            "unifiedlayeras1",
            "frankfurt",
            "main",
            "germany",
            "google safe",
            "browsing",
            "script urls",
            "a domains",
            "libs",
            "monstroid2",
            "link",
            "accept encoding",
            "script domains",
            "title",
            "vary",
            "jquery",
            "pulse pulses",
            "hostname xn",
            "files domain",
            "showing",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "present jul",
            "for privacy",
            "roboto",
            "delete",
            "trojan",
            "globalc",
            "mozilla",
            "guard",
            "malware",
            "iwin",
            "local",
            "lowfi",
            "helper",
            "nsisdl",
            "executable",
            "amazon s3",
            "pe exe",
            "dll windows",
            "http yara",
            "alerts",
            "meta http",
            "content",
            "pragma",
            "content type",
            "body",
            "service",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "windows nt",
            "mitre att",
            "ascii text",
            "show technique",
            "path",
            "span",
            "click",
            "august",
            "hybrid",
            "general",
            "strings",
            "footer",
            "ck matrix"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 460,
            "hostname": 744,
            "URL": 3496,
            "email": 4,
            "domain": 394,
            "FileHash-SHA256": 2072,
            "FileHash-MD5": 464,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 7641,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570800373899fd03e2e49db",
          "name": "Democrats.org",
          "description": "",
          "modified": "2023-12-06T14:06:59.250000",
          "created": "2023-12-06T14:06:59.250000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3114,
            "domain": 3501,
            "hostname": 3860,
            "URL": 17938,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 10
          },
          "indicator_count": 28425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707e09372dc83478c07fa1",
          "name": "doctoroz.com",
          "description": "",
          "modified": "2023-12-06T13:58:33.053000",
          "created": "2023-12-06T13:58:33.053000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 517,
            "hostname": 1115,
            "URL": 3648,
            "domain": 603,
            "email": 3,
            "FileHash-MD5": 4,
            "CVE": 2,
            "CIDR": 3,
            "FileHash-SHA1": 4
          },
          "indicator_count": 5899,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707d8251e635c843c1f5b8",
          "name": "Asurion.com",
          "description": "",
          "modified": "2023-12-06T13:56:18.534000",
          "created": "2023-12-06T13:56:18.534000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 805,
            "hostname": 2031,
            "URL": 7728,
            "domain": 1064,
            "FileHash-MD5": 4,
            "FileHash-SHA1": 4,
            "email": 2
          },
          "indicator_count": 11638,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707c9df9c33dd5983b366a",
          "name": "TrueCar.com",
          "description": "",
          "modified": "2023-12-06T13:52:29.953000",
          "created": "2023-12-06T13:52:29.953000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1156,
            "domain": 4253,
            "hostname": 4203,
            "URL": 17071,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 5,
            "email": 1
          },
          "indicator_count": 26702,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6220c81aaf6fddde0116569a",
          "name": "Democrats.org",
          "description": "",
          "modified": "2022-04-02T00:04:50.405000",
          "created": "2022-03-03T13:52:26.328000",
          "tags": [
            "date",
            "dns replication"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 17938,
            "hostname": 3860,
            "domain": 3501,
            "FileHash-SHA256": 3114,
            "FileHash-MD5": 2,
            "FileHash-SHA1": 10
          },
          "indicator_count": 28425,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 408,
          "modified_text": "1479 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62096e251f1ca9c1530d2d57",
          "name": "doctoroz.com",
          "description": "",
          "modified": "2022-03-14T00:03:07.473000",
          "created": "2022-02-13T20:46:29.205000",
          "tags": [
            "win32 exe",
            "csc corporate",
            "domains",
            "code",
            "server",
            "registrar abuse",
            "iana id",
            "tech email",
            "admin country",
            "ozmedia",
            "davis",
            "android",
            "dns replication",
            "date",
            "contact phone",
            "registrar url",
            "contact email",
            "registrar iana",
            "expiration date",
            "registrar whois",
            "aaaa",
            "algorithm",
            "full name",
            "time cisco",
            "umbrella",
            "utc statvoo",
            "utc alexa",
            "utc quantcast",
            "dns records",
            "record type",
            "info",
            "ssl certificate",
            "whois record"
          ],
          "references": [
            "https://www.virustotal.com/graph/g9f48f3119de04e009c4fb74b0f288480d61de0a5c3b04ef38c92871ea0ec6952"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3648,
            "hostname": 1115,
            "domain": 603,
            "FileHash-SHA256": 517,
            "CVE": 2,
            "CIDR": 3,
            "FileHash-SHA1": 4,
            "email": 3,
            "FileHash-MD5": 4
          },
          "indicator_count": 5899,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 408,
          "modified_text": "1498 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "61f2cadaf1967e1400a2273a",
          "name": "Asurion.com",
          "description": "",
          "modified": "2022-02-26T00:02:44.767000",
          "created": "2022-01-27T16:39:54.550000",
          "tags": [
            "technology",
            "date",
            "security",
            "csc corporate",
            "domains",
            "code",
            "llc registrar",
            "iana id",
            "server",
            "registrar abuse",
            "registrant",
            "tech email",
            "admin country",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "issuer",
            "cus cnentrust",
            "l1k oentrust",
            "entrust",
            "validity",
            "info",
            "first",
            "whois record",
            "ssl certificate"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 805,
            "URL": 7728,
            "hostname": 2031,
            "domain": 1064,
            "FileHash-MD5": 4,
            "FileHash-SHA1": 4,
            "email": 2
          },
          "indicator_count": 11638,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1514 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "61e2733e9e57250b5725ab5a",
          "name": "TrueCar.com",
          "description": "",
          "modified": "2022-02-14T00:00:26.279000",
          "created": "2022-01-15T07:09:50.416000",
          "tags": [
            "android",
            "win32 exe",
            "key identifier",
            "win32 dll",
            "x509v3 subject",
            "server",
            "date",
            "registrar abuse",
            "algorithm",
            "markmonitor",
            "format",
            "impact",
            "first",
            "text",
            "email",
            "type name",
            "portable",
            "adguard premium",
            "usus",
            "mozilla firefox",
            "technology",
            "microsoft",
            "security",
            "subdomains",
            "threatseeker",
            "sophos",
            "comodo valkyrie",
            "verdict mobile",
            "rank value",
            "ingestion time",
            "statvoo",
            "cisco umbrella",
            "dns records",
            "record type",
            "ttl value",
            "msms94514764",
            "data",
            "v3 serial",
            "number",
            "issuer",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "domain status",
            "contact phone",
            "registrar",
            "ca creation",
            "dnssec",
            "domain name",
            "us registrant",
            "links https",
            "path",
            "submission",
            "httponly",
            "expiressat",
            "samesitelax",
            "details links",
            "vehicles comodo",
            "history first",
            "analysis"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 17071,
            "hostname": 4203,
            "FileHash-SHA256": 1156,
            "domain": 4253,
            "FileHash-MD5": 13,
            "FileHash-SHA1": 5,
            "email": 1
          },
          "indicator_count": 26702,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 412,
          "modified_text": "1526 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/graph/g9f48f3119de04e009c4fb74b0f288480d61de0a5c3b04ef38c92871ea0ec6952"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Telecommunications",
            "Media"
          ],
          "unique_indicators": 73524
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/gold360.com.br",
    "whois": "http://whois.domaintools.com/gold360.com.br",
    "domain": "gold360.com.br",
    "hostname": "cms.gold360.com.br"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "688e31b80edd775fe5d2f34f",
      "name": "Social Engineering led to -#Lowfi:HSTR:Win32/iWin.B",
      "description": "Likely: Phone referral led to an in person meeting, financial transaction, telephone numbers exchange, website click, in home service call. The alternative is compromised target was redirected to malicious host or service provider became compromised by targeted persons issue.\nThere are several targeted people. This person is closely associated with a target.(idk -malicious)\nMitre: T1055.015\tListPlanting\t\nDefense Evasion\nPrivilege Escalation\nAdversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.",
      "modified": "2025-09-01T15:02:58.791000",
      "created": "2025-08-02T15:41:44.319000",
      "tags": [
        "united",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "gmt server",
        "gmt content",
        "certificate",
        "apache",
        "encrypt",
        "gmt path",
        "set cookie",
        "httponly",
        "passive dns",
        "urls",
        "address",
        "meta",
        "dynamicloader",
        "write c",
        "medium",
        "tlsv1",
        "show",
        "entries",
        "high",
        "http",
        "copy",
        "upatre",
        "write",
        "unknown",
        "asn15169",
        "google",
        "asn46606",
        "unifiedlayeras1",
        "frankfurt",
        "main",
        "germany",
        "google safe",
        "browsing",
        "script urls",
        "a domains",
        "libs",
        "monstroid2",
        "link",
        "accept encoding",
        "script domains",
        "title",
        "vary",
        "jquery",
        "pulse pulses",
        "hostname xn",
        "files domain",
        "showing",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "present jul",
        "for privacy",
        "roboto",
        "delete",
        "trojan",
        "globalc",
        "mozilla",
        "guard",
        "malware",
        "iwin",
        "local",
        "lowfi",
        "helper",
        "nsisdl",
        "executable",
        "amazon s3",
        "pe exe",
        "dll windows",
        "http yara",
        "alerts",
        "meta http",
        "content",
        "pragma",
        "content type",
        "body",
        "service",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "windows nt",
        "mitre att",
        "ascii text",
        "show technique",
        "path",
        "span",
        "click",
        "august",
        "hybrid",
        "general",
        "strings",
        "footer",
        "ck matrix"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 460,
        "hostname": 744,
        "URL": 3496,
        "email": 4,
        "domain": 394,
        "FileHash-SHA256": 2072,
        "FileHash-MD5": 464,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 7641,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570800373899fd03e2e49db",
      "name": "Democrats.org",
      "description": "",
      "modified": "2023-12-06T14:06:59.250000",
      "created": "2023-12-06T14:06:59.250000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 3114,
        "domain": 3501,
        "hostname": 3860,
        "URL": 17938,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 10
      },
      "indicator_count": 28425,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707e09372dc83478c07fa1",
      "name": "doctoroz.com",
      "description": "",
      "modified": "2023-12-06T13:58:33.053000",
      "created": "2023-12-06T13:58:33.053000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 517,
        "hostname": 1115,
        "URL": 3648,
        "domain": 603,
        "email": 3,
        "FileHash-MD5": 4,
        "CVE": 2,
        "CIDR": 3,
        "FileHash-SHA1": 4
      },
      "indicator_count": 5899,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707d8251e635c843c1f5b8",
      "name": "Asurion.com",
      "description": "",
      "modified": "2023-12-06T13:56:18.534000",
      "created": "2023-12-06T13:56:18.534000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 805,
        "hostname": 2031,
        "URL": 7728,
        "domain": 1064,
        "FileHash-MD5": 4,
        "FileHash-SHA1": 4,
        "email": 2
      },
      "indicator_count": 11638,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707c9df9c33dd5983b366a",
      "name": "TrueCar.com",
      "description": "",
      "modified": "2023-12-06T13:52:29.953000",
      "created": "2023-12-06T13:52:29.953000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1156,
        "domain": 4253,
        "hostname": 4203,
        "URL": 17071,
        "FileHash-MD5": 13,
        "FileHash-SHA1": 5,
        "email": 1
      },
      "indicator_count": 26702,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6220c81aaf6fddde0116569a",
      "name": "Democrats.org",
      "description": "",
      "modified": "2022-04-02T00:04:50.405000",
      "created": "2022-03-03T13:52:26.328000",
      "tags": [
        "date",
        "dns replication"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 17938,
        "hostname": 3860,
        "domain": 3501,
        "FileHash-SHA256": 3114,
        "FileHash-MD5": 2,
        "FileHash-SHA1": 10
      },
      "indicator_count": 28425,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 408,
      "modified_text": "1479 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62096e251f1ca9c1530d2d57",
      "name": "doctoroz.com",
      "description": "",
      "modified": "2022-03-14T00:03:07.473000",
      "created": "2022-02-13T20:46:29.205000",
      "tags": [
        "win32 exe",
        "csc corporate",
        "domains",
        "code",
        "server",
        "registrar abuse",
        "iana id",
        "tech email",
        "admin country",
        "ozmedia",
        "davis",
        "android",
        "dns replication",
        "date",
        "contact phone",
        "registrar url",
        "contact email",
        "registrar iana",
        "expiration date",
        "registrar whois",
        "aaaa",
        "algorithm",
        "full name",
        "time cisco",
        "umbrella",
        "utc statvoo",
        "utc alexa",
        "utc quantcast",
        "dns records",
        "record type",
        "info",
        "ssl certificate",
        "whois record"
      ],
      "references": [
        "https://www.virustotal.com/graph/g9f48f3119de04e009c4fb74b0f288480d61de0a5c3b04ef38c92871ea0ec6952"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Media"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3648,
        "hostname": 1115,
        "domain": 603,
        "FileHash-SHA256": 517,
        "CVE": 2,
        "CIDR": 3,
        "FileHash-SHA1": 4,
        "email": 3,
        "FileHash-MD5": 4
      },
      "indicator_count": 5899,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 408,
      "modified_text": "1498 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "61f2cadaf1967e1400a2273a",
      "name": "Asurion.com",
      "description": "",
      "modified": "2022-02-26T00:02:44.767000",
      "created": "2022-01-27T16:39:54.550000",
      "tags": [
        "technology",
        "date",
        "security",
        "csc corporate",
        "domains",
        "code",
        "llc registrar",
        "iana id",
        "server",
        "registrar abuse",
        "registrant",
        "tech email",
        "admin country",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "issuer",
        "cus cnentrust",
        "l1k oentrust",
        "entrust",
        "validity",
        "info",
        "first",
        "whois record",
        "ssl certificate"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 805,
        "URL": 7728,
        "hostname": 2031,
        "domain": 1064,
        "FileHash-MD5": 4,
        "FileHash-SHA1": 4,
        "email": 2
      },
      "indicator_count": 11638,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 407,
      "modified_text": "1514 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "61e2733e9e57250b5725ab5a",
      "name": "TrueCar.com",
      "description": "",
      "modified": "2022-02-14T00:00:26.279000",
      "created": "2022-01-15T07:09:50.416000",
      "tags": [
        "android",
        "win32 exe",
        "key identifier",
        "win32 dll",
        "x509v3 subject",
        "server",
        "date",
        "registrar abuse",
        "algorithm",
        "markmonitor",
        "format",
        "impact",
        "first",
        "text",
        "email",
        "type name",
        "portable",
        "adguard premium",
        "usus",
        "mozilla firefox",
        "technology",
        "microsoft",
        "security",
        "subdomains",
        "threatseeker",
        "sophos",
        "comodo valkyrie",
        "verdict mobile",
        "rank value",
        "ingestion time",
        "statvoo",
        "cisco umbrella",
        "dns records",
        "record type",
        "ttl value",
        "msms94514764",
        "data",
        "v3 serial",
        "number",
        "issuer",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "domain status",
        "contact phone",
        "registrar",
        "ca creation",
        "dnssec",
        "domain name",
        "us registrant",
        "links https",
        "path",
        "submission",
        "httponly",
        "expiressat",
        "samesitelax",
        "details links",
        "vehicles comodo",
        "history first",
        "analysis"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 17071,
        "hostname": 4203,
        "FileHash-SHA256": 1156,
        "domain": 4253,
        "FileHash-MD5": 13,
        "FileHash-SHA1": 5,
        "email": 1
      },
      "indicator_count": 26702,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 412,
      "modified_text": "1526 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cms.gold360.com.br",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cms.gold360.com.br",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776651017.322161
}