{
  "type": "URL",
  "indicator": "https://dhl-urgent-fee.com/secure",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dhl-urgent-fee.com/secure",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3840158490,
      "indicator": "https://dhl-urgent-fee.com/secure",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "63eaffa16993c3f21e9ed286",
          "name": "DHL Phishing Collection",
          "description": "This page stores DHL phishing page IOCs. Legitimate website for the brand is https://www.dhl.com/\nNOLA defense is tracking newly observed phishing websites. Follow us on twitter https://twitter.com/noladefense",
          "modified": "2026-05-29T09:38:11.747000",
          "created": "2023-02-14T03:27:29.077000",
          "tags": [
            "urls",
            "url",
            "domains",
            "domain",
            "phishing",
            "scam",
            "dhl"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/9e06470d30593e11c8daad2157e0d4ef1ccce47787e2b5303846704767c26d6a"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Transportation"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 556,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "noladefense",
            "id": "222814",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_222814/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 34,
            "domain": 18,
            "URL": 1
          },
          "indicator_count": 53,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 429,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 0
        },
        {
          "id": "65d053a935bf99f5263deb57",
          "name": "History Killer Pro Injection deleting virustotal & otx.alienvault Pulses",
          "description": "History killer pro, is being used to delete and modify virustotal nodes and 41 otx.alienvault pulses. Junk data is being used to fill in missing pulses.\nTargeted: 1 callmeDoris  several scoreblue (sometimes I clone pulses) Octoseek.  \npulses.\nHallrender, Metro by T-Mobile, https://myaccount.uscis.gov/, Esurance,  40 pule reports are regarding Tsara Brashears cyber bully campaign which attacked the corporates mentioned except 2 AIG and Hallrender attackers. 100's of other modifications, deletions by another tool affecting several users.",
          "modified": "2024-03-18T04:01:27.756000",
          "created": "2024-02-17T06:35:21.666000",
          "tags": [
            "contacted",
            "execution",
            "january",
            "september",
            "whois record",
            "resolutions",
            "communicating",
            "roundup",
            "highly targeted",
            "phishing",
            "quasar",
            "malware",
            "open",
            "threat roundup",
            "referrer",
            "remote",
            "kimsuky",
            "passive dns",
            "urls",
            "dive domains",
            "creation date",
            "search",
            "record value",
            "date",
            "united",
            "scan endpoints",
            "all scoreblue",
            "unknown",
            "body",
            "brian sabey",
            "hall render",
            "reinsurance",
            "state",
            "danger",
            "threat",
            "critical",
            "crypthashdata",
            "read c",
            "tcmiheijkmutcix",
            "entries",
            "show",
            "t1055",
            "intel",
            "ms windows",
            "delphi",
            "win32",
            "copy",
            "write",
            "injection",
            "zusy",
            "neojit",
            "cyber stalking",
            "worker",
            "inject",
            "illegal",
            "tampering",
            "hijacker",
            "delete",
            "ret hat",
            "stalker",
            "shadow",
            "quasi"
          ],
          "references": [
            "www.historykillerpro.com",
            "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
            "http://sniper.debugger.ru",
            "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Variant.Zusy.572 Checkin",
              "display_name": "Variant.Zusy.572 Checkin",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Neojit.A",
              "display_name": "TrojanDownloader:Win32/Neojit.A",
              "target": "/malware/TrojanDownloader:Win32/Neojit.A"
            },
            {
              "id": "Win32:Delf-SES\\ [Trj]",
              "display_name": "Win32:Delf-SES\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1372316",
              "display_name": "Win.Trojan.Agent-1372316",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1915,
            "FileHash-MD5": 437,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 3054,
            "domain": 987,
            "URL": 5902,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 12732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "807 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d0a9c7f1b04296d9b0d803",
          "name": "History Killer Pro Injection deleting VirusTotal & OTX.AlienVault Pulses",
          "description": "",
          "modified": "2024-03-18T04:01:27.756000",
          "created": "2024-02-17T12:42:47.334000",
          "tags": [
            "contacted",
            "execution",
            "january",
            "september",
            "whois record",
            "resolutions",
            "communicating",
            "roundup",
            "highly targeted",
            "phishing",
            "quasar",
            "malware",
            "open",
            "threat roundup",
            "referrer",
            "remote",
            "kimsuky",
            "passive dns",
            "urls",
            "dive domains",
            "creation date",
            "search",
            "record value",
            "date",
            "united",
            "scan endpoints",
            "all scoreblue",
            "unknown",
            "body",
            "brian sabey",
            "hall render",
            "reinsurance",
            "state",
            "danger",
            "threat",
            "critical",
            "crypthashdata",
            "read c",
            "tcmiheijkmutcix",
            "entries",
            "show",
            "t1055",
            "intel",
            "ms windows",
            "delphi",
            "win32",
            "copy",
            "write",
            "injection",
            "zusy",
            "neojit",
            "cyber stalking",
            "worker",
            "inject",
            "illegal",
            "tampering",
            "hijacker",
            "delete",
            "ret hat",
            "stalker",
            "shadow",
            "quasi"
          ],
          "references": [
            "www.historykillerpro.com",
            "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
            "http://sniper.debugger.ru",
            "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Variant.Zusy.572 Checkin",
              "display_name": "Variant.Zusy.572 Checkin",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Neojit.A",
              "display_name": "TrojanDownloader:Win32/Neojit.A",
              "target": "/malware/TrojanDownloader:Win32/Neojit.A"
            },
            {
              "id": "Win32:Delf-SES\\ [Trj]",
              "display_name": "Win32:Delf-SES\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1372316",
              "display_name": "Win.Trojan.Agent-1372316",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65d053a935bf99f5263deb57",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1915,
            "FileHash-MD5": 437,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 3054,
            "domain": 987,
            "URL": 5902,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 12732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "807 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65cd573a581ddbe340404ce3",
          "name": "Twitter Feed - noladefense - 14-02-2024",
          "description": "",
          "modified": "2024-03-16T00:04:45.921000",
          "created": "2024-02-15T00:13:46.556000",
          "tags": [
            "phishing"
          ],
          "references": [
            "https://twitter.com/noladefense/status/1757564706372387204",
            "https://twitter.com/noladefense/status/1757579805413851349",
            "https://twitter.com/noladefense/status/1757579874833690912",
            "https://twitter.com/noladefense/status/1757579903665422567",
            "https://twitter.com/noladefense/status/1757610050334392783",
            "https://twitter.com/noladefense/status/1757610056059965515",
            "https://twitter.com/noladefense/status/1757621334232686717",
            "https://twitter.com/noladefense/status/1757625145181561203",
            "https://twitter.com/noladefense/status/1757625157051396177",
            "https://twitter.com/noladefense/status/1757625170812920195",
            "https://twitter.com/noladefense/status/1757629536445817192",
            "https://twitter.com/noladefense/status/1757631431440736304",
            "https://twitter.com/noladefense/status/1757631634092724302",
            "https://twitter.com/noladefense/status/1757633134915400107",
            "https://twitter.com/noladefense/status/1757633325206765883",
            "https://twitter.com/noladefense/status/1757634678566134057",
            "https://twitter.com/noladefense/status/1757634780273783184",
            "https://twitter.com/noladefense/status/1757634839027548571",
            "https://twitter.com/noladefense/status/1757638325215596654",
            "https://twitter.com/noladefense/status/1757643789538058714",
            "https://twitter.com/noladefense/status/1757643847566319869",
            "https://twitter.com/noladefense/status/1757643911533650094",
            "https://twitter.com/noladefense/status/1757643971658956845",
            "https://twitter.com/noladefense/status/1757644031503245796",
            "https://twitter.com/noladefense/status/1757645503871734089",
            "https://twitter.com/noladefense/status/1757645844579340474",
            "https://twitter.com/noladefense/status/1757647501073469503",
            "https://twitter.com/noladefense/status/1757647560187969901",
            "https://twitter.com/noladefense/status/1757647672817668444",
            "https://twitter.com/noladefense/status/1757649054962462820",
            "https://twitter.com/noladefense/status/1757649098147066091",
            "https://twitter.com/noladefense/status/1757649351273279724",
            "https://twitter.com/noladefense/status/1757651118299943164",
            "https://twitter.com/noladefense/status/1757655398033588479",
            "https://twitter.com/noladefense/status/1757655407286202688",
            "https://twitter.com/noladefense/status/1757656357501534531",
            "https://twitter.com/noladefense/status/1757656697303134535",
            "https://twitter.com/noladefense/status/1757656763866706365",
            "https://twitter.com/noladefense/status/1757663667007402488",
            "https://twitter.com/noladefense/status/1757664069824213339",
            "https://twitter.com/noladefense/status/1757664130083737825",
            "https://twitter.com/noladefense/status/1757664188665610588",
            "https://twitter.com/noladefense/status/1757664248753205739",
            "https://twitter.com/noladefense/status/1757665630403150241",
            "https://twitter.com/noladefense/status/1757665697553912198",
            "https://twitter.com/noladefense/status/1757665758522315260",
            "https://twitter.com/noladefense/status/1757666128308928709",
            "https://twitter.com/noladefense/status/1757669448603869261",
            "https://twitter.com/noladefense/status/1757669503347884387",
            "https://twitter.com/noladefense/status/1757669587322097747",
            "https://twitter.com/noladefense/status/1757669658432311358",
            "https://twitter.com/noladefense/status/1757669714371764436",
            "https://twitter.com/noladefense/status/1757670448521675146",
            "https://twitter.com/noladefense/status/1757670463596028338",
            "https://twitter.com/noladefense/status/1757670486773743886",
            "https://twitter.com/noladefense/status/1757670637177327960",
            "https://twitter.com/noladefense/status/1757673671114539027",
            "https://twitter.com/noladefense/status/1757676908945224032",
            "https://twitter.com/noladefense/status/1757681093090648559",
            "https://twitter.com/noladefense/status/1757682591749013651",
            "https://twitter.com/noladefense/status/1757685539325514222",
            "https://twitter.com/noladefense/status/1757685543721128430",
            "https://twitter.com/noladefense/status/1757700616065884488",
            "https://twitter.com/noladefense/status/1757700626656477629",
            "https://twitter.com/noladefense/status/1757700655873953863",
            "https://twitter.com/noladefense/status/1757700660387098717",
            "https://twitter.com/noladefense/status/1757700679336935549",
            "https://twitter.com/noladefense/status/1757700807892365763",
            "https://twitter.com/noladefense/status/1757700819695071386",
            "https://twitter.com/noladefense/status/1757707171339370763",
            "https://twitter.com/noladefense/status/1757707235747041410",
            "https://twitter.com/noladefense/status/1757708798347583834",
            "https://twitter.com/noladefense/status/1757715767968112643",
            "https://twitter.com/noladefense/status/1757715773919740224",
            "https://twitter.com/noladefense/status/1757715798875865164",
            "https://twitter.com/noladefense/status/1757716385583534455",
            "https://twitter.com/noladefense/status/1757731155900498365",
            "https://twitter.com/noladefense/status/1757735485730926977",
            "https://twitter.com/noladefense/status/1757740261323530450",
            "https://twitter.com/noladefense/status/1757745916327440649",
            "https://twitter.com/noladefense/status/1757745933175959864",
            "https://twitter.com/noladefense/status/1757746076172304618",
            "https://twitter.com/noladefense/status/1757746233584615689",
            "https://twitter.com/noladefense/status/1757752130490798106",
            "https://twitter.com/noladefense/status/1757755129825005883",
            "https://twitter.com/noladefense/status/1757755176662757495",
            "https://twitter.com/noladefense/status/1757760995819180506",
            "https://twitter.com/noladefense/status/1757761029956604144",
            "https://twitter.com/noladefense/status/1757766878208864298",
            "https://twitter.com/noladefense/status/1757766932776780155",
            "https://twitter.com/noladefense/status/1757770255101804836",
            "https://twitter.com/noladefense/status/1757776622868967608",
            "https://twitter.com/noladefense/status/1757791406129590351",
            "https://twitter.com/noladefense/status/1757791441902793018",
            "https://twitter.com/noladefense/status/1757791537600025081",
            "https://twitter.com/noladefense/status/1757791606239883299",
            "https://twitter.com/noladefense/status/1757791654667260035",
            "https://twitter.com/noladefense/status/1757791665945805282",
            "https://twitter.com/noladefense/status/1757791673390674279",
            "https://twitter.com/noladefense/status/1757791736166826335",
            "https://twitter.com/noladefense/status/1757791757318672477",
            "https://twitter.com/noladefense/status/1757791796170514820",
            "https://twitter.com/noladefense/status/1757796977243275549",
            "https://twitter.com/noladefense/status/1757798498739634618",
            "https://twitter.com/noladefense/status/1757799906306130422",
            "https://twitter.com/noladefense/status/1757799949792579645",
            "https://twitter.com/noladefense/status/1757800118160392396",
            "https://twitter.com/noladefense/status/1757800174770864603",
            "https://twitter.com/noladefense/status/1757801524846031197",
            "https://twitter.com/noladefense/status/1757806380629545151",
            "https://twitter.com/noladefense/status/1757806412082631096",
            "https://twitter.com/noladefense/status/1757806426687197524",
            "https://twitter.com/noladefense/status/1757806576025346131",
            "https://twitter.com/noladefense/status/1757806706359177220",
            "https://twitter.com/noladefense/status/1757806757261246530",
            "https://twitter.com/noladefense/status/1757806785539301810",
            "https://twitter.com/noladefense/status/1757808588481786077",
            "https://twitter.com/noladefense/status/1757808652918849671",
            "https://twitter.com/noladefense/status/1757811936635367699",
            "https://twitter.com/noladefense/status/1757821277690032585",
            "https://twitter.com/noladefense/status/1757821391720562857",
            "https://twitter.com/noladefense/status/1757821423869993188",
            "https://twitter.com/noladefense/status/1757821429448421523",
            "https://twitter.com/noladefense/status/1757841668475097581",
            "https://twitter.com/noladefense/status/1757841724536213541",
            "https://twitter.com/noladefense/status/1757841784799936910",
            "https://twitter.com/noladefense/status/1757844787967750165",
            "https://twitter.com/noladefense/status/1757844840941867237",
            "https://twitter.com/noladefense/status/1757855265834025383",
            "https://twitter.com/noladefense/status/1757855323711246459",
            "https://twitter.com/noladefense/status/1757858535428194432",
            "https://twitter.com/noladefense/status/1757866705907310772",
            "https://twitter.com/noladefense/status/1757866729152082385",
            "https://twitter.com/noladefense/status/1757866751914545290",
            "https://twitter.com/noladefense/status/1757866802082697591",
            "https://twitter.com/noladefense/status/1757867027945886026",
            "https://twitter.com/noladefense/status/1757867041694818759",
            "https://twitter.com/noladefense/status/1757867092307501365",
            "https://twitter.com/noladefense/status/1757867146380443946",
            "https://twitter.com/noladefense/status/1757867214605074765",
            "https://twitter.com/noladefense/status/1757881831456686441",
            "https://twitter.com/noladefense/status/1757881896686510323",
            "https://twitter.com/noladefense/status/1757881901774237963",
            "https://twitter.com/noladefense/status/1757882152002134439",
            "https://twitter.com/noladefense/status/1757882210164568434",
            "https://twitter.com/noladefense/status/1757882332696993815",
            "https://twitter.com/noladefense/status/1757882355702694324",
            "https://twitter.com/noladefense/status/1757897040174989341",
            "https://twitter.com/noladefense/status/1757897066439757908",
            "https://twitter.com/noladefense/status/1757897088778571830",
            "https://twitter.com/noladefense/status/1757897091928494468",
            "https://twitter.com/noladefense/status/1757897547517980970",
            "https://twitter.com/noladefense/status/1757897572989968706",
            "https://twitter.com/noladefense/status/1757897627490812173"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 63,
            "URL": 110,
            "FileHash-SHA256": 141,
            "domain": 45,
            "FileHash-MD5": 7
          },
          "indicator_count": 366,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1624,
          "modified_text": "809 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://twitter.com/noladefense/status/1757670463596028338",
        "https://twitter.com/noladefense/status/1757821423869993188",
        "https://twitter.com/noladefense/status/1757700819695071386",
        "https://twitter.com/noladefense/status/1757897040174989341",
        "https://twitter.com/noladefense/status/1757649098147066091",
        "https://twitter.com/noladefense/status/1757707235747041410",
        "https://twitter.com/noladefense/status/1757770255101804836",
        "https://twitter.com/noladefense/status/1757681093090648559",
        "https://twitter.com/noladefense/status/1757881896686510323",
        "https://twitter.com/noladefense/status/1757867146380443946",
        "https://twitter.com/noladefense/status/1757858535428194432",
        "https://twitter.com/noladefense/status/1757669448603869261",
        "https://twitter.com/noladefense/status/1757645503871734089",
        "https://twitter.com/noladefense/status/1757800118160392396",
        "https://twitter.com/noladefense/status/1757700807892365763",
        "https://twitter.com/noladefense/status/1757655398033588479",
        "https://twitter.com/noladefense/status/1757644031503245796",
        "https://twitter.com/noladefense/status/1757700626656477629",
        "https://twitter.com/noladefense/status/1757633325206765883",
        "https://twitter.com/noladefense/status/1757881901774237963",
        "https://twitter.com/noladefense/status/1757808588481786077",
        "https://twitter.com/noladefense/status/1757882152002134439",
        "https://twitter.com/noladefense/status/1757664069824213339",
        "https://twitter.com/noladefense/status/1757673671114539027",
        "https://twitter.com/noladefense/status/1757821391720562857",
        "https://twitter.com/noladefense/status/1757806412082631096",
        "https://twitter.com/noladefense/status/1757867214605074765",
        "https://twitter.com/noladefense/status/1757700616065884488",
        "https://twitter.com/noladefense/status/1757808652918849671",
        "https://twitter.com/noladefense/status/1757897088778571830",
        "https://twitter.com/noladefense/status/1757564706372387204",
        "https://twitter.com/noladefense/status/1757610050334392783",
        "http://sniper.debugger.ru",
        "https://twitter.com/noladefense/status/1757897627490812173",
        "https://twitter.com/noladefense/status/1757625170812920195",
        "https://twitter.com/noladefense/status/1757656357501534531",
        "https://twitter.com/noladefense/status/1757643971658956845",
        "https://twitter.com/noladefense/status/1757806576025346131",
        "https://twitter.com/noladefense/status/1757643847566319869",
        "https://twitter.com/noladefense/status/1757656697303134535",
        "https://twitter.com/noladefense/status/1757669658432311358",
        "https://twitter.com/noladefense/status/1757799949792579645",
        "https://twitter.com/noladefense/status/1757796977243275549",
        "https://twitter.com/noladefense/status/1757579903665422567",
        "https://twitter.com/noladefense/status/1757638325215596654",
        "https://twitter.com/noladefense/status/1757707171339370763",
        "https://twitter.com/noladefense/status/1757867041694818759",
        "https://twitter.com/noladefense/status/1757715773919740224",
        "https://twitter.com/noladefense/status/1757866802082697591",
        "https://twitter.com/noladefense/status/1757633134915400107",
        "https://twitter.com/noladefense/status/1757634678566134057",
        "https://twitter.com/noladefense/status/1757715767968112643",
        "https://twitter.com/noladefense/status/1757647560187969901",
        "https://twitter.com/noladefense/status/1757752130490798106",
        "https://twitter.com/noladefense/status/1757745933175959864",
        "https://twitter.com/noladefense/status/1757855323711246459",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "https://twitter.com/noladefense/status/1757867092307501365",
        "https://twitter.com/noladefense/status/1757882332696993815",
        "https://twitter.com/noladefense/status/1757882355702694324",
        "https://twitter.com/noladefense/status/1757670448521675146",
        "https://twitter.com/noladefense/status/1757791606239883299",
        "https://twitter.com/noladefense/status/1757821429448421523",
        "https://twitter.com/noladefense/status/1757776622868967608",
        "https://twitter.com/noladefense/status/1757791673390674279",
        "https://twitter.com/noladefense/status/1757670637177327960",
        "https://twitter.com/noladefense/status/1757746233584615689",
        "https://twitter.com/noladefense/status/1757897091928494468",
        "https://twitter.com/noladefense/status/1757844787967750165",
        "https://twitter.com/noladefense/status/1757716385583534455",
        "https://twitter.com/noladefense/status/1757746076172304618",
        "https://www.virustotal.com/gui/collection/9e06470d30593e11c8daad2157e0d4ef1ccce47787e2b5303846704767c26d6a",
        "https://twitter.com/noladefense/status/1757799906306130422",
        "https://twitter.com/noladefense/status/1757897572989968706",
        "https://twitter.com/noladefense/status/1757631431440736304",
        "https://twitter.com/noladefense/status/1757631634092724302",
        "https://twitter.com/noladefense/status/1757664248753205739",
        "https://twitter.com/noladefense/status/1757708798347583834",
        "https://twitter.com/noladefense/status/1757670486773743886",
        "https://twitter.com/noladefense/status/1757579874833690912",
        "https://twitter.com/noladefense/status/1757844840941867237",
        "https://twitter.com/noladefense/status/1757610056059965515",
        "https://twitter.com/noladefense/status/1757806380629545151",
        "https://twitter.com/noladefense/status/1757897547517980970",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "https://twitter.com/noladefense/status/1757669587322097747",
        "https://twitter.com/noladefense/status/1757791665945805282",
        "https://twitter.com/noladefense/status/1757791736166826335",
        "https://twitter.com/noladefense/status/1757806706359177220",
        "https://twitter.com/noladefense/status/1757666128308928709",
        "https://twitter.com/noladefense/status/1757655407286202688",
        "https://twitter.com/noladefense/status/1757735485730926977",
        "https://twitter.com/noladefense/status/1757685543721128430",
        "https://twitter.com/noladefense/status/1757755176662757495",
        "https://twitter.com/noladefense/status/1757791406129590351",
        "https://twitter.com/noladefense/status/1757700660387098717",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany",
        "https://twitter.com/noladefense/status/1757669503347884387",
        "https://twitter.com/noladefense/status/1757656763866706365",
        "https://twitter.com/noladefense/status/1757855265834025383",
        "https://twitter.com/noladefense/status/1757676908945224032",
        "https://twitter.com/noladefense/status/1757649054962462820",
        "https://twitter.com/noladefense/status/1757664188665610588",
        "https://twitter.com/noladefense/status/1757882210164568434",
        "https://twitter.com/noladefense/status/1757798498739634618",
        "https://twitter.com/noladefense/status/1757647672817668444",
        "https://twitter.com/noladefense/status/1757664130083737825",
        "https://twitter.com/noladefense/status/1757629536445817192",
        "https://twitter.com/noladefense/status/1757579805413851349",
        "https://twitter.com/noladefense/status/1757866729152082385",
        "https://twitter.com/noladefense/status/1757867027945886026",
        "https://twitter.com/noladefense/status/1757625157051396177",
        "https://twitter.com/noladefense/status/1757647501073469503",
        "https://twitter.com/noladefense/status/1757634839027548571",
        "https://twitter.com/noladefense/status/1757665758522315260",
        "https://twitter.com/noladefense/status/1757806757261246530",
        "https://twitter.com/noladefense/status/1757663667007402488",
        "https://twitter.com/noladefense/status/1757745916327440649",
        "https://twitter.com/noladefense/status/1757651118299943164",
        "https://twitter.com/noladefense/status/1757766878208864298",
        "https://twitter.com/noladefense/status/1757665630403150241",
        "https://twitter.com/noladefense/status/1757625145181561203",
        "https://twitter.com/noladefense/status/1757881831456686441",
        "https://twitter.com/noladefense/status/1757755129825005883",
        "https://twitter.com/noladefense/status/1757685539325514222",
        "https://twitter.com/noladefense/status/1757806426687197524",
        "https://twitter.com/noladefense/status/1757800174770864603",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "https://twitter.com/noladefense/status/1757731155900498365",
        "https://twitter.com/noladefense/status/1757760995819180506",
        "https://twitter.com/noladefense/status/1757715798875865164",
        "https://twitter.com/noladefense/status/1757766932776780155",
        "https://twitter.com/noladefense/status/1757649351273279724",
        "https://twitter.com/noladefense/status/1757643911533650094",
        "https://twitter.com/noladefense/status/1757897066439757908",
        "https://twitter.com/noladefense/status/1757740261323530450",
        "https://twitter.com/noladefense/status/1757791654667260035",
        "https://twitter.com/noladefense/status/1757791796170514820",
        "https://twitter.com/noladefense/status/1757621334232686717",
        "https://twitter.com/noladefense/status/1757801524846031197",
        "https://twitter.com/noladefense/status/1757841668475097581",
        "https://twitter.com/noladefense/status/1757866705907310772",
        "https://twitter.com/noladefense/status/1757700679336935549",
        "https://twitter.com/noladefense/status/1757761029956604144",
        "www.historykillerpro.com",
        "https://twitter.com/noladefense/status/1757866751914545290",
        "https://twitter.com/noladefense/status/1757791757318672477",
        "https://twitter.com/noladefense/status/1757821277690032585",
        "https://twitter.com/noladefense/status/1757841724536213541",
        "https://twitter.com/noladefense/status/1757841784799936910",
        "https://twitter.com/noladefense/status/1757791441902793018",
        "https://twitter.com/noladefense/status/1757645844579340474",
        "https://twitter.com/noladefense/status/1757806785539301810",
        "https://twitter.com/noladefense/status/1757791537600025081",
        "https://twitter.com/noladefense/status/1757811936635367699",
        "https://twitter.com/noladefense/status/1757643789538058714",
        "https://twitter.com/noladefense/status/1757634780273783184",
        "https://twitter.com/noladefense/status/1757700655873953863",
        "https://twitter.com/noladefense/status/1757682591749013651",
        "https://twitter.com/noladefense/status/1757665697553912198",
        "https://twitter.com/noladefense/status/1757669714371764436"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojandownloader:win32/neojit.a",
            "Win32:delf-ses\\ [trj]",
            "Win.trojan.agent-1372316",
            "Variant.zusy.572 checkin"
          ],
          "industries": [
            "Transportation"
          ],
          "unique_indicators": 17677
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/dhl-urgent-fee.com",
    "whois": "http://whois.domaintools.com/dhl-urgent-fee.com",
    "domain": "dhl-urgent-fee.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "63eaffa16993c3f21e9ed286",
      "name": "DHL Phishing Collection",
      "description": "This page stores DHL phishing page IOCs. Legitimate website for the brand is https://www.dhl.com/\nNOLA defense is tracking newly observed phishing websites. Follow us on twitter https://twitter.com/noladefense",
      "modified": "2026-05-29T09:38:11.747000",
      "created": "2023-02-14T03:27:29.077000",
      "tags": [
        "urls",
        "url",
        "domains",
        "domain",
        "phishing",
        "scam",
        "dhl"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/9e06470d30593e11c8daad2157e0d4ef1ccce47787e2b5303846704767c26d6a"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Transportation"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 556,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "noladefense",
        "id": "222814",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_222814/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 34,
        "domain": 18,
        "URL": 1
      },
      "indicator_count": 53,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 429,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 0
    },
    {
      "id": "65d053a935bf99f5263deb57",
      "name": "History Killer Pro Injection deleting virustotal & otx.alienvault Pulses",
      "description": "History killer pro, is being used to delete and modify virustotal nodes and 41 otx.alienvault pulses. Junk data is being used to fill in missing pulses.\nTargeted: 1 callmeDoris  several scoreblue (sometimes I clone pulses) Octoseek.  \npulses.\nHallrender, Metro by T-Mobile, https://myaccount.uscis.gov/, Esurance,  40 pule reports are regarding Tsara Brashears cyber bully campaign which attacked the corporates mentioned except 2 AIG and Hallrender attackers. 100's of other modifications, deletions by another tool affecting several users.",
      "modified": "2024-03-18T04:01:27.756000",
      "created": "2024-02-17T06:35:21.666000",
      "tags": [
        "contacted",
        "execution",
        "january",
        "september",
        "whois record",
        "resolutions",
        "communicating",
        "roundup",
        "highly targeted",
        "phishing",
        "quasar",
        "malware",
        "open",
        "threat roundup",
        "referrer",
        "remote",
        "kimsuky",
        "passive dns",
        "urls",
        "dive domains",
        "creation date",
        "search",
        "record value",
        "date",
        "united",
        "scan endpoints",
        "all scoreblue",
        "unknown",
        "body",
        "brian sabey",
        "hall render",
        "reinsurance",
        "state",
        "danger",
        "threat",
        "critical",
        "crypthashdata",
        "read c",
        "tcmiheijkmutcix",
        "entries",
        "show",
        "t1055",
        "intel",
        "ms windows",
        "delphi",
        "win32",
        "copy",
        "write",
        "injection",
        "zusy",
        "neojit",
        "cyber stalking",
        "worker",
        "inject",
        "illegal",
        "tampering",
        "hijacker",
        "delete",
        "ret hat",
        "stalker",
        "shadow",
        "quasi"
      ],
      "references": [
        "www.historykillerpro.com",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "http://sniper.debugger.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Variant.Zusy.572 Checkin",
          "display_name": "Variant.Zusy.572 Checkin",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Neojit.A",
          "display_name": "TrojanDownloader:Win32/Neojit.A",
          "target": "/malware/TrojanDownloader:Win32/Neojit.A"
        },
        {
          "id": "Win32:Delf-SES\\ [Trj]",
          "display_name": "Win32:Delf-SES\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1372316",
          "display_name": "Win.Trojan.Agent-1372316",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1915,
        "FileHash-MD5": 437,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 3054,
        "domain": 987,
        "URL": 5902,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 12732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "807 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d0a9c7f1b04296d9b0d803",
      "name": "History Killer Pro Injection deleting VirusTotal & OTX.AlienVault Pulses",
      "description": "",
      "modified": "2024-03-18T04:01:27.756000",
      "created": "2024-02-17T12:42:47.334000",
      "tags": [
        "contacted",
        "execution",
        "january",
        "september",
        "whois record",
        "resolutions",
        "communicating",
        "roundup",
        "highly targeted",
        "phishing",
        "quasar",
        "malware",
        "open",
        "threat roundup",
        "referrer",
        "remote",
        "kimsuky",
        "passive dns",
        "urls",
        "dive domains",
        "creation date",
        "search",
        "record value",
        "date",
        "united",
        "scan endpoints",
        "all scoreblue",
        "unknown",
        "body",
        "brian sabey",
        "hall render",
        "reinsurance",
        "state",
        "danger",
        "threat",
        "critical",
        "crypthashdata",
        "read c",
        "tcmiheijkmutcix",
        "entries",
        "show",
        "t1055",
        "intel",
        "ms windows",
        "delphi",
        "win32",
        "copy",
        "write",
        "injection",
        "zusy",
        "neojit",
        "cyber stalking",
        "worker",
        "inject",
        "illegal",
        "tampering",
        "hijacker",
        "delete",
        "ret hat",
        "stalker",
        "shadow",
        "quasi"
      ],
      "references": [
        "www.historykillerpro.com",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "http://sniper.debugger.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Variant.Zusy.572 Checkin",
          "display_name": "Variant.Zusy.572 Checkin",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Neojit.A",
          "display_name": "TrojanDownloader:Win32/Neojit.A",
          "target": "/malware/TrojanDownloader:Win32/Neojit.A"
        },
        {
          "id": "Win32:Delf-SES\\ [Trj]",
          "display_name": "Win32:Delf-SES\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1372316",
          "display_name": "Win.Trojan.Agent-1372316",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65d053a935bf99f5263deb57",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1915,
        "FileHash-MD5": 437,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 3054,
        "domain": 987,
        "URL": 5902,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 12732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "807 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65cd573a581ddbe340404ce3",
      "name": "Twitter Feed - noladefense - 14-02-2024",
      "description": "",
      "modified": "2024-03-16T00:04:45.921000",
      "created": "2024-02-15T00:13:46.556000",
      "tags": [
        "phishing"
      ],
      "references": [
        "https://twitter.com/noladefense/status/1757564706372387204",
        "https://twitter.com/noladefense/status/1757579805413851349",
        "https://twitter.com/noladefense/status/1757579874833690912",
        "https://twitter.com/noladefense/status/1757579903665422567",
        "https://twitter.com/noladefense/status/1757610050334392783",
        "https://twitter.com/noladefense/status/1757610056059965515",
        "https://twitter.com/noladefense/status/1757621334232686717",
        "https://twitter.com/noladefense/status/1757625145181561203",
        "https://twitter.com/noladefense/status/1757625157051396177",
        "https://twitter.com/noladefense/status/1757625170812920195",
        "https://twitter.com/noladefense/status/1757629536445817192",
        "https://twitter.com/noladefense/status/1757631431440736304",
        "https://twitter.com/noladefense/status/1757631634092724302",
        "https://twitter.com/noladefense/status/1757633134915400107",
        "https://twitter.com/noladefense/status/1757633325206765883",
        "https://twitter.com/noladefense/status/1757634678566134057",
        "https://twitter.com/noladefense/status/1757634780273783184",
        "https://twitter.com/noladefense/status/1757634839027548571",
        "https://twitter.com/noladefense/status/1757638325215596654",
        "https://twitter.com/noladefense/status/1757643789538058714",
        "https://twitter.com/noladefense/status/1757643847566319869",
        "https://twitter.com/noladefense/status/1757643911533650094",
        "https://twitter.com/noladefense/status/1757643971658956845",
        "https://twitter.com/noladefense/status/1757644031503245796",
        "https://twitter.com/noladefense/status/1757645503871734089",
        "https://twitter.com/noladefense/status/1757645844579340474",
        "https://twitter.com/noladefense/status/1757647501073469503",
        "https://twitter.com/noladefense/status/1757647560187969901",
        "https://twitter.com/noladefense/status/1757647672817668444",
        "https://twitter.com/noladefense/status/1757649054962462820",
        "https://twitter.com/noladefense/status/1757649098147066091",
        "https://twitter.com/noladefense/status/1757649351273279724",
        "https://twitter.com/noladefense/status/1757651118299943164",
        "https://twitter.com/noladefense/status/1757655398033588479",
        "https://twitter.com/noladefense/status/1757655407286202688",
        "https://twitter.com/noladefense/status/1757656357501534531",
        "https://twitter.com/noladefense/status/1757656697303134535",
        "https://twitter.com/noladefense/status/1757656763866706365",
        "https://twitter.com/noladefense/status/1757663667007402488",
        "https://twitter.com/noladefense/status/1757664069824213339",
        "https://twitter.com/noladefense/status/1757664130083737825",
        "https://twitter.com/noladefense/status/1757664188665610588",
        "https://twitter.com/noladefense/status/1757664248753205739",
        "https://twitter.com/noladefense/status/1757665630403150241",
        "https://twitter.com/noladefense/status/1757665697553912198",
        "https://twitter.com/noladefense/status/1757665758522315260",
        "https://twitter.com/noladefense/status/1757666128308928709",
        "https://twitter.com/noladefense/status/1757669448603869261",
        "https://twitter.com/noladefense/status/1757669503347884387",
        "https://twitter.com/noladefense/status/1757669587322097747",
        "https://twitter.com/noladefense/status/1757669658432311358",
        "https://twitter.com/noladefense/status/1757669714371764436",
        "https://twitter.com/noladefense/status/1757670448521675146",
        "https://twitter.com/noladefense/status/1757670463596028338",
        "https://twitter.com/noladefense/status/1757670486773743886",
        "https://twitter.com/noladefense/status/1757670637177327960",
        "https://twitter.com/noladefense/status/1757673671114539027",
        "https://twitter.com/noladefense/status/1757676908945224032",
        "https://twitter.com/noladefense/status/1757681093090648559",
        "https://twitter.com/noladefense/status/1757682591749013651",
        "https://twitter.com/noladefense/status/1757685539325514222",
        "https://twitter.com/noladefense/status/1757685543721128430",
        "https://twitter.com/noladefense/status/1757700616065884488",
        "https://twitter.com/noladefense/status/1757700626656477629",
        "https://twitter.com/noladefense/status/1757700655873953863",
        "https://twitter.com/noladefense/status/1757700660387098717",
        "https://twitter.com/noladefense/status/1757700679336935549",
        "https://twitter.com/noladefense/status/1757700807892365763",
        "https://twitter.com/noladefense/status/1757700819695071386",
        "https://twitter.com/noladefense/status/1757707171339370763",
        "https://twitter.com/noladefense/status/1757707235747041410",
        "https://twitter.com/noladefense/status/1757708798347583834",
        "https://twitter.com/noladefense/status/1757715767968112643",
        "https://twitter.com/noladefense/status/1757715773919740224",
        "https://twitter.com/noladefense/status/1757715798875865164",
        "https://twitter.com/noladefense/status/1757716385583534455",
        "https://twitter.com/noladefense/status/1757731155900498365",
        "https://twitter.com/noladefense/status/1757735485730926977",
        "https://twitter.com/noladefense/status/1757740261323530450",
        "https://twitter.com/noladefense/status/1757745916327440649",
        "https://twitter.com/noladefense/status/1757745933175959864",
        "https://twitter.com/noladefense/status/1757746076172304618",
        "https://twitter.com/noladefense/status/1757746233584615689",
        "https://twitter.com/noladefense/status/1757752130490798106",
        "https://twitter.com/noladefense/status/1757755129825005883",
        "https://twitter.com/noladefense/status/1757755176662757495",
        "https://twitter.com/noladefense/status/1757760995819180506",
        "https://twitter.com/noladefense/status/1757761029956604144",
        "https://twitter.com/noladefense/status/1757766878208864298",
        "https://twitter.com/noladefense/status/1757766932776780155",
        "https://twitter.com/noladefense/status/1757770255101804836",
        "https://twitter.com/noladefense/status/1757776622868967608",
        "https://twitter.com/noladefense/status/1757791406129590351",
        "https://twitter.com/noladefense/status/1757791441902793018",
        "https://twitter.com/noladefense/status/1757791537600025081",
        "https://twitter.com/noladefense/status/1757791606239883299",
        "https://twitter.com/noladefense/status/1757791654667260035",
        "https://twitter.com/noladefense/status/1757791665945805282",
        "https://twitter.com/noladefense/status/1757791673390674279",
        "https://twitter.com/noladefense/status/1757791736166826335",
        "https://twitter.com/noladefense/status/1757791757318672477",
        "https://twitter.com/noladefense/status/1757791796170514820",
        "https://twitter.com/noladefense/status/1757796977243275549",
        "https://twitter.com/noladefense/status/1757798498739634618",
        "https://twitter.com/noladefense/status/1757799906306130422",
        "https://twitter.com/noladefense/status/1757799949792579645",
        "https://twitter.com/noladefense/status/1757800118160392396",
        "https://twitter.com/noladefense/status/1757800174770864603",
        "https://twitter.com/noladefense/status/1757801524846031197",
        "https://twitter.com/noladefense/status/1757806380629545151",
        "https://twitter.com/noladefense/status/1757806412082631096",
        "https://twitter.com/noladefense/status/1757806426687197524",
        "https://twitter.com/noladefense/status/1757806576025346131",
        "https://twitter.com/noladefense/status/1757806706359177220",
        "https://twitter.com/noladefense/status/1757806757261246530",
        "https://twitter.com/noladefense/status/1757806785539301810",
        "https://twitter.com/noladefense/status/1757808588481786077",
        "https://twitter.com/noladefense/status/1757808652918849671",
        "https://twitter.com/noladefense/status/1757811936635367699",
        "https://twitter.com/noladefense/status/1757821277690032585",
        "https://twitter.com/noladefense/status/1757821391720562857",
        "https://twitter.com/noladefense/status/1757821423869993188",
        "https://twitter.com/noladefense/status/1757821429448421523",
        "https://twitter.com/noladefense/status/1757841668475097581",
        "https://twitter.com/noladefense/status/1757841724536213541",
        "https://twitter.com/noladefense/status/1757841784799936910",
        "https://twitter.com/noladefense/status/1757844787967750165",
        "https://twitter.com/noladefense/status/1757844840941867237",
        "https://twitter.com/noladefense/status/1757855265834025383",
        "https://twitter.com/noladefense/status/1757855323711246459",
        "https://twitter.com/noladefense/status/1757858535428194432",
        "https://twitter.com/noladefense/status/1757866705907310772",
        "https://twitter.com/noladefense/status/1757866729152082385",
        "https://twitter.com/noladefense/status/1757866751914545290",
        "https://twitter.com/noladefense/status/1757866802082697591",
        "https://twitter.com/noladefense/status/1757867027945886026",
        "https://twitter.com/noladefense/status/1757867041694818759",
        "https://twitter.com/noladefense/status/1757867092307501365",
        "https://twitter.com/noladefense/status/1757867146380443946",
        "https://twitter.com/noladefense/status/1757867214605074765",
        "https://twitter.com/noladefense/status/1757881831456686441",
        "https://twitter.com/noladefense/status/1757881896686510323",
        "https://twitter.com/noladefense/status/1757881901774237963",
        "https://twitter.com/noladefense/status/1757882152002134439",
        "https://twitter.com/noladefense/status/1757882210164568434",
        "https://twitter.com/noladefense/status/1757882332696993815",
        "https://twitter.com/noladefense/status/1757882355702694324",
        "https://twitter.com/noladefense/status/1757897040174989341",
        "https://twitter.com/noladefense/status/1757897066439757908",
        "https://twitter.com/noladefense/status/1757897088778571830",
        "https://twitter.com/noladefense/status/1757897091928494468",
        "https://twitter.com/noladefense/status/1757897547517980970",
        "https://twitter.com/noladefense/status/1757897572989968706",
        "https://twitter.com/noladefense/status/1757897627490812173"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 63,
        "URL": 110,
        "FileHash-SHA256": 141,
        "domain": 45,
        "FileHash-MD5": 7
      },
      "indicator_count": 366,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1624,
      "modified_text": "809 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dhl-urgent-fee.com/secure",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://dhl-urgent-fee.com/secure",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780468815.020523
}