{
  "type": "URL",
  "indicator": "https://dummyns.aliautoman.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://dummyns.aliautoman.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3844949095,
      "indicator": "https://dummyns.aliautoman.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68ae5b9ef87646927a236b61",
          "name": "Privacy - Google Videos Search - Web Applications Stack Exchange = WannaCry",
          "description": "Description: dfir.blog - A blog about Digital Forensics & Incident Response\ndfir.blog\nDigital forensics, web browsers, visualizations, & open source tools.\n#monitoring #dod(?) #chinacache #crypt #ransom#infectedsystems",
          "modified": "2025-09-26T00:01:12.214000",
          "created": "2025-08-27T01:13:02.780000",
          "tags": [
            "google",
            "mullvad browser",
            "value",
            "incognito mode",
            "mine",
            "unix time",
            "friday",
            "january",
            "does",
            "tor browser",
            "search",
            "show",
            "langchinese",
            "packing t1045",
            "t1045",
            "medium",
            "pe resource",
            "module load",
            "t1129",
            "service",
            "trojan",
            "copy",
            "dock",
            "write",
            "malware",
            "clock",
            "united",
            "passive dns",
            "urls",
            "next associated",
            "gmt cache",
            "ipv4 add",
            "pulse pulses",
            "files",
            "reverse dns",
            "win32",
            "title",
            "location united",
            "america flag",
            "america asn",
            "as15169 google",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "present aug",
            "china unknown",
            "creation date",
            "date",
            "domain",
            "ip address",
            "domain name",
            "expiration date",
            "status ok",
            "nanjing",
            "accept",
            "body",
            "div td",
            "td tr",
            "div div",
            "span span",
            "a li",
            "span p",
            "p div",
            "moved",
            "a domains",
            "open",
            "span",
            "uuupupu",
            "t1055",
            "process32nextw",
            "high",
            "windows",
            "high defense",
            "evasion",
            "delphi",
            "google gmail",
            "images sign",
            "advanced search",
            "solutions",
            "privacy",
            "store gmail",
            "delete delete",
            "report",
            "how search",
            "applying ai",
            "settings search",
            "advanced",
            "search search",
            "search help",
            "domainabuse",
            "showing",
            "hostname add",
            "url add",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "read c",
            "tlsv1",
            "whitelisted",
            "port",
            "destination",
            "ascii text",
            "next",
            "encrypt",
            "script urls",
            "msie",
            "chrome",
            "bad gateway",
            "script domains",
            "present feb",
            "link",
            "meta",
            "digital",
            "language",
            "body doctype",
            "ghost",
            "present jun",
            "aaaa",
            "present jul",
            "present oct",
            "record value",
            "yara detections",
            "dock zone",
            "top source",
            "top destination",
            "source source",
            "filehash",
            "code",
            "error",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "execution",
            "persistence",
            "tulach",
            "brian sabey",
            "dod network",
            "orgtechref",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity dnic",
            "handle",
            "whois lookup",
            "dod",
            "et trojan",
            "server header",
            "suspicious",
            "et info",
            "unknown",
            "virustotal",
            "specified",
            "download",
            "et",
            "please",
            "type size",
            "first seen",
            "loading",
            "python wheel",
            "dynamicloader",
            "intel",
            "ms windows",
            "pe32",
            "entries",
            "user agent",
            "powershell",
            "agent",
            "yara rule",
            "checks",
            "levelblue",
            "open threat",
            "observed dns",
            "query",
            "dns lookup",
            "msdos",
            "wannacry dns",
            "lookup",
            "wannacry",
            "worm",
            "explorer",
            "msil",
            "darkcomet",
            "ping",
            "tools",
            "capture",
            "hallrender",
            "dga domains",
            "unfurl sites",
            "honey net",
            "bot",
            "nxdomain",
            "potential-c2"
          ],
          "references": [
            "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
            "DoD Network Information Center (DNIC)",
            "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
            "Python Wheel package",
            "https://www.google.com/search",
            "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
            "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan:Win32/Magania.DSK!MTB",
              "display_name": "Trojan:Win32/Magania.DSK!MTB",
              "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
            },
            {
              "id": "Trojan:Win32/Zusy",
              "display_name": "Trojan:Win32/Zusy",
              "target": "/malware/Trojan:Win32/Zusy"
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "a variant of Win32/Kryptik.DEOA",
              "display_name": "a variant of Win32/Kryptik.DEOA",
              "target": null
            },
            {
              "id": "ALF:Exploit:Win32/gSharedInfoRef.A",
              "display_name": "ALF:Exploit:Win32/gSharedInfoRef.A",
              "target": null
            },
            {
              "id": "Wannacry",
              "display_name": "Wannacry",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1054",
              "name": "Indicator Blocking",
              "display_name": "T1054 - Indicator Blocking"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Civilian"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 40,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8221,
            "domain": 1216,
            "FileHash-SHA256": 2434,
            "FileHash-MD5": 296,
            "FileHash-SHA1": 155,
            "hostname": 2939,
            "email": 7,
            "SSLCertFingerprint": 8,
            "CIDR": 2
          },
          "indicator_count": 15278,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66e01dc0fd31b731b2d5dac7",
          "name": "Cloudflade Botnet \u00bb  | 1.1.1.1 | Warp.Plus?  | smlpp.monster | Mirai",
          "description": "This issue may only affect those already in Botnet/s. DoS.Bad login requests .dead host, CnC,\nELF:Mirai-GH\\ [Trj] ,\nMirai ,\nNIDS m\nTrojan:Win32/Danabot",
          "modified": "2024-10-10T10:03:15.339000",
          "created": "2024-09-10T10:21:52.428000",
          "tags": [
            "ip block",
            "list",
            "historical ssl",
            "iocs",
            "apt ip",
            "address list",
            "nukespeed",
            "bot networks",
            "listen",
            "tracker",
            "powershell",
            "http response",
            "final url",
            "ip address",
            "status code",
            "kb body",
            "sha256",
            "gmt server",
            "united",
            "passive dns",
            "as54113",
            "arial",
            "dynamic link",
            "msg div",
            "all scoreblue",
            "south korea",
            "china as4134",
            "china as4837",
            "as4766 korea",
            "as9318 sk",
            "taiwan as3462",
            "high",
            "nids",
            "tcp syn",
            "resolverror",
            "malware",
            "next",
            "certificate",
            "encrypt",
            "title invalid",
            "a domains",
            "files",
            "ip related",
            "pulses otx",
            "as21928",
            "china as9394",
            "asnone",
            "as701 verizon",
            "china asnone",
            "port",
            "destination",
            "south africa",
            "tunisia as37693",
            "nigeria asnone",
            "tunisia asnone",
            "kenya as36926",
            "egypt as36992",
            "as14061",
            "aaaa",
            "moved",
            "search",
            "body",
            "114.114.114.114",
            "tulach",
            "telnet",
            "firebase app",
            "telnet login",
            "bad login",
            "gpl telnet",
            "telnet root",
            "hisilicon dvr",
            "hong kong",
            "activity",
            "copy",
            "suspicious path",
            "fbotsatori",
            "yara detections",
            "contacted",
            "cname",
            "urls",
            "creation date",
            "otx telemetry",
            "record value",
            "date",
            "unknown",
            "as51468",
            "denmark unknown",
            "scan endpoints",
            "pulse pulses",
            "dcbg",
            "status",
            "hostname",
            "taiwan",
            "as3462",
            "showing",
            "as17421",
            "entries",
            "win32",
            "busybox"
          ],
          "references": [
            "Cloudflare | 1.1.1.1 -WarpPlus/****",
            "smlpp.monster",
            "IDS Detections: Fbot/Satori CnC Checkin SUSPICIOUS Path to BusyBox Bad Login root logbusyboxin",
            "Alerts: dead_host nids_malware_alert network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
            "Yara Detections is__elf ,  LZMA",
            "Tulach- 114.114.114.114"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "India",
            "Korea, Republic of",
            "Japan",
            "Hong Kong",
            "Philippines",
            "Taiwan",
            "Indonesia",
            "Australia",
            "France",
            "South Africa",
            "United States of America",
            "Italy"
          ],
          "malware_families": [
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "ELF:Mirai-GH\\ [Trj]",
              "display_name": "ELF:Mirai-GH\\ [Trj]",
              "target": null
            },
            {
              "id": "Trojan:Win32/Danabot",
              "display_name": "Trojan:Win32/Danabot",
              "target": "/malware/Trojan:Win32/Danabot"
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civilian Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 144,
            "FileHash-SHA256": 863,
            "domain": 640,
            "hostname": 740,
            "URL": 1117,
            "email": 3,
            "CVE": 1
          },
          "indicator_count": 3652,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "598 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66e01e7b6a0bc2abe0d6c0d1",
          "name": "Cloudflare Botnet- https://otx.alienvault.com/pulse/66e01dc0fd31b731b2d5dac7",
          "description": "",
          "modified": "2024-10-10T10:03:15.339000",
          "created": "2024-09-10T10:24:59.035000",
          "tags": [
            "ip block",
            "list",
            "historical ssl",
            "iocs",
            "apt ip",
            "address list",
            "nukespeed",
            "bot networks",
            "listen",
            "tracker",
            "powershell",
            "http response",
            "final url",
            "ip address",
            "status code",
            "kb body",
            "sha256",
            "gmt server",
            "united",
            "passive dns",
            "as54113",
            "arial",
            "dynamic link",
            "msg div",
            "all scoreblue",
            "south korea",
            "china as4134",
            "china as4837",
            "as4766 korea",
            "as9318 sk",
            "taiwan as3462",
            "high",
            "nids",
            "tcp syn",
            "resolverror",
            "malware",
            "next",
            "certificate",
            "encrypt",
            "title invalid",
            "a domains",
            "files",
            "ip related",
            "pulses otx",
            "as21928",
            "china as9394",
            "asnone",
            "as701 verizon",
            "china asnone",
            "port",
            "destination",
            "south africa",
            "tunisia as37693",
            "nigeria asnone",
            "tunisia asnone",
            "kenya as36926",
            "egypt as36992",
            "as14061",
            "aaaa",
            "moved",
            "search",
            "body",
            "114.114.114.114",
            "tulach",
            "telnet",
            "firebase app",
            "telnet login",
            "bad login",
            "gpl telnet",
            "telnet root",
            "hisilicon dvr",
            "hong kong",
            "activity",
            "copy",
            "suspicious path",
            "fbotsatori",
            "yara detections",
            "contacted",
            "cname",
            "urls",
            "creation date",
            "otx telemetry",
            "record value",
            "date",
            "unknown",
            "as51468",
            "denmark unknown",
            "scan endpoints",
            "pulse pulses",
            "dcbg",
            "status",
            "hostname",
            "taiwan",
            "as3462",
            "showing",
            "as17421",
            "entries",
            "win32",
            "busybox"
          ],
          "references": [
            "Cloudflare | 1.1.1.1 -WarpPlus/****",
            "smlpp.monster",
            "IDS Detections: Fbot/Satori CnC Checkin SUSPICIOUS Path to BusyBox Bad Login root logbusyboxin",
            "Alerts: dead_host nids_malware_alert network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
            "Yara Detections is__elf ,  LZMA",
            "Tulach- 114.114.114.114"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "India",
            "Korea, Republic of",
            "Japan",
            "Hong Kong",
            "Philippines",
            "Taiwan",
            "Indonesia",
            "Australia",
            "France",
            "South Africa",
            "United States of America",
            "Italy"
          ],
          "malware_families": [
            {
              "id": "NIDS",
              "display_name": "NIDS",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "ELF:Mirai-GH\\ [Trj]",
              "display_name": "ELF:Mirai-GH\\ [Trj]",
              "target": null
            },
            {
              "id": "Trojan:Win32/Danabot",
              "display_name": "Trojan:Win32/Danabot",
              "target": "/malware/Trojan:Win32/Danabot"
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civilian Society"
          ],
          "TLP": "green",
          "cloned_from": "66e01dc0fd31b731b2d5dac7",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 144,
            "FileHash-SHA1": 144,
            "FileHash-SHA256": 863,
            "domain": 640,
            "hostname": 740,
            "URL": 1117,
            "email": 3,
            "CVE": 1
          },
          "indicator_count": 3652,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "598 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "667af85fe8fea6365adaa65d",
          "name": "Norton & Norton Lifelock Products",
          "description": "Just taking a pak at some Norton-Related Problems\n(03.11.24): https://www.virustotal.com/graph/embed/g8619c830b2c24d849472aef95a362ce113e12cd6d68849e7a83c7eca387a378a?theme=dark",
          "modified": "2024-09-29T20:01:29.028000",
          "created": "2024-06-25T17:03:27.155000",
          "tags": [
            "entity",
            "please",
            "javascript",
            "xwwmwh4cg2hpw"
          ],
          "references": [
            "https://www.virustotal.com/graph/embed/g8619c830b2c24d849472aef95a362ce113e12cd6d68849e7a83c7eca387a378a?theme=dark",
            "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/summary",
            "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/iocs",
            "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/graph",
            "08.30.24: e1ec7ebd4046143153dd28dd2b5a54cf34edd137c6288f4e56c6449f0753a986 (VT)",
            "08.30.24: Report ID: \t 6a27e451-df79-4f90-a022-9aa15cb58cea (Filescanio)"
          ],
          "public": 1,
          "adversary": "Norton Norton Lifelock Telus",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 50,
            "FileHash-SHA1": 54,
            "FileHash-SHA256": 831,
            "URL": 1120,
            "domain": 181,
            "hostname": 261
          },
          "indicator_count": 2497,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "609 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IDS Detections: Fbot/Satori CnC Checkin SUSPICIOUS Path to BusyBox Bad Login root logbusyboxin",
        "DoD Network Information Center (DNIC)",
        "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
        "08.30.24: e1ec7ebd4046143153dd28dd2b5a54cf34edd137c6288f4e56c6449f0753a986 (VT)",
        "Yara Detections is__elf ,  LZMA",
        "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/graph",
        "Alerts: dead_host nids_malware_alert network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "Cloudflare | 1.1.1.1 -WarpPlus/****",
        "Tulach- 114.114.114.114",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/iocs",
        "08.30.24: Report ID: \t 6a27e451-df79-4f90-a022-9aa15cb58cea (Filescanio)",
        "https://www.google.com/search",
        "smlpp.monster",
        "https://www.virustotal.com/graph/embed/g8619c830b2c24d849472aef95a362ce113e12cd6d68849e7a83c7eca387a378a?theme=dark",
        "Python Wheel package",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/summary"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Norton Norton Lifelock Telus"
          ],
          "malware_families": [
            "Trojan:win32/magania.dsk!mtb",
            "Nids",
            "Elf:mirai-gh\\ [trj]",
            "Wannacry",
            "Trojan:win32/zusy",
            "Et",
            "Trojan:win32/danabot",
            "A variant of win32/kryptik.deoa",
            "Alf:exploit:win32/gsharedinforef.a",
            "Mirai"
          ],
          "industries": [
            "Telecommunications",
            "Civilian",
            "Civilian society",
            "Technology"
          ],
          "unique_indicators": 20555
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/aliautoman.com",
    "whois": "http://whois.domaintools.com/aliautoman.com",
    "domain": "aliautoman.com",
    "hostname": "dummyns.aliautoman.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68ae5b9ef87646927a236b61",
      "name": "Privacy - Google Videos Search - Web Applications Stack Exchange = WannaCry",
      "description": "Description: dfir.blog - A blog about Digital Forensics & Incident Response\ndfir.blog\nDigital forensics, web browsers, visualizations, & open source tools.\n#monitoring #dod(?) #chinacache #crypt #ransom#infectedsystems",
      "modified": "2025-09-26T00:01:12.214000",
      "created": "2025-08-27T01:13:02.780000",
      "tags": [
        "google",
        "mullvad browser",
        "value",
        "incognito mode",
        "mine",
        "unix time",
        "friday",
        "january",
        "does",
        "tor browser",
        "search",
        "show",
        "langchinese",
        "packing t1045",
        "t1045",
        "medium",
        "pe resource",
        "module load",
        "t1129",
        "service",
        "trojan",
        "copy",
        "dock",
        "write",
        "malware",
        "clock",
        "united",
        "passive dns",
        "urls",
        "next associated",
        "gmt cache",
        "ipv4 add",
        "pulse pulses",
        "files",
        "reverse dns",
        "win32",
        "title",
        "location united",
        "america flag",
        "america asn",
        "as15169 google",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "present aug",
        "china unknown",
        "creation date",
        "date",
        "domain",
        "ip address",
        "domain name",
        "expiration date",
        "status ok",
        "nanjing",
        "accept",
        "body",
        "div td",
        "td tr",
        "div div",
        "span span",
        "a li",
        "span p",
        "p div",
        "moved",
        "a domains",
        "open",
        "span",
        "uuupupu",
        "t1055",
        "process32nextw",
        "high",
        "windows",
        "high defense",
        "evasion",
        "delphi",
        "google gmail",
        "images sign",
        "advanced search",
        "solutions",
        "privacy",
        "store gmail",
        "delete delete",
        "report",
        "how search",
        "applying ai",
        "settings search",
        "advanced",
        "search search",
        "search help",
        "domainabuse",
        "showing",
        "hostname add",
        "url add",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "read c",
        "tlsv1",
        "whitelisted",
        "port",
        "destination",
        "ascii text",
        "next",
        "encrypt",
        "script urls",
        "msie",
        "chrome",
        "bad gateway",
        "script domains",
        "present feb",
        "link",
        "meta",
        "digital",
        "language",
        "body doctype",
        "ghost",
        "present jun",
        "aaaa",
        "present jul",
        "present oct",
        "record value",
        "yara detections",
        "dock zone",
        "top source",
        "top destination",
        "source source",
        "filehash",
        "code",
        "error",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "execution",
        "persistence",
        "tulach",
        "brian sabey",
        "dod network",
        "orgtechref",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity dnic",
        "handle",
        "whois lookup",
        "dod",
        "et trojan",
        "server header",
        "suspicious",
        "et info",
        "unknown",
        "virustotal",
        "specified",
        "download",
        "et",
        "please",
        "type size",
        "first seen",
        "loading",
        "python wheel",
        "dynamicloader",
        "intel",
        "ms windows",
        "pe32",
        "entries",
        "user agent",
        "powershell",
        "agent",
        "yara rule",
        "checks",
        "levelblue",
        "open threat",
        "observed dns",
        "query",
        "dns lookup",
        "msdos",
        "wannacry dns",
        "lookup",
        "wannacry",
        "worm",
        "explorer",
        "msil",
        "darkcomet",
        "ping",
        "tools",
        "capture",
        "hallrender",
        "dga domains",
        "unfurl sites",
        "honey net",
        "bot",
        "nxdomain",
        "potential-c2"
      ],
      "references": [
        "Don\u2019t click! https://webapps.stackexchange.com/questions/172215/google-videos-search-sca-esv-query-parameter-possible-tracking | Infected systems",
        "DoD Network Information Center (DNIC)",
        "DoD Network Information Center disa.columbus.ns.mbx.arin-registrations@mail.mil [seen throughout}",
        "Python Wheel package",
        "https://www.google.com/search",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com",
        "https://otx.alienvault.com/indicator/hostname/palantir.hosted-by-discourse.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan:Win32/Magania.DSK!MTB",
          "display_name": "Trojan:Win32/Magania.DSK!MTB",
          "target": "/malware/Trojan:Win32/Magania.DSK!MTB"
        },
        {
          "id": "Trojan:Win32/Zusy",
          "display_name": "Trojan:Win32/Zusy",
          "target": "/malware/Trojan:Win32/Zusy"
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "a variant of Win32/Kryptik.DEOA",
          "display_name": "a variant of Win32/Kryptik.DEOA",
          "target": null
        },
        {
          "id": "ALF:Exploit:Win32/gSharedInfoRef.A",
          "display_name": "ALF:Exploit:Win32/gSharedInfoRef.A",
          "target": null
        },
        {
          "id": "Wannacry",
          "display_name": "Wannacry",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1054",
          "name": "Indicator Blocking",
          "display_name": "T1054 - Indicator Blocking"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Telecommunications",
        "Technology",
        "Civilian"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 40,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8221,
        "domain": 1216,
        "FileHash-SHA256": 2434,
        "FileHash-MD5": 296,
        "FileHash-SHA1": 155,
        "hostname": 2939,
        "email": 7,
        "SSLCertFingerprint": 8,
        "CIDR": 2
      },
      "indicator_count": 15278,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66e01dc0fd31b731b2d5dac7",
      "name": "Cloudflade Botnet \u00bb  | 1.1.1.1 | Warp.Plus?  | smlpp.monster | Mirai",
      "description": "This issue may only affect those already in Botnet/s. DoS.Bad login requests .dead host, CnC,\nELF:Mirai-GH\\ [Trj] ,\nMirai ,\nNIDS m\nTrojan:Win32/Danabot",
      "modified": "2024-10-10T10:03:15.339000",
      "created": "2024-09-10T10:21:52.428000",
      "tags": [
        "ip block",
        "list",
        "historical ssl",
        "iocs",
        "apt ip",
        "address list",
        "nukespeed",
        "bot networks",
        "listen",
        "tracker",
        "powershell",
        "http response",
        "final url",
        "ip address",
        "status code",
        "kb body",
        "sha256",
        "gmt server",
        "united",
        "passive dns",
        "as54113",
        "arial",
        "dynamic link",
        "msg div",
        "all scoreblue",
        "south korea",
        "china as4134",
        "china as4837",
        "as4766 korea",
        "as9318 sk",
        "taiwan as3462",
        "high",
        "nids",
        "tcp syn",
        "resolverror",
        "malware",
        "next",
        "certificate",
        "encrypt",
        "title invalid",
        "a domains",
        "files",
        "ip related",
        "pulses otx",
        "as21928",
        "china as9394",
        "asnone",
        "as701 verizon",
        "china asnone",
        "port",
        "destination",
        "south africa",
        "tunisia as37693",
        "nigeria asnone",
        "tunisia asnone",
        "kenya as36926",
        "egypt as36992",
        "as14061",
        "aaaa",
        "moved",
        "search",
        "body",
        "114.114.114.114",
        "tulach",
        "telnet",
        "firebase app",
        "telnet login",
        "bad login",
        "gpl telnet",
        "telnet root",
        "hisilicon dvr",
        "hong kong",
        "activity",
        "copy",
        "suspicious path",
        "fbotsatori",
        "yara detections",
        "contacted",
        "cname",
        "urls",
        "creation date",
        "otx telemetry",
        "record value",
        "date",
        "unknown",
        "as51468",
        "denmark unknown",
        "scan endpoints",
        "pulse pulses",
        "dcbg",
        "status",
        "hostname",
        "taiwan",
        "as3462",
        "showing",
        "as17421",
        "entries",
        "win32",
        "busybox"
      ],
      "references": [
        "Cloudflare | 1.1.1.1 -WarpPlus/****",
        "smlpp.monster",
        "IDS Detections: Fbot/Satori CnC Checkin SUSPICIOUS Path to BusyBox Bad Login root logbusyboxin",
        "Alerts: dead_host nids_malware_alert network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "Yara Detections is__elf ,  LZMA",
        "Tulach- 114.114.114.114"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "India",
        "Korea, Republic of",
        "Japan",
        "Hong Kong",
        "Philippines",
        "Taiwan",
        "Indonesia",
        "Australia",
        "France",
        "South Africa",
        "United States of America",
        "Italy"
      ],
      "malware_families": [
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "ELF:Mirai-GH\\ [Trj]",
          "display_name": "ELF:Mirai-GH\\ [Trj]",
          "target": null
        },
        {
          "id": "Trojan:Win32/Danabot",
          "display_name": "Trojan:Win32/Danabot",
          "target": "/malware/Trojan:Win32/Danabot"
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civilian Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 144,
        "FileHash-SHA256": 863,
        "domain": 640,
        "hostname": 740,
        "URL": 1117,
        "email": 3,
        "CVE": 1
      },
      "indicator_count": 3652,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "598 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66e01e7b6a0bc2abe0d6c0d1",
      "name": "Cloudflare Botnet- https://otx.alienvault.com/pulse/66e01dc0fd31b731b2d5dac7",
      "description": "",
      "modified": "2024-10-10T10:03:15.339000",
      "created": "2024-09-10T10:24:59.035000",
      "tags": [
        "ip block",
        "list",
        "historical ssl",
        "iocs",
        "apt ip",
        "address list",
        "nukespeed",
        "bot networks",
        "listen",
        "tracker",
        "powershell",
        "http response",
        "final url",
        "ip address",
        "status code",
        "kb body",
        "sha256",
        "gmt server",
        "united",
        "passive dns",
        "as54113",
        "arial",
        "dynamic link",
        "msg div",
        "all scoreblue",
        "south korea",
        "china as4134",
        "china as4837",
        "as4766 korea",
        "as9318 sk",
        "taiwan as3462",
        "high",
        "nids",
        "tcp syn",
        "resolverror",
        "malware",
        "next",
        "certificate",
        "encrypt",
        "title invalid",
        "a domains",
        "files",
        "ip related",
        "pulses otx",
        "as21928",
        "china as9394",
        "asnone",
        "as701 verizon",
        "china asnone",
        "port",
        "destination",
        "south africa",
        "tunisia as37693",
        "nigeria asnone",
        "tunisia asnone",
        "kenya as36926",
        "egypt as36992",
        "as14061",
        "aaaa",
        "moved",
        "search",
        "body",
        "114.114.114.114",
        "tulach",
        "telnet",
        "firebase app",
        "telnet login",
        "bad login",
        "gpl telnet",
        "telnet root",
        "hisilicon dvr",
        "hong kong",
        "activity",
        "copy",
        "suspicious path",
        "fbotsatori",
        "yara detections",
        "contacted",
        "cname",
        "urls",
        "creation date",
        "otx telemetry",
        "record value",
        "date",
        "unknown",
        "as51468",
        "denmark unknown",
        "scan endpoints",
        "pulse pulses",
        "dcbg",
        "status",
        "hostname",
        "taiwan",
        "as3462",
        "showing",
        "as17421",
        "entries",
        "win32",
        "busybox"
      ],
      "references": [
        "Cloudflare | 1.1.1.1 -WarpPlus/****",
        "smlpp.monster",
        "IDS Detections: Fbot/Satori CnC Checkin SUSPICIOUS Path to BusyBox Bad Login root logbusyboxin",
        "Alerts: dead_host nids_malware_alert network_icmp tcp_syn_scan nolookup_communication nids_alert writes_to_stdout",
        "Yara Detections is__elf ,  LZMA",
        "Tulach- 114.114.114.114"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "India",
        "Korea, Republic of",
        "Japan",
        "Hong Kong",
        "Philippines",
        "Taiwan",
        "Indonesia",
        "Australia",
        "France",
        "South Africa",
        "United States of America",
        "Italy"
      ],
      "malware_families": [
        {
          "id": "NIDS",
          "display_name": "NIDS",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "ELF:Mirai-GH\\ [Trj]",
          "display_name": "ELF:Mirai-GH\\ [Trj]",
          "target": null
        },
        {
          "id": "Trojan:Win32/Danabot",
          "display_name": "Trojan:Win32/Danabot",
          "target": "/malware/Trojan:Win32/Danabot"
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civilian Society"
      ],
      "TLP": "green",
      "cloned_from": "66e01dc0fd31b731b2d5dac7",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 144,
        "FileHash-SHA1": 144,
        "FileHash-SHA256": 863,
        "domain": 640,
        "hostname": 740,
        "URL": 1117,
        "email": 3,
        "CVE": 1
      },
      "indicator_count": 3652,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "598 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "667af85fe8fea6365adaa65d",
      "name": "Norton & Norton Lifelock Products",
      "description": "Just taking a pak at some Norton-Related Problems\n(03.11.24): https://www.virustotal.com/graph/embed/g8619c830b2c24d849472aef95a362ce113e12cd6d68849e7a83c7eca387a378a?theme=dark",
      "modified": "2024-09-29T20:01:29.028000",
      "created": "2024-06-25T17:03:27.155000",
      "tags": [
        "entity",
        "please",
        "javascript",
        "xwwmwh4cg2hpw"
      ],
      "references": [
        "https://www.virustotal.com/graph/embed/g8619c830b2c24d849472aef95a362ce113e12cd6d68849e7a83c7eca387a378a?theme=dark",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/summary",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/iocs",
        "https://www.virustotal.com/gui/collection/aabd4abecf7099202ccbfbc1cec130ea266329ade38b040169399c6abf97a188/graph",
        "08.30.24: e1ec7ebd4046143153dd28dd2b5a54cf34edd137c6288f4e56c6449f0753a986 (VT)",
        "08.30.24: Report ID: \t 6a27e451-df79-4f90-a022-9aa15cb58cea (Filescanio)"
      ],
      "public": 1,
      "adversary": "Norton Norton Lifelock Telus",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 50,
        "FileHash-SHA1": 54,
        "FileHash-SHA256": 831,
        "URL": 1120,
        "domain": 181,
        "hostname": 261
      },
      "indicator_count": 2497,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "609 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://dummyns.aliautoman.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://dummyns.aliautoman.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780293701.298387
}