{
  "type": "URL",
  "indicator": "https://en.chessmatec.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://en.chessmatec.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4113487228,
      "indicator": "https://en.chessmatec.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68923ea4efbf58b7ba48acec",
          "name": "Hosted App",
          "description": "",
          "modified": "2025-09-04T16:03:17.037000",
          "created": "2025-08-05T17:25:56.454000",
          "tags": [
            "issuer wr3",
            "log id",
            "gmtn",
            "abn timestamp",
            "ad180b80",
            "full name",
            "extensionsstr",
            "web server",
            "ca issuers",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "mitre att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "ascii text",
            "pattern match",
            "show technique",
            "date",
            "format",
            "august",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "flag",
            "usa windows",
            "hwp support",
            "march",
            "december",
            "united",
            "markmonitor",
            "overview dns",
            "requests domain",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "t1179 hooking",
            "access windows",
            "installs",
            "control att",
            "found",
            "development att",
            "name server",
            "show process",
            "programfiles",
            "command decode",
            "suricata ipv4",
            "ck matrix",
            "comspec",
            "model",
            "general",
            "dynamicloader",
            "unknown",
            "as16509",
            "whitelisted",
            "medium",
            "write c",
            "as15169",
            "search",
            "high",
            "write",
            "android",
            "malware",
            "copy",
            "next",
            "formbook cnc",
            "checkin",
            "entries",
            "passive dns",
            "next associated",
            "site",
            "neue",
            "ipv4",
            "pulse pulses",
            "exploit",
            "trojan",
            "virtool",
            "body",
            "refer",
            "present dec",
            "epub",
            "present jan",
            "present nov",
            "present oct",
            "showing",
            "urls show",
            "win32",
            "win64",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "prefetch8",
            "localappdata",
            "prefetch1"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3409,
            "hostname": 4127,
            "URL": 8408,
            "SSLCertFingerprint": 9,
            "FileHash-SHA256": 1175,
            "FileHash-MD5": 144,
            "FileHash-SHA1": 134,
            "CVE": 2
          },
          "indicator_count": 17408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6891bf5f58c1ae303f6d313e",
          "name": "Jeeng | Powerbox | Tracking | Mirai \u2022 Palantir plugin",
          "description": "#ELF:Mirai-ALC\\ [Trj]\n* [https://d1-myadmin.dpdlocal.co.uk/login]\n\u2022 [cf20ed53-cb6d-4dfd-a4e8-794fbe163efc.pcap]\nAlfper:BrowserModifier:Win32/DeepSync.C\n#prometheus #trojan #malware #elf #mirai dpd #palantir # plugin #tracking #monitoring #call #tracker #spyware #worm #virus #election_ news",
          "modified": "2025-09-04T08:05:56.240000",
          "created": "2025-08-05T08:22:55.113000",
          "tags": [
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "iocs",
            "learn more",
            "filehashsha256",
            "types",
            "indicators show",
            "search",
            "present jul",
            "present jun",
            "present may",
            "present aug",
            "present apr",
            "present mar",
            "present feb",
            "united",
            "unknown aaaa",
            "all ipv4",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "location united",
            "america flag",
            "america asn",
            "open",
            "registrar",
            "limited ta",
            "com laude",
            "nomiq",
            "creation date",
            "ip address",
            "date",
            "domain",
            "hostname",
            "files ip",
            "address",
            "asn as21342",
            "scan",
            "ipv4",
            "pulses",
            "servers",
            "hostname add",
            "pulse submit",
            "url analysis",
            "verdict",
            "france unknown",
            "name servers",
            "present",
            "whois show",
            "record value",
            "domain name",
            "expiration date",
            "status",
            "domain add",
            "filehashmd5",
            "idhttp",
            "tidcustomhttp",
            "classes",
            "medium",
            "crlf line",
            "show",
            "registry",
            "service",
            "copy",
            "patch",
            "write",
            "next",
            "markus",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "http",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "refresh57959",
            "windows xp",
            "pack",
            "shows",
            "cc08",
            "f06a6b",
            "pulses hostname",
            "germany unknown",
            "aaaa",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "ascii text",
            "pattern match",
            "mitre att",
            "show technique",
            "format",
            "august",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "filehashsha1",
            "palantir feb",
            "difference feb"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3809,
            "hostname": 1197,
            "domain": 456,
            "FileHash-MD5": 170,
            "FileHash-SHA256": 579,
            "FileHash-SHA1": 161,
            "CVE": 1,
            "email": 1,
            "SSLCertFingerprint": 6
          },
          "indicator_count": 6380,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68919fdceabd582b8502932b",
          "name": "Reviewable.io w/ Palantir plugin - Malicious IoC\u2019s",
          "description": "",
          "modified": "2025-09-04T05:03:13.563000",
          "created": "2025-08-05T06:08:28.757000",
          "tags": [
            "united",
            "formbook cnc",
            "checkin",
            "entries",
            "passive dns",
            "next associated",
            "neue",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "exploit",
            "trojan",
            "virtool",
            "body",
            "files",
            "ip address",
            "location united",
            "asn as54113",
            "less whois",
            "registrar",
            "gandi sas",
            "creation date",
            "pulses",
            "present aug",
            "unknown ns",
            "search",
            "showing",
            "record value",
            "domain id",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "win64",
            "certificate",
            "error",
            "present showing",
            "next http",
            "scans show",
            "france unknown",
            "name servers",
            "date",
            "hostname",
            "pulse submit",
            "url analysis",
            "dynamicloader",
            "show",
            "vwu codeoverlap",
            "yara detections",
            "medium",
            "delete",
            "default",
            "copy",
            "write",
            "dupzom",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 366,
            "domain": 161,
            "hostname": 253,
            "FileHash-MD5": 204,
            "FileHash-SHA1": 201,
            "FileHash-SHA256": 328,
            "CVE": 2
          },
          "indicator_count": 1515,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 23735
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/chessmatec.com",
    "whois": "http://whois.domaintools.com/chessmatec.com",
    "domain": "chessmatec.com",
    "hostname": "en.chessmatec.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68923ea4efbf58b7ba48acec",
      "name": "Hosted App",
      "description": "",
      "modified": "2025-09-04T16:03:17.037000",
      "created": "2025-08-05T17:25:56.454000",
      "tags": [
        "issuer wr3",
        "log id",
        "gmtn",
        "abn timestamp",
        "ad180b80",
        "full name",
        "extensionsstr",
        "web server",
        "ca issuers",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "mitre att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "ascii text",
        "pattern match",
        "show technique",
        "date",
        "format",
        "august",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "flag",
        "usa windows",
        "hwp support",
        "march",
        "december",
        "united",
        "markmonitor",
        "overview dns",
        "requests domain",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "t1179 hooking",
        "access windows",
        "installs",
        "control att",
        "found",
        "development att",
        "name server",
        "show process",
        "programfiles",
        "command decode",
        "suricata ipv4",
        "ck matrix",
        "comspec",
        "model",
        "general",
        "dynamicloader",
        "unknown",
        "as16509",
        "whitelisted",
        "medium",
        "write c",
        "as15169",
        "search",
        "high",
        "write",
        "android",
        "malware",
        "copy",
        "next",
        "formbook cnc",
        "checkin",
        "entries",
        "passive dns",
        "next associated",
        "site",
        "neue",
        "ipv4",
        "pulse pulses",
        "exploit",
        "trojan",
        "virtool",
        "body",
        "refer",
        "present dec",
        "epub",
        "present jan",
        "present nov",
        "present oct",
        "showing",
        "urls show",
        "win32",
        "win64",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "prefetch8",
        "localappdata",
        "prefetch1"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3409,
        "hostname": 4127,
        "URL": 8408,
        "SSLCertFingerprint": 9,
        "FileHash-SHA256": 1175,
        "FileHash-MD5": 144,
        "FileHash-SHA1": 134,
        "CVE": 2
      },
      "indicator_count": 17408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6891bf5f58c1ae303f6d313e",
      "name": "Jeeng | Powerbox | Tracking | Mirai \u2022 Palantir plugin",
      "description": "#ELF:Mirai-ALC\\ [Trj]\n* [https://d1-myadmin.dpdlocal.co.uk/login]\n\u2022 [cf20ed53-cb6d-4dfd-a4e8-794fbe163efc.pcap]\nAlfper:BrowserModifier:Win32/DeepSync.C\n#prometheus #trojan #malware #elf #mirai dpd #palantir # plugin #tracking #monitoring #call #tracker #spyware #worm #virus #election_ news",
      "modified": "2025-09-04T08:05:56.240000",
      "created": "2025-08-05T08:22:55.113000",
      "tags": [
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "entries",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "iocs",
        "learn more",
        "filehashsha256",
        "types",
        "indicators show",
        "search",
        "present jul",
        "present jun",
        "present may",
        "present aug",
        "present apr",
        "present mar",
        "present feb",
        "united",
        "unknown aaaa",
        "all ipv4",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "location united",
        "america flag",
        "america asn",
        "open",
        "registrar",
        "limited ta",
        "com laude",
        "nomiq",
        "creation date",
        "ip address",
        "date",
        "domain",
        "hostname",
        "files ip",
        "address",
        "asn as21342",
        "scan",
        "ipv4",
        "pulses",
        "servers",
        "hostname add",
        "pulse submit",
        "url analysis",
        "verdict",
        "france unknown",
        "name servers",
        "present",
        "whois show",
        "record value",
        "domain name",
        "expiration date",
        "status",
        "domain add",
        "filehashmd5",
        "idhttp",
        "tidcustomhttp",
        "classes",
        "medium",
        "crlf line",
        "show",
        "registry",
        "service",
        "copy",
        "patch",
        "write",
        "next",
        "markus",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "http",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "refresh57959",
        "windows xp",
        "pack",
        "shows",
        "cc08",
        "f06a6b",
        "pulses hostname",
        "germany unknown",
        "aaaa",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "ascii text",
        "pattern match",
        "mitre att",
        "show technique",
        "format",
        "august",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "filehashsha1",
        "palantir feb",
        "difference feb"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3809,
        "hostname": 1197,
        "domain": 456,
        "FileHash-MD5": 170,
        "FileHash-SHA256": 579,
        "FileHash-SHA1": 161,
        "CVE": 1,
        "email": 1,
        "SSLCertFingerprint": 6
      },
      "indicator_count": 6380,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68919fdceabd582b8502932b",
      "name": "Reviewable.io w/ Palantir plugin - Malicious IoC\u2019s",
      "description": "",
      "modified": "2025-09-04T05:03:13.563000",
      "created": "2025-08-05T06:08:28.757000",
      "tags": [
        "united",
        "formbook cnc",
        "checkin",
        "entries",
        "passive dns",
        "next associated",
        "neue",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "exploit",
        "trojan",
        "virtool",
        "body",
        "files",
        "ip address",
        "location united",
        "asn as54113",
        "less whois",
        "registrar",
        "gandi sas",
        "creation date",
        "pulses",
        "present aug",
        "unknown ns",
        "search",
        "showing",
        "record value",
        "domain id",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "win64",
        "certificate",
        "error",
        "present showing",
        "next http",
        "scans show",
        "france unknown",
        "name servers",
        "date",
        "hostname",
        "pulse submit",
        "url analysis",
        "dynamicloader",
        "show",
        "vwu codeoverlap",
        "yara detections",
        "medium",
        "delete",
        "default",
        "copy",
        "write",
        "dupzom",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 366,
        "domain": 161,
        "hostname": 253,
        "FileHash-MD5": 204,
        "FileHash-SHA1": 201,
        "FileHash-SHA256": 328,
        "CVE": 2
      },
      "indicator_count": 1515,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://en.chessmatec.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://en.chessmatec.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776645619.0405896
}