{
  "type": "URL",
  "indicator": "https://firebase.google.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://firebase.google.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #1",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #3",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain google.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain google.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3633011638,
      "indicator": "https://firebase.google.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6893032410060f658d862c60",
          "name": "Hosting App - Partial research | Emotet Worm",
          "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:24:20.645000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "269 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68930449988277cd29c25cb7",
          "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
          "description": "",
          "modified": "2025-09-05T07:00:00.711000",
          "created": "2025-08-06T07:29:13.136000",
          "tags": [
            "url https",
            "iocs",
            "learn more",
            "ipv4",
            "domain",
            "hostname",
            "types of",
            "sweden",
            "united",
            "belgium",
            "indicator role",
            "title added",
            "active related",
            "pulses hostname",
            "showing",
            "document file",
            "v2 document",
            "search",
            "medium",
            "ms windows",
            "vista event",
            "port",
            "msie",
            "windows nt",
            "wow64",
            "dirty",
            "write",
            "powershell",
            "copy",
            "next",
            "defender",
            "dynamicloader",
            "high",
            "fwlink",
            "windows",
            "cmd c",
            "alerts",
            "bios",
            "related pulses",
            "pulses",
            "related tags",
            "file type",
            "ascii text",
            "sha256",
            "external",
            "virustotal api",
            "screenshots",
            "june",
            "flag",
            "usa windows",
            "input threat",
            "level analysis",
            "summary",
            "gbrflag",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "ssl certificate",
            "defense evasion",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "size",
            "mitre att",
            "date",
            "path",
            "format",
            "august",
            "hybrid",
            "local",
            "form",
            "click",
            "strings",
            "ubar",
            "truetype",
            "web open",
            "font format",
            "description web",
            "general",
            "iframe",
            "slcc2",
            "media center",
            "destination",
            "tlsv1",
            "unknown",
            "execution",
            "dock",
            "persistence",
            "malware",
            "encrypt",
            "ck techniques",
            "read c",
            "show",
            "entries",
            "delete",
            "data upload",
            "extraction",
            "onlv",
            "find",
            "type",
            "no matching",
            "indicator",
            "mtb may",
            "trojandropper",
            "passive dns",
            "next associated",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "ipv4 add",
            "trojan",
            "mtb apr",
            "files show",
            "date hash",
            "avast avg",
            "shellterlod may",
            "win32qqpass apr",
            "trojanspy",
            "ransom",
            "wiper",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results aug",
            "urls show",
            "hookwowlow may"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6893032410060f658d862c60",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4593,
            "hostname": 1754,
            "domain": 399,
            "FileHash-SHA256": 2128,
            "FileHash-MD5": 426,
            "FileHash-SHA1": 299,
            "SSLCertFingerprint": 17
          },
          "indicator_count": 9616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "269 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68396d9ae8b96e90ff1848d5",
          "name": "AcK-U // unenriched - 05.30.25",
          "description": "Just a quick check",
          "modified": "2025-07-23T20:11:01.749000",
          "created": "2025-05-30T08:34:34.215000",
          "tags": [
            "amazon02",
            "cloudflarenet",
            "amazonaes",
            "fastly",
            "github",
            "google",
            "facebook",
            "namecheapnet",
            "service",
            "cdck",
            "level3",
            "cloud",
            "com laude",
            "ltd dba",
            "namecheap inc",
            "gandi sas",
            "gmbh",
            "cloudflare",
            "namecheap",
            "registrarsafe",
            "ascio",
            "tucows",
            "spaceship",
            "please",
            "javascript",
            "iocs",
            "threat",
            "malware unread",
            "collection",
            "crowdsourced",
            "acku new",
            "share",
            "updated",
            "first ioc",
            "seen",
            "premium",
            "entity"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/e03439bc07bcb1908764755571e127ec051193d4cc24cf842ec3179557f533cb/iocs",
            "https://www.virustotal.com/graph/embed/g36d8fc13d786418ab1d0a75cc331f0eb5bca28d4a4fe4666a84f23e25fb6600b?theme=dark",
            "https://www.virustotal.com/gui/collection/e03439bc07bcb1908764755571e127ec051193d4cc24cf842ec3179557f533cb/summary",
            "https://report.netcraft.com/submission/iduhE4oNTsMOSAeOeBjzZdIfCLtefF3P - 07.23.25 - see notes on references*"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 91,
            "domain": 204,
            "hostname": 192,
            "URL": 731,
            "FileHash-SHA256": 27,
            "email": 1
          },
          "indicator_count": 1246,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "312 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63eabe6f6a9aaa48a17d66e0",
          "name": "Google Chrome",
          "description": "Google has released a version of its operating system that stops automatically checking for security updates and instead instead uses the 'cros' tool to automatically install them on to the Google Chrome operating systems, as well as the Android version.",
          "modified": "2023-03-16T00:12:03.978000",
          "created": "2023-02-13T22:49:19.557000",
          "tags": [
            "license",
            "copyright",
            "android open",
            "source project",
            "apache license",
            "version",
            "unless",
            "as is",
            "basis",
            "or conditions",
            "disables",
            "please",
            "google",
            "private key",
            "software",
            "work",
            "licensor",
            "a particular",
            "direct",
            "february",
            "generator",
            "david",
            "code",
            "bunny",
            "neither",
            "apache",
            "june",
            "uboot",
            "except",
            "bsd3clause",
            "bsd2clause",
            "library name",
            "link",
            "license name",
            "binaries",
            "qt websockets",
            "tink",
            "qt widgets",
            "unknown",
            "format",
            "branch",
            "any kind"
          ],
          "references": [
            "cros-garcon.conf",
            "source.properties",
            "LICENSE",
            "android-info.txt",
            "android-sdk-preview-license",
            "web.dev.har",
            "NOTICE.csv",
            "android-sdk-license",
            "NOTICE.txt",
            "Downloads.pem",
            "weston.ini",
            "package.xml",
            "mkfs.ext3",
            "mkfs.ext4",
            "mkfs.ext2"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Lillylillith39",
            "id": "221303",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 453,
            "hostname": 81,
            "FileHash-SHA256": 245,
            "domain": 62,
            "email": 7,
            "FileHash-SHA1": 3,
            "YARA": 1
          },
          "indicator_count": 852,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 32,
          "modified_text": "1173 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "NOTICE.txt",
        "LICENSE",
        "web.dev.har",
        "mkfs.ext4",
        "android-info.txt",
        "package.xml",
        "mkfs.ext2",
        "cros-garcon.conf",
        "source.properties",
        "NOTICE.csv",
        "https://www.virustotal.com/graph/embed/g36d8fc13d786418ab1d0a75cc331f0eb5bca28d4a4fe4666a84f23e25fb6600b?theme=dark",
        "android-sdk-license",
        "https://www.virustotal.com/gui/collection/e03439bc07bcb1908764755571e127ec051193d4cc24cf842ec3179557f533cb/summary",
        "Downloads.pem",
        "https://www.virustotal.com/gui/collection/e03439bc07bcb1908764755571e127ec051193d4cc24cf842ec3179557f533cb/iocs",
        "android-sdk-preview-license",
        "mkfs.ext3",
        "https://report.netcraft.com/submission/iduhE4oNTsMOSAeOeBjzZdIfCLtefF3P - 07.23.25 - see notes on references*",
        "weston.ini"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 12696
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/google.com",
    "whois": "http://whois.domaintools.com/google.com",
    "domain": "google.com",
    "hostname": "firebase.google.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6893032410060f658d862c60",
      "name": "Hosting App - Partial research | Emotet Worm",
      "description": "#firebase #google #dark_web_hosting #ransom #tracking #locate #monitored_targets #worm #emotet #malware #remoted_devices #trojan #reputation\n\n\u2022 Targets likely unaware.\n\n[m.pornsexer.xxx.3.1.adiosfil.roksit.net - reputation tool]",
      "modified": "2025-09-05T07:00:00.711000",
      "created": "2025-08-06T07:24:20.645000",
      "tags": [
        "url https",
        "iocs",
        "learn more",
        "ipv4",
        "domain",
        "hostname",
        "types of",
        "sweden",
        "united",
        "belgium",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "showing",
        "document file",
        "v2 document",
        "search",
        "medium",
        "ms windows",
        "vista event",
        "port",
        "msie",
        "windows nt",
        "wow64",
        "dirty",
        "write",
        "powershell",
        "copy",
        "next",
        "defender",
        "dynamicloader",
        "high",
        "fwlink",
        "windows",
        "cmd c",
        "alerts",
        "bios",
        "related pulses",
        "pulses",
        "related tags",
        "file type",
        "ascii text",
        "sha256",
        "external",
        "virustotal api",
        "screenshots",
        "june",
        "flag",
        "usa windows",
        "input threat",
        "level analysis",
        "summary",
        "gbrflag",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "ssl certificate",
        "defense evasion",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "mitre att",
        "date",
        "path",
        "format",
        "august",
        "hybrid",
        "local",
        "form",
        "click",
        "strings",
        "ubar",
        "truetype",
        "web open",
        "font format",
        "description web",
        "general",
        "iframe",
        "slcc2",
        "media center",
        "destination",
        "tlsv1",
        "unknown",
        "execution",
        "dock",
        "persistence",
        "malware",
        "encrypt",
        "ck techniques",
        "read c",
        "show",
        "entries",
        "delete",
        "data upload",
        "extraction",
        "onlv",
        "find",
        "type",
        "no matching",
        "indicator",
        "mtb may",
        "trojandropper",
        "passive dns",
        "next associated",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "ipv4 add",
        "trojan",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg",
        "shellterlod may",
        "win32qqpass apr",
        "trojanspy",
        "ransom",
        "wiper",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results aug",
        "urls show",
        "hookwowlow may"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4593,
        "hostname": 1754,
        "domain": 399,
        "FileHash-SHA256": 2128,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 299,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 9616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "269 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68930449988277cd29c25cb7",
      "name": "https://firebase.google.com/ - Ransom \u2022 Wiper\u2022 Trojan dropper",
      "description": "",
      "modified": "2025-09-05T07:00:00.711000",
      "created": "2025-08-06T07:29:13.136000",
      "tags": [
        "url https",
        "iocs",
        "learn more",
        "ipv4",
        "domain",
        "hostname",
        "types of",
        "sweden",
        "united",
        "belgium",
        "indicator role",
        "title added",
        "active related",
        "pulses hostname",
        "showing",
        "document file",
        "v2 document",
        "search",
        "medium",
        "ms windows",
        "vista event",
        "port",
        "msie",
        "windows nt",
        "wow64",
        "dirty",
        "write",
        "powershell",
        "copy",
        "next",
        "defender",
        "dynamicloader",
        "high",
        "fwlink",
        "windows",
        "cmd c",
        "alerts",
        "bios",
        "related pulses",
        "pulses",
        "related tags",
        "file type",
        "ascii text",
        "sha256",
        "external",
        "virustotal api",
        "screenshots",
        "june",
        "flag",
        "usa windows",
        "input threat",
        "level analysis",
        "summary",
        "gbrflag",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "ssl certificate",
        "defense evasion",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "size",
        "mitre att",
        "date",
        "path",
        "format",
        "august",
        "hybrid",
        "local",
        "form",
        "click",
        "strings",
        "ubar",
        "truetype",
        "web open",
        "font format",
        "description web",
        "general",
        "iframe",
        "slcc2",
        "media center",
        "destination",
        "tlsv1",
        "unknown",
        "execution",
        "dock",
        "persistence",
        "malware",
        "encrypt",
        "ck techniques",
        "read c",
        "show",
        "entries",
        "delete",
        "data upload",
        "extraction",
        "onlv",
        "find",
        "type",
        "no matching",
        "indicator",
        "mtb may",
        "trojandropper",
        "passive dns",
        "next associated",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "ipv4 add",
        "trojan",
        "mtb apr",
        "files show",
        "date hash",
        "avast avg",
        "shellterlod may",
        "win32qqpass apr",
        "trojanspy",
        "ransom",
        "wiper",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results aug",
        "urls show",
        "hookwowlow may"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6893032410060f658d862c60",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4593,
        "hostname": 1754,
        "domain": 399,
        "FileHash-SHA256": 2128,
        "FileHash-MD5": 426,
        "FileHash-SHA1": 299,
        "SSLCertFingerprint": 17
      },
      "indicator_count": 9616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "269 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68396d9ae8b96e90ff1848d5",
      "name": "AcK-U // unenriched - 05.30.25",
      "description": "Just a quick check",
      "modified": "2025-07-23T20:11:01.749000",
      "created": "2025-05-30T08:34:34.215000",
      "tags": [
        "amazon02",
        "cloudflarenet",
        "amazonaes",
        "fastly",
        "github",
        "google",
        "facebook",
        "namecheapnet",
        "service",
        "cdck",
        "level3",
        "cloud",
        "com laude",
        "ltd dba",
        "namecheap inc",
        "gandi sas",
        "gmbh",
        "cloudflare",
        "namecheap",
        "registrarsafe",
        "ascio",
        "tucows",
        "spaceship",
        "please",
        "javascript",
        "iocs",
        "threat",
        "malware unread",
        "collection",
        "crowdsourced",
        "acku new",
        "share",
        "updated",
        "first ioc",
        "seen",
        "premium",
        "entity"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/e03439bc07bcb1908764755571e127ec051193d4cc24cf842ec3179557f533cb/iocs",
        "https://www.virustotal.com/graph/embed/g36d8fc13d786418ab1d0a75cc331f0eb5bca28d4a4fe4666a84f23e25fb6600b?theme=dark",
        "https://www.virustotal.com/gui/collection/e03439bc07bcb1908764755571e127ec051193d4cc24cf842ec3179557f533cb/summary",
        "https://report.netcraft.com/submission/iduhE4oNTsMOSAeOeBjzZdIfCLtefF3P - 07.23.25 - see notes on references*"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 91,
        "domain": 204,
        "hostname": 192,
        "URL": 731,
        "FileHash-SHA256": 27,
        "email": 1
      },
      "indicator_count": 1246,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "312 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "63eabe6f6a9aaa48a17d66e0",
      "name": "Google Chrome",
      "description": "Google has released a version of its operating system that stops automatically checking for security updates and instead instead uses the 'cros' tool to automatically install them on to the Google Chrome operating systems, as well as the Android version.",
      "modified": "2023-03-16T00:12:03.978000",
      "created": "2023-02-13T22:49:19.557000",
      "tags": [
        "license",
        "copyright",
        "android open",
        "source project",
        "apache license",
        "version",
        "unless",
        "as is",
        "basis",
        "or conditions",
        "disables",
        "please",
        "google",
        "private key",
        "software",
        "work",
        "licensor",
        "a particular",
        "direct",
        "february",
        "generator",
        "david",
        "code",
        "bunny",
        "neither",
        "apache",
        "june",
        "uboot",
        "except",
        "bsd3clause",
        "bsd2clause",
        "library name",
        "link",
        "license name",
        "binaries",
        "qt websockets",
        "tink",
        "qt widgets",
        "unknown",
        "format",
        "branch",
        "any kind"
      ],
      "references": [
        "cros-garcon.conf",
        "source.properties",
        "LICENSE",
        "android-info.txt",
        "android-sdk-preview-license",
        "web.dev.har",
        "NOTICE.csv",
        "android-sdk-license",
        "NOTICE.txt",
        "Downloads.pem",
        "weston.ini",
        "package.xml",
        "mkfs.ext3",
        "mkfs.ext4",
        "mkfs.ext2"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Lillylillith39",
        "id": "221303",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 453,
        "hostname": 81,
        "FileHash-SHA256": 245,
        "domain": 62,
        "email": 7,
        "FileHash-SHA1": 3,
        "YARA": 1
      },
      "indicator_count": 852,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 32,
      "modified_text": "1173 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://firebase.google.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://firebase.google.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780309033.4988678
}