{
  "type": "URL",
  "indicator": "https://fms.deltax.cloud/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://fms.deltax.cloud/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4097957526,
      "indicator": "https://fms.deltax.cloud/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "687d30048b95aaba628a5ee7",
          "name": "Working on it\u2026\u2026",
          "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
          "modified": "2025-08-19T17:00:59.379000",
          "created": "2025-07-20T18:05:56.587000",
          "tags": [
            "dynamicloader",
            "united",
            "as15169",
            "medium",
            "search",
            "show",
            "write c",
            "whitelisted",
            "brazil as396982",
            "high",
            "themida",
            "write",
            "delphi",
            "copy",
            "upatre",
            "encrypt",
            "june",
            "win32",
            "malware",
            "win64",
            "windows nt",
            "directui",
            "element",
            "classinfobase",
            "value",
            "hwndhost",
            "sapeav12",
            "delete c",
            "worm",
            "explorer",
            "insert",
            "movie",
            "alerts",
            "windows",
            "installs",
            "filehash",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "passive dns",
            "urls",
            "http",
            "ip address",
            "related nids",
            "files location",
            "spain flag",
            "spain domain",
            "files related",
            "spain",
            "entries",
            "next associated",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "gmt content",
            "filehashsha256",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "filehashmd5",
            "showing",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "iocs",
            "learn more",
            "filehashsha1",
            "types of",
            "united kingdom",
            "t1053",
            "taskjob",
            "t1055",
            "injection",
            "t1082",
            "t1119",
            "t1129",
            "modules",
            "t1143",
            "soundcloud",
            "created",
            "hour ago",
            "facebook",
            "twitter",
            "victims website",
            "youtube",
            "jansky",
            "trojandropper",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2012,
            "FileHash-MD5": 140,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1348,
            "SSLCertFingerprint": 3,
            "domain": 288,
            "hostname": 812
          },
          "indicator_count": 4732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d18d829739be014393c59",
          "name": "SoundCloud - Hear the world\u2019s sounds",
          "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
          "modified": "2025-08-19T14:03:11.976000",
          "created": "2025-07-20T16:27:04.872000",
          "tags": [
            "read c",
            "search",
            "medium",
            "entries",
            "show",
            "unicode",
            "tls handshake",
            "memcommit",
            "delete",
            "crlf line",
            "next",
            "dock",
            "write",
            "execution",
            "malware",
            "copy",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "showing",
            "urls",
            "passive dns",
            "http",
            "unique",
            "l add",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "united",
            "code",
            "present jul",
            "present showing",
            "title error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next associated",
            "files show",
            "win32",
            "date",
            "urls show",
            "error",
            "creation date",
            "name servers",
            "value emails",
            "name eric",
            "wahlforss name",
            "org soundcloud",
            "city berlin",
            "country de",
            "dnssec unsigned",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as16509",
            "less",
            "results nov",
            "associated urls",
            "results jan",
            "present feb",
            "related tags",
            "none indicator",
            "facts domain",
            "present",
            "akamai external",
            "resources whois",
            "urlvoid",
            "related",
            "png image",
            "rgba",
            "alfper",
            "ipv4 add",
            "trojandropper",
            "present may",
            "present jun",
            "cname",
            "emails",
            "status",
            "servers",
            "less whois",
            "body",
            "fastly error",
            "please",
            "sea p",
            "america flag",
            "america asn",
            "trojan",
            "accept",
            "url add",
            "ip related",
            "pulses none",
            "cdhc",
            "oxq xr8w1",
            "fv5hc9a2l",
            "s showing",
            "next related",
            "domains domain",
            "script urls",
            "present sep",
            "cookie",
            "hostname add"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6020,
            "hostname": 1865,
            "FileHash-SHA256": 676,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 86,
            "domain": 990,
            "email": 5
          },
          "indicator_count": 9748,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d18de7177474b759ab2b7",
          "name": "SoundCloud - Hear the world\u2019s sounds",
          "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
          "modified": "2025-08-19T14:03:11.976000",
          "created": "2025-07-20T16:27:10.608000",
          "tags": [
            "read c",
            "search",
            "medium",
            "entries",
            "show",
            "unicode",
            "tls handshake",
            "memcommit",
            "delete",
            "crlf line",
            "next",
            "dock",
            "write",
            "execution",
            "malware",
            "copy",
            "no expiration",
            "filehashmd5",
            "filehashsha256",
            "showing",
            "urls",
            "passive dns",
            "http",
            "unique",
            "l add",
            "pulse pulses",
            "ip address",
            "related nids",
            "files location",
            "united",
            "code",
            "present jul",
            "present showing",
            "title error",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next associated",
            "files show",
            "win32",
            "date",
            "urls show",
            "error",
            "creation date",
            "name servers",
            "value emails",
            "name eric",
            "wahlforss name",
            "org soundcloud",
            "city berlin",
            "country de",
            "dnssec unsigned",
            "files",
            "verdict",
            "domain",
            "files ip",
            "address",
            "location united",
            "asn as16509",
            "less",
            "results nov",
            "associated urls",
            "results jan",
            "present feb",
            "related tags",
            "none indicator",
            "facts domain",
            "present",
            "akamai external",
            "resources whois",
            "urlvoid",
            "related",
            "png image",
            "rgba",
            "alfper",
            "ipv4 add",
            "trojandropper",
            "present may",
            "present jun",
            "cname",
            "emails",
            "status",
            "servers",
            "less whois",
            "body",
            "fastly error",
            "please",
            "sea p",
            "america flag",
            "america asn",
            "trojan",
            "accept",
            "url add",
            "ip related",
            "pulses none",
            "cdhc",
            "oxq xr8w1",
            "fv5hc9a2l",
            "s showing",
            "next related",
            "domains domain",
            "script urls",
            "present sep",
            "cookie",
            "hostname add"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6020,
            "hostname": 1865,
            "FileHash-SHA256": 676,
            "FileHash-MD5": 106,
            "FileHash-SHA1": 86,
            "domain": 990,
            "email": 5
          },
          "indicator_count": 9748,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 13518
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/deltax.cloud",
    "whois": "http://whois.domaintools.com/deltax.cloud",
    "domain": "deltax.cloud",
    "hostname": "fms.deltax.cloud"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "687d30048b95aaba628a5ee7",
      "name": "Working on it\u2026\u2026",
      "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
      "modified": "2025-08-19T17:00:59.379000",
      "created": "2025-07-20T18:05:56.587000",
      "tags": [
        "dynamicloader",
        "united",
        "as15169",
        "medium",
        "search",
        "show",
        "write c",
        "whitelisted",
        "brazil as396982",
        "high",
        "themida",
        "write",
        "delphi",
        "copy",
        "upatre",
        "encrypt",
        "june",
        "win32",
        "malware",
        "win64",
        "windows nt",
        "directui",
        "element",
        "classinfobase",
        "value",
        "hwndhost",
        "sapeav12",
        "delete c",
        "worm",
        "explorer",
        "insert",
        "movie",
        "alerts",
        "windows",
        "installs",
        "filehash",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "passive dns",
        "urls",
        "http",
        "ip address",
        "related nids",
        "files location",
        "spain flag",
        "spain domain",
        "files related",
        "spain",
        "entries",
        "next associated",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "gmt content",
        "filehashsha256",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "filehashmd5",
        "showing",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "iocs",
        "learn more",
        "filehashsha1",
        "types of",
        "united kingdom",
        "t1053",
        "taskjob",
        "t1055",
        "injection",
        "t1082",
        "t1119",
        "t1129",
        "modules",
        "t1143",
        "soundcloud",
        "created",
        "hour ago",
        "facebook",
        "twitter",
        "victims website",
        "youtube",
        "jansky",
        "trojandropper",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2012,
        "FileHash-MD5": 140,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1348,
        "SSLCertFingerprint": 3,
        "domain": 288,
        "hostname": 812
      },
      "indicator_count": 4732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d18d829739be014393c59",
      "name": "SoundCloud - Hear the world\u2019s sounds",
      "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
      "modified": "2025-08-19T14:03:11.976000",
      "created": "2025-07-20T16:27:04.872000",
      "tags": [
        "read c",
        "search",
        "medium",
        "entries",
        "show",
        "unicode",
        "tls handshake",
        "memcommit",
        "delete",
        "crlf line",
        "next",
        "dock",
        "write",
        "execution",
        "malware",
        "copy",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "showing",
        "urls",
        "passive dns",
        "http",
        "unique",
        "l add",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "united",
        "code",
        "present jul",
        "present showing",
        "title error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next associated",
        "files show",
        "win32",
        "date",
        "urls show",
        "error",
        "creation date",
        "name servers",
        "value emails",
        "name eric",
        "wahlforss name",
        "org soundcloud",
        "city berlin",
        "country de",
        "dnssec unsigned",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as16509",
        "less",
        "results nov",
        "associated urls",
        "results jan",
        "present feb",
        "related tags",
        "none indicator",
        "facts domain",
        "present",
        "akamai external",
        "resources whois",
        "urlvoid",
        "related",
        "png image",
        "rgba",
        "alfper",
        "ipv4 add",
        "trojandropper",
        "present may",
        "present jun",
        "cname",
        "emails",
        "status",
        "servers",
        "less whois",
        "body",
        "fastly error",
        "please",
        "sea p",
        "america flag",
        "america asn",
        "trojan",
        "accept",
        "url add",
        "ip related",
        "pulses none",
        "cdhc",
        "oxq xr8w1",
        "fv5hc9a2l",
        "s showing",
        "next related",
        "domains domain",
        "script urls",
        "present sep",
        "cookie",
        "hostname add"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6020,
        "hostname": 1865,
        "FileHash-SHA256": 676,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 86,
        "domain": 990,
        "email": 5
      },
      "indicator_count": 9748,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d18de7177474b759ab2b7",
      "name": "SoundCloud - Hear the world\u2019s sounds",
      "description": "Social engineering included lots of contact via Facebook, Twitter, SoundCloud, Victims website, iCloud.. iCloud was erased and the hacker left the man \u2018deadmau5\u2018 .  deadmau5 was used threatening posts emails and whoever they are sent photos and became overly interested in victims music. 1st to report music was not showing up on YouTube. Statements show victim had millions of views redirected. Hackers would often thank artistss for another million views. Songs pirated. Jansky on SoundCloud contacted victims daughter often, sent a photo and said he was from Great Britain. \n\u2022 ALFPER:PUA:Win32/InstallCore\n\u2022 TrojanDropper:Win32/VB.IL\n\u2022 Win.Trojan.Agent-\n|| blog.jpcert.or.jp \n\n\u2022 Registrant Org: Japan Computer Emergency Response Team Coordination Center\n\nI feel like this is very dangerous. These people are in Colorado no matter where they say they are.",
      "modified": "2025-08-19T14:03:11.976000",
      "created": "2025-07-20T16:27:10.608000",
      "tags": [
        "read c",
        "search",
        "medium",
        "entries",
        "show",
        "unicode",
        "tls handshake",
        "memcommit",
        "delete",
        "crlf line",
        "next",
        "dock",
        "write",
        "execution",
        "malware",
        "copy",
        "no expiration",
        "filehashmd5",
        "filehashsha256",
        "showing",
        "urls",
        "passive dns",
        "http",
        "unique",
        "l add",
        "pulse pulses",
        "ip address",
        "related nids",
        "files location",
        "united",
        "code",
        "present jul",
        "present showing",
        "title error",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next associated",
        "files show",
        "win32",
        "date",
        "urls show",
        "error",
        "creation date",
        "name servers",
        "value emails",
        "name eric",
        "wahlforss name",
        "org soundcloud",
        "city berlin",
        "country de",
        "dnssec unsigned",
        "files",
        "verdict",
        "domain",
        "files ip",
        "address",
        "location united",
        "asn as16509",
        "less",
        "results nov",
        "associated urls",
        "results jan",
        "present feb",
        "related tags",
        "none indicator",
        "facts domain",
        "present",
        "akamai external",
        "resources whois",
        "urlvoid",
        "related",
        "png image",
        "rgba",
        "alfper",
        "ipv4 add",
        "trojandropper",
        "present may",
        "present jun",
        "cname",
        "emails",
        "status",
        "servers",
        "less whois",
        "body",
        "fastly error",
        "please",
        "sea p",
        "america flag",
        "america asn",
        "trojan",
        "accept",
        "url add",
        "ip related",
        "pulses none",
        "cdhc",
        "oxq xr8w1",
        "fv5hc9a2l",
        "s showing",
        "next related",
        "domains domain",
        "script urls",
        "present sep",
        "cookie",
        "hostname add"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6020,
        "hostname": 1865,
        "FileHash-SHA256": 676,
        "FileHash-MD5": 106,
        "FileHash-SHA1": 86,
        "domain": 990,
        "email": 5
      },
      "indicator_count": 9748,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://fms.deltax.cloud/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://fms.deltax.cloud/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641596.2515912
}