{
  "type": "URL",
  "indicator": "https://initium-gmbh.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://initium-gmbh.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3251308436,
      "indicator": "https://initium-gmbh.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "688e401a6f5537232c6fc6ca",
          "name": "Different view of iWin",
          "description": "Residuals and different view of Pulse [https://otx.alienvault.com/pulse/688e31b80edd775fe5d2f34f] Does OTX Pulse:\nMitre: T1055.015 ListPlanting Defense Evasion Privilege Escalation Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.\n\nTarget & Cousin scammed?",
          "modified": "2025-09-01T16:02:12.221000",
          "created": "2025-08-02T16:43:06.981000",
          "tags": [
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "ascii text",
            "date",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "body",
            "layer network",
            "as46606",
            "us note",
            "route",
            "ptr record",
            "windows nt",
            "apache",
            "span",
            "pragma",
            "meta",
            "footer",
            "google",
            "us seen",
            "general info",
            "geo united",
            "as15169",
            "t1045",
            "packing",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1119",
            "t1057",
            "discovery",
            "t1071",
            "showing",
            "entries",
            "present jul",
            "error jul",
            "present showing",
            "next http",
            "scans record",
            "value",
            "body html",
            "head title",
            "title head",
            "accept",
            "ip address",
            "location united",
            "asn as46606",
            "whois registrar",
            "creation date",
            "pulses",
            "related tags",
            "indicator",
            "response ip",
            "address google",
            "safe browsing",
            "title",
            "head",
            "search",
            "passive dns",
            "urls",
            "record value",
            "emails",
            "error",
            "meta http",
            "content",
            "gmt server",
            "content type",
            "script urls",
            "script script",
            "service",
            "code",
            "filehashmd5",
            "filehashsha1",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "ipv4",
            "url http",
            "indicator role",
            "title added",
            "active related",
            "pulses ipv4",
            "ccus asnas15169",
            "role"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 145,
            "FileHash-SHA1": 149,
            "FileHash-SHA256": 494,
            "SSLCertFingerprint": 3,
            "URL": 319,
            "domain": 63,
            "hostname": 228,
            "CIDR": 3,
            "email": 4
          },
          "indicator_count": 1408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688e31b80edd775fe5d2f34f",
          "name": "Social Engineering led to -#Lowfi:HSTR:Win32/iWin.B",
          "description": "Likely: Phone referral led to an in person meeting, financial transaction, telephone numbers exchange, website click, in home service call. The alternative is compromised target was redirected to malicious host or service provider became compromised by targeted persons issue.\nThere are several targeted people. This person is closely associated with a target.(idk -malicious)\nMitre: T1055.015\tListPlanting\t\nDefense Evasion\nPrivilege Escalation\nAdversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.",
          "modified": "2025-09-01T15:02:58.791000",
          "created": "2025-08-02T15:41:44.319000",
          "tags": [
            "united",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "gmt server",
            "gmt content",
            "certificate",
            "apache",
            "encrypt",
            "gmt path",
            "set cookie",
            "httponly",
            "passive dns",
            "urls",
            "address",
            "meta",
            "dynamicloader",
            "write c",
            "medium",
            "tlsv1",
            "show",
            "entries",
            "high",
            "http",
            "copy",
            "upatre",
            "write",
            "unknown",
            "asn15169",
            "google",
            "asn46606",
            "unifiedlayeras1",
            "frankfurt",
            "main",
            "germany",
            "google safe",
            "browsing",
            "script urls",
            "a domains",
            "libs",
            "monstroid2",
            "link",
            "accept encoding",
            "script domains",
            "title",
            "vary",
            "jquery",
            "pulse pulses",
            "hostname xn",
            "files domain",
            "showing",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "present jul",
            "for privacy",
            "roboto",
            "delete",
            "trojan",
            "globalc",
            "mozilla",
            "guard",
            "malware",
            "iwin",
            "local",
            "lowfi",
            "helper",
            "nsisdl",
            "executable",
            "amazon s3",
            "pe exe",
            "dll windows",
            "http yara",
            "alerts",
            "meta http",
            "content",
            "pragma",
            "content type",
            "body",
            "service",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "windows nt",
            "mitre att",
            "ascii text",
            "show technique",
            "path",
            "span",
            "click",
            "august",
            "hybrid",
            "general",
            "strings",
            "footer",
            "ck matrix"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 460,
            "hostname": 744,
            "URL": 3496,
            "email": 4,
            "domain": 394,
            "FileHash-SHA256": 2072,
            "FileHash-MD5": 464,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 7641,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546cf78627adef6562a97aa",
          "name": "Browser Malware Attack",
          "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:10:48.676000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "866 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6546d0120a7e479fecffe2b1",
          "name": "Browser Malware Attack",
          "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
          "modified": "2023-12-04T22:00:43.514000",
          "created": "2023-11-04T23:13:21.883000",
          "tags": [
            "united",
            "facebook",
            "phishtank",
            "detection list",
            "ip address",
            "blacklist",
            "paypal",
            "cisco umbrella",
            "site",
            "alexa top",
            "safe site",
            "million",
            "malicious url",
            "malware site",
            "malicious site",
            "malware",
            "name verdict",
            "falcon sandbox",
            "reports no",
            "speci",
            "efr1",
            "pattern match",
            "file",
            "web open",
            "font format",
            "truetype",
            "indicator",
            "windows nt",
            "et tor",
            "known tor",
            "relayrouter",
            "date",
            "unknown",
            "general",
            "hybrid",
            "local",
            "stream",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "self",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "phishing site",
            "heur",
            "cyber threat",
            "unsafe",
            "riskware",
            "phishing",
            "bank",
            "service",
            "artemis",
            "team",
            "xtrat",
            "agent",
            "xrat",
            "filetour",
            "exploit",
            "conduit",
            "opencandy",
            "fusioncore",
            "orkut",
            "steam",
            "genkryptik",
            "runescape",
            "presenoker",
            "ramnit",
            "msil",
            "crack",
            "tofsee",
            "suppobox",
            "malicious",
            "simda",
            "vawtrak",
            "hotmail",
            "generic",
            "webtoolbar",
            "hsbc",
            "maltiverse",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "count blacklist",
            "tag count",
            "downldr",
            "cleaner",
            "iframe",
            "wacatac",
            "alexa",
            "win64",
            "swrort",
            "installcore",
            "azorult",
            "download",
            "blacknet rat",
            "stealer",
            "softcnapp",
            "nircmd",
            "unruy",
            "patcher",
            "adload",
            "dropper",
            "installpack",
            "tiggre",
            "gamehack",
            "trojanspy",
            "germany http",
            "attacker",
            "static engine",
            "internet storm",
            "center",
            "passive dns",
            "urls",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "url http",
            "pulse pulses",
            "http",
            "related nids"
          ],
          "references": [
            "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
            "object.prototype.hasownproperty.call",
            "hasownproperty.call",
            "a.default.meta.applestore.id",
            "applestore.id",
            "http://decafsmob.this.id",
            "id.google.com",
            "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
            "http://git.io/yBU2rg",
            "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
            "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
            "http://tracking.3061331.corn10wuk.club",
            "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
            "apps.apple.com/us/app/id$",
            "t.name",
            "http://e.id?e.id:e.id.getAttribute",
            "location.search",
            "https://dnsorangetel.dn2.n-helix.com",
            "1080p-torrent.ml",
            "states.app",
            "dev-2.ernestatech.com",
            "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
            "209.85.145.113 [malware]",
            "cdn.fuckporntube.com",
            "www.search.app.goo.gl",
            "apps.apple.com",
            "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
            "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
            "globalworker1.sol.us",
            "worker-m-tlcus1.sol.us"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany",
            "Ireland",
            "Singapore"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 33,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1015,
            "hostname": 1309,
            "FileHash-MD5": 466,
            "FileHash-SHA1": 255,
            "FileHash-SHA256": 3783,
            "URL": 4001,
            "CVE": 9,
            "email": 3
          },
          "indicator_count": 10841,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "866 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "states.app",
        "id.google.com",
        "object.prototype.hasownproperty.call",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "t.name",
        "hasownproperty.call",
        "globalworker1.sol.us",
        "applestore.id",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "location.search",
        "http://e.id?e.id:e.id.getAttribute",
        "http://git.io/yBU2rg",
        "http://decafsmob.this.id",
        "cdn.fuckporntube.com",
        "apps.apple.com/us/app/id$",
        "dev-2.ernestatech.com",
        "http://tracking.3061331.corn10wuk.club",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "worker-m-tlcus1.sol.us",
        "a.default.meta.applestore.id",
        "www.search.app.goo.gl",
        "209.85.145.113 [malware]",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "apps.apple.com",
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Webtoolbar",
            "Hsbc",
            "Maltiverse",
            "Gamehack"
          ],
          "industries": [],
          "unique_indicators": 19366
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/initium-gmbh.com",
    "whois": "http://whois.domaintools.com/initium-gmbh.com",
    "domain": "initium-gmbh.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "688e401a6f5537232c6fc6ca",
      "name": "Different view of iWin",
      "description": "Residuals and different view of Pulse [https://otx.alienvault.com/pulse/688e31b80edd775fe5d2f34f] Does OTX Pulse:\nMitre: T1055.015 ListPlanting Defense Evasion Privilege Escalation Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.\n\nTarget & Cousin scammed?",
      "modified": "2025-09-01T16:02:12.221000",
      "created": "2025-08-02T16:43:06.981000",
      "tags": [
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "ascii text",
        "date",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "body",
        "layer network",
        "as46606",
        "us note",
        "route",
        "ptr record",
        "windows nt",
        "apache",
        "span",
        "pragma",
        "meta",
        "footer",
        "google",
        "us seen",
        "general info",
        "geo united",
        "as15169",
        "t1045",
        "packing",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1119",
        "t1057",
        "discovery",
        "t1071",
        "showing",
        "entries",
        "present jul",
        "error jul",
        "present showing",
        "next http",
        "scans record",
        "value",
        "body html",
        "head title",
        "title head",
        "accept",
        "ip address",
        "location united",
        "asn as46606",
        "whois registrar",
        "creation date",
        "pulses",
        "related tags",
        "indicator",
        "response ip",
        "address google",
        "safe browsing",
        "title",
        "head",
        "search",
        "passive dns",
        "urls",
        "record value",
        "emails",
        "error",
        "meta http",
        "content",
        "gmt server",
        "content type",
        "script urls",
        "script script",
        "service",
        "code",
        "filehashmd5",
        "filehashsha1",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "ipv4",
        "url http",
        "indicator role",
        "title added",
        "active related",
        "pulses ipv4",
        "ccus asnas15169",
        "role"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 145,
        "FileHash-SHA1": 149,
        "FileHash-SHA256": 494,
        "SSLCertFingerprint": 3,
        "URL": 319,
        "domain": 63,
        "hostname": 228,
        "CIDR": 3,
        "email": 4
      },
      "indicator_count": 1408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688e31b80edd775fe5d2f34f",
      "name": "Social Engineering led to -#Lowfi:HSTR:Win32/iWin.B",
      "description": "Likely: Phone referral led to an in person meeting, financial transaction, telephone numbers exchange, website click, in home service call. The alternative is compromised target was redirected to malicious host or service provider became compromised by targeted persons issue.\nThere are several targeted people. This person is closely associated with a target.(idk -malicious)\nMitre: T1055.015\tListPlanting\t\nDefense Evasion\nPrivilege Escalation\nAdversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.",
      "modified": "2025-09-01T15:02:58.791000",
      "created": "2025-08-02T15:41:44.319000",
      "tags": [
        "united",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "gmt server",
        "gmt content",
        "certificate",
        "apache",
        "encrypt",
        "gmt path",
        "set cookie",
        "httponly",
        "passive dns",
        "urls",
        "address",
        "meta",
        "dynamicloader",
        "write c",
        "medium",
        "tlsv1",
        "show",
        "entries",
        "high",
        "http",
        "copy",
        "upatre",
        "write",
        "unknown",
        "asn15169",
        "google",
        "asn46606",
        "unifiedlayeras1",
        "frankfurt",
        "main",
        "germany",
        "google safe",
        "browsing",
        "script urls",
        "a domains",
        "libs",
        "monstroid2",
        "link",
        "accept encoding",
        "script domains",
        "title",
        "vary",
        "jquery",
        "pulse pulses",
        "hostname xn",
        "files domain",
        "showing",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "present jul",
        "for privacy",
        "roboto",
        "delete",
        "trojan",
        "globalc",
        "mozilla",
        "guard",
        "malware",
        "iwin",
        "local",
        "lowfi",
        "helper",
        "nsisdl",
        "executable",
        "amazon s3",
        "pe exe",
        "dll windows",
        "http yara",
        "alerts",
        "meta http",
        "content",
        "pragma",
        "content type",
        "body",
        "service",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "windows nt",
        "mitre att",
        "ascii text",
        "show technique",
        "path",
        "span",
        "click",
        "august",
        "hybrid",
        "general",
        "strings",
        "footer",
        "ck matrix"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 460,
        "hostname": 744,
        "URL": 3496,
        "email": 4,
        "domain": 394,
        "FileHash-SHA256": 2072,
        "FileHash-MD5": 464,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 7641,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546cf78627adef6562a97aa",
      "name": "Browser Malware Attack",
      "description": "Attacking my browser to identify.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:10:48.676000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "866 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6546d0120a7e479fecffe2b1",
      "name": "Browser Malware Attack",
      "description": "Attacking  browser to identify researcher.\nCommand for critical failure/destruction:    https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
      "modified": "2023-12-04T22:00:43.514000",
      "created": "2023-11-04T23:13:21.883000",
      "tags": [
        "united",
        "facebook",
        "phishtank",
        "detection list",
        "ip address",
        "blacklist",
        "paypal",
        "cisco umbrella",
        "site",
        "alexa top",
        "safe site",
        "million",
        "malicious url",
        "malware site",
        "malicious site",
        "malware",
        "name verdict",
        "falcon sandbox",
        "reports no",
        "speci",
        "efr1",
        "pattern match",
        "file",
        "web open",
        "font format",
        "truetype",
        "indicator",
        "windows nt",
        "et tor",
        "known tor",
        "relayrouter",
        "date",
        "unknown",
        "general",
        "hybrid",
        "local",
        "stream",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "self",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "phishing site",
        "heur",
        "cyber threat",
        "unsafe",
        "riskware",
        "phishing",
        "bank",
        "service",
        "artemis",
        "team",
        "xtrat",
        "agent",
        "xrat",
        "filetour",
        "exploit",
        "conduit",
        "opencandy",
        "fusioncore",
        "orkut",
        "steam",
        "genkryptik",
        "runescape",
        "presenoker",
        "ramnit",
        "msil",
        "crack",
        "tofsee",
        "suppobox",
        "malicious",
        "simda",
        "vawtrak",
        "hotmail",
        "generic",
        "webtoolbar",
        "hsbc",
        "maltiverse",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "count blacklist",
        "tag count",
        "downldr",
        "cleaner",
        "iframe",
        "wacatac",
        "alexa",
        "win64",
        "swrort",
        "installcore",
        "azorult",
        "download",
        "blacknet rat",
        "stealer",
        "softcnapp",
        "nircmd",
        "unruy",
        "patcher",
        "adload",
        "dropper",
        "installpack",
        "tiggre",
        "gamehack",
        "trojanspy",
        "germany http",
        "attacker",
        "static engine",
        "internet storm",
        "center",
        "passive dns",
        "urls",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "url http",
        "pulse pulses",
        "http",
        "related nids"
      ],
      "references": [
        "https://search.app.goo.gl/?ofl=https://lens.google&al=googleapp://lens?lens_data=KAw&apn=com.google.android.googlequicksearchbox&amv=301204913&isi=284815942&ius=googleapp&ibi=com.goog",
        "object.prototype.hasownproperty.call",
        "hasownproperty.call",
        "a.default.meta.applestore.id",
        "applestore.id",
        "http://decafsmob.this.id",
        "id.google.com",
        "http://critical-system-failure7250.21ny35098453.com-bm3y-v806d9gk.cricket/",
        "http://git.io/yBU2rg",
        "critical-failure-alert2286.40ek97931491.com-4nj1ze3ivfwy.website",
        "https://fairspin.io/?track_id=44698569&pid=1&geo=6252001&utm_source=bonafides&utm_medium=&utm_campaign=smarttds&utm_term=incorrect_param",
        "http://tracking.3061331.corn10wuk.club",
        "http://information.7174932.cakcuk.az/tracking/tracking.php?id=8459701&page=904",
        "apps.apple.com/us/app/id$",
        "t.name",
        "http://e.id?e.id:e.id.getAttribute",
        "location.search",
        "https://dnsorangetel.dn2.n-helix.com",
        "1080p-torrent.ml",
        "states.app",
        "dev-2.ernestatech.com",
        "https://hybrid-analysis.com/sample/d26000dfe1137f05f9187996dc752a703000402fe9e35a8ea216e9215a34560d",
        "209.85.145.113 [malware]",
        "cdn.fuckporntube.com",
        "www.search.app.goo.gl",
        "apps.apple.com",
        "http://www.youtube.com/gen_204?cplatform=tablet&c=android&cver=5.6.36&cos=Android&cosver=4.4.2&cbr=com.google.android.youtube&cbrv",
        "https://coloradosprings.americanlisted.com/pets-animals/beautiful-ragdoll-kittens_31591993.html",
        "globalworker1.sol.us",
        "worker-m-tlcus1.sol.us"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany",
        "Ireland",
        "Singapore"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 33,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1015,
        "hostname": 1309,
        "FileHash-MD5": 466,
        "FileHash-SHA1": 255,
        "FileHash-SHA256": 3783,
        "URL": 4001,
        "CVE": 9,
        "email": 3
      },
      "indicator_count": 10841,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "866 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://initium-gmbh.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://initium-gmbh.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776625908.0571768
}