{
  "type": "URL",
  "indicator": "https://lb.nasigolang.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://lb.nasigolang.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3831658482,
      "indicator": "https://lb.nasigolang.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "6952fbca42c1b0da7431e6a7",
          "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ",
          "description": "",
          "modified": "2025-12-29T22:08:10.280000",
          "created": "2025-12-29T22:08:10.280000",
          "tags": [
            "backdoor",
            "cyprus",
            "trojan",
            "mtb sep",
            "passive dns",
            "ddos",
            "mtb oct",
            "mtb aug",
            "ipv4 add",
            "smokeloader",
            "trojandropper",
            "extraction",
            "se extraction",
            "failed",
            "data upload",
            "enter s",
            "enter sc",
            "data u",
            "extrac please",
            "prop",
            "extre data",
            "type",
            "extr data",
            "include review",
            "exclude",
            "find s",
            "typ data",
            "source tir",
            "extri",
            "exclude sugges",
            "se type",
            "extra",
            "include data",
            "exclude review",
            "show",
            "showinil tvnes",
            "dom dom",
            "sc cat959",
            "drop",
            "pulse pulses",
            "worm",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "susp",
            "cyprus showing",
            "entries",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "date",
            "registrar",
            "se cre",
            "pul use",
            "url list",
            "status http",
            "linkid182227",
            "linkid151642",
            "first",
            "domain list",
            "ii llc",
            "sc data",
            "ukl extract",
            "hiloti style",
            "msle",
            "win3 data",
            "onio",
            "observea",
            "data data",
            "stop data",
            "monitored target",
            "tsara",
            "pegasus",
            "social engineering"
          ],
          "references": [
            "http://fakejuko.site40/",
            "pegacloud.net",
            "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "IDS: Win32/Ibashade CnC Beacon",
            "IDS: Win32.Scar.hhrw POST",
            "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
            "IDS: OnionDuke CnC Beacon 1",
            "IDS: Observed Suspicious UA (Mozilla/5.0)",
            "IDS: Data POST to an image file (jpg)",
            "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:WormX-gen [Wrm]",
              "display_name": "Win32:WormX-gen [Wrm]",
              "target": null
            },
            {
              "id": "Worm:Win32:Drolnux",
              "display_name": "Worm:Win32:Drolnux",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "6877422df67773a07ef450c2",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1630,
            "URL": 4078,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 246,
            "FileHash-SHA256": 2561,
            "CVE": 2,
            "domain": 1307,
            "email": 1
          },
          "indicator_count": 10070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "111 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6877422df67773a07ef450c2",
          "name": "Pegasus / Pegacloud - Infiltration",
          "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.",
          "modified": "2025-08-15T05:01:22.570000",
          "created": "2025-07-16T06:09:49.704000",
          "tags": [
            "backdoor",
            "cyprus",
            "trojan",
            "mtb sep",
            "passive dns",
            "ddos",
            "mtb oct",
            "mtb aug",
            "ipv4 add",
            "smokeloader",
            "trojandropper",
            "extraction",
            "se extraction",
            "failed",
            "data upload",
            "enter s",
            "enter sc",
            "data u",
            "extrac please",
            "prop",
            "extre data",
            "type",
            "extr data",
            "include review",
            "exclude",
            "find s",
            "typ data",
            "source tir",
            "extri",
            "exclude sugges",
            "se type",
            "extra",
            "include data",
            "exclude review",
            "show",
            "showinil tvnes",
            "dom dom",
            "sc cat959",
            "drop",
            "pulse pulses",
            "worm",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "susp",
            "cyprus showing",
            "entries",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "date",
            "registrar",
            "se cre",
            "pul use",
            "url list",
            "status http",
            "linkid182227",
            "linkid151642",
            "first",
            "domain list",
            "ii llc",
            "sc data",
            "ukl extract",
            "hiloti style",
            "msle",
            "win3 data",
            "onio",
            "observea",
            "data data",
            "stop data",
            "monitored target",
            "tsara",
            "pegasus",
            "social engineering"
          ],
          "references": [
            "http://fakejuko.site40/",
            "pegacloud.net",
            "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "IDS: Win32/Ibashade CnC Beacon",
            "IDS: Win32.Scar.hhrw POST",
            "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
            "IDS: OnionDuke CnC Beacon 1",
            "IDS: Observed Suspicious UA (Mozilla/5.0)",
            "IDS: Data POST to an image file (jpg)",
            "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:WormX-gen [Wrm]",
              "display_name": "Win32:WormX-gen [Wrm]",
              "target": null
            },
            {
              "id": "Worm:Win32:Drolnux",
              "display_name": "Worm:Win32:Drolnux",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1630,
            "URL": 4078,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 246,
            "FileHash-SHA256": 2561,
            "CVE": 2,
            "domain": 1307,
            "email": 1
          },
          "indicator_count": 10070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "247 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b7119615db47ea27706a86",
          "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
          "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
          "modified": "2024-04-12T23:03:13.367000",
          "created": "2024-01-29T02:46:46.076000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 9102,
            "CVE": 5,
            "FileHash-MD5": 68,
            "FileHash-SHA1": 67,
            "FileHash-SHA256": 2209,
            "domain": 1427,
            "hostname": 4334
          },
          "indicator_count": 17212,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "737 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65de941acedcdd661f0593b6",
          "name": "Esurance Remote Attacks (Cloned. Who modifies reports? This happens to me)",
          "description": "",
          "modified": "2024-02-28T02:02:02.807000",
          "created": "2024-02-28T02:02:02.807000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": "65b711a6f49f057c311f2642",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "781 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b7119e9272b1426729e1ed",
          "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
          "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
          "modified": "2024-02-28T02:01:51.407000",
          "created": "2024-01-29T02:46:54.594000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b711a6f49f057c311f2642",
          "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
          "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
          "modified": "2024-02-28T02:01:51.407000",
          "created": "2024-01-29T02:47:02.117000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80763e9d9e18cf87d985b",
          "name": "Esurance Remote Attacks| Emotet | Lolkek | Part I",
          "description": "",
          "modified": "2024-02-28T02:01:51.407000",
          "created": "2024-01-29T20:15:31.163000",
          "tags": [
            "ssl certificate",
            "xamzexpires600",
            "whois record",
            "url collection",
            "collections",
            "historical ssl",
            "referrer",
            "contacted",
            "resolutions",
            "web gateway",
            "emotet",
            "urls http",
            "whois whois",
            "domains",
            "lolkek",
            "core",
            "caddywiper",
            "awful",
            "urls url",
            "cymulate",
            "malware",
            "com laude",
            "ltd dba",
            "first",
            "utc submissions",
            "submitters",
            "cloudflarenet",
            "internet domain",
            "service bs",
            "corp",
            "dynadot",
            "twitter",
            "optimizer",
            "amazonaes",
            "summary iocs",
            "graph community",
            "origin1",
            "ver33",
            "dtamlb",
            "smlb",
            "csc corporate",
            "gandi sas",
            "namecheap inc",
            "google",
            "amazon02",
            "apple",
            "remote attacks"
          ],
          "references": [
            "https://www.esurance.com/",
            "https://www.malwarebytes.com/emotet"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "LolKek",
              "display_name": "LolKek",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Telecom",
            "Civil Society",
            "Insurance"
          ],
          "TLP": "white",
          "cloned_from": "65b711a6f49f057c311f2642",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8575,
            "CVE": 4,
            "FileHash-MD5": 47,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 1951,
            "domain": 1394,
            "hostname": 4095
          },
          "indicator_count": 16112,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Win32/Ibashade CnC Beacon",
        "https://www.esurance.com/",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "pegacloud.net",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214",
        "IDS: Data POST to an image file (jpg)",
        "IDS: Win32.Scar.hhrw POST",
        "https://www.malwarebytes.com/emotet",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "http://fakejuko.site40/",
        "IDS: OnionDuke CnC Beacon 1"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Worm:win32:drolnux",
            "Win32:wormx-gen [wrm]",
            "Emotet",
            "Pegasus - mob-s0005",
            "Lolkek"
          ],
          "industries": [
            "Insurance",
            "Telecommunications",
            "Telecom",
            "Government",
            "Civil society",
            "Technology"
          ],
          "unique_indicators": 27721
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/nasigolang.com",
    "whois": "http://whois.domaintools.com/nasigolang.com",
    "domain": "nasigolang.com",
    "hostname": "lb.nasigolang.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "6952fbca42c1b0da7431e6a7",
      "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ",
      "description": "",
      "modified": "2025-12-29T22:08:10.280000",
      "created": "2025-12-29T22:08:10.280000",
      "tags": [
        "backdoor",
        "cyprus",
        "trojan",
        "mtb sep",
        "passive dns",
        "ddos",
        "mtb oct",
        "mtb aug",
        "ipv4 add",
        "smokeloader",
        "trojandropper",
        "extraction",
        "se extraction",
        "failed",
        "data upload",
        "enter s",
        "enter sc",
        "data u",
        "extrac please",
        "prop",
        "extre data",
        "type",
        "extr data",
        "include review",
        "exclude",
        "find s",
        "typ data",
        "source tir",
        "extri",
        "exclude sugges",
        "se type",
        "extra",
        "include data",
        "exclude review",
        "show",
        "showinil tvnes",
        "dom dom",
        "sc cat959",
        "drop",
        "pulse pulses",
        "worm",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "susp",
        "cyprus showing",
        "entries",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "date",
        "registrar",
        "se cre",
        "pul use",
        "url list",
        "status http",
        "linkid182227",
        "linkid151642",
        "first",
        "domain list",
        "ii llc",
        "sc data",
        "ukl extract",
        "hiloti style",
        "msle",
        "win3 data",
        "onio",
        "observea",
        "data data",
        "stop data",
        "monitored target",
        "tsara",
        "pegasus",
        "social engineering"
      ],
      "references": [
        "http://fakejuko.site40/",
        "pegacloud.net",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Win32.Scar.hhrw POST",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Data POST to an image file (jpg)",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:WormX-gen [Wrm]",
          "display_name": "Win32:WormX-gen [Wrm]",
          "target": null
        },
        {
          "id": "Worm:Win32:Drolnux",
          "display_name": "Worm:Win32:Drolnux",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "6877422df67773a07ef450c2",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1630,
        "URL": 4078,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 246,
        "FileHash-SHA256": 2561,
        "CVE": 2,
        "domain": 1307,
        "email": 1
      },
      "indicator_count": 10070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "111 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6877422df67773a07ef450c2",
      "name": "Pegasus / Pegacloud - Infiltration",
      "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.",
      "modified": "2025-08-15T05:01:22.570000",
      "created": "2025-07-16T06:09:49.704000",
      "tags": [
        "backdoor",
        "cyprus",
        "trojan",
        "mtb sep",
        "passive dns",
        "ddos",
        "mtb oct",
        "mtb aug",
        "ipv4 add",
        "smokeloader",
        "trojandropper",
        "extraction",
        "se extraction",
        "failed",
        "data upload",
        "enter s",
        "enter sc",
        "data u",
        "extrac please",
        "prop",
        "extre data",
        "type",
        "extr data",
        "include review",
        "exclude",
        "find s",
        "typ data",
        "source tir",
        "extri",
        "exclude sugges",
        "se type",
        "extra",
        "include data",
        "exclude review",
        "show",
        "showinil tvnes",
        "dom dom",
        "sc cat959",
        "drop",
        "pulse pulses",
        "worm",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "susp",
        "cyprus showing",
        "entries",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "date",
        "registrar",
        "se cre",
        "pul use",
        "url list",
        "status http",
        "linkid182227",
        "linkid151642",
        "first",
        "domain list",
        "ii llc",
        "sc data",
        "ukl extract",
        "hiloti style",
        "msle",
        "win3 data",
        "onio",
        "observea",
        "data data",
        "stop data",
        "monitored target",
        "tsara",
        "pegasus",
        "social engineering"
      ],
      "references": [
        "http://fakejuko.site40/",
        "pegacloud.net",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Win32.Scar.hhrw POST",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Data POST to an image file (jpg)",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:WormX-gen [Wrm]",
          "display_name": "Win32:WormX-gen [Wrm]",
          "target": null
        },
        {
          "id": "Worm:Win32:Drolnux",
          "display_name": "Worm:Win32:Drolnux",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1630,
        "URL": 4078,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 246,
        "FileHash-SHA256": 2561,
        "CVE": 2,
        "domain": 1307,
        "email": 1
      },
      "indicator_count": 10070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "247 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b7119615db47ea27706a86",
      "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
      "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
      "modified": "2024-04-12T23:03:13.367000",
      "created": "2024-01-29T02:46:46.076000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 9102,
        "CVE": 5,
        "FileHash-MD5": 68,
        "FileHash-SHA1": 67,
        "FileHash-SHA256": 2209,
        "domain": 1427,
        "hostname": 4334
      },
      "indicator_count": 17212,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "737 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65de941acedcdd661f0593b6",
      "name": "Esurance Remote Attacks (Cloned. Who modifies reports? This happens to me)",
      "description": "",
      "modified": "2024-02-28T02:02:02.807000",
      "created": "2024-02-28T02:02:02.807000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": "65b711a6f49f057c311f2642",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "781 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b7119e9272b1426729e1ed",
      "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
      "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
      "modified": "2024-02-28T02:01:51.407000",
      "created": "2024-01-29T02:46:54.594000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b711a6f49f057c311f2642",
      "name": "Esurance Remote Attacks| Emotet | Lolkek  | Part I",
      "description": "Emotet is a kind of malware originally designed as a banking Trojan aimed at stealing financial data, but it's evolved to become a major threat to users everywhere.\n\nLater versions evolved to use macro-enabled documents to retrieve the virus payload from command and control. They have been advised .",
      "modified": "2024-02-28T02:01:51.407000",
      "created": "2024-01-29T02:47:02.117000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80763e9d9e18cf87d985b",
      "name": "Esurance Remote Attacks| Emotet | Lolkek | Part I",
      "description": "",
      "modified": "2024-02-28T02:01:51.407000",
      "created": "2024-01-29T20:15:31.163000",
      "tags": [
        "ssl certificate",
        "xamzexpires600",
        "whois record",
        "url collection",
        "collections",
        "historical ssl",
        "referrer",
        "contacted",
        "resolutions",
        "web gateway",
        "emotet",
        "urls http",
        "whois whois",
        "domains",
        "lolkek",
        "core",
        "caddywiper",
        "awful",
        "urls url",
        "cymulate",
        "malware",
        "com laude",
        "ltd dba",
        "first",
        "utc submissions",
        "submitters",
        "cloudflarenet",
        "internet domain",
        "service bs",
        "corp",
        "dynadot",
        "twitter",
        "optimizer",
        "amazonaes",
        "summary iocs",
        "graph community",
        "origin1",
        "ver33",
        "dtamlb",
        "smlb",
        "csc corporate",
        "gandi sas",
        "namecheap inc",
        "google",
        "amazon02",
        "apple",
        "remote attacks"
      ],
      "references": [
        "https://www.esurance.com/",
        "https://www.malwarebytes.com/emotet"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "LolKek",
          "display_name": "LolKek",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Telecom",
        "Civil Society",
        "Insurance"
      ],
      "TLP": "white",
      "cloned_from": "65b711a6f49f057c311f2642",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8575,
        "CVE": 4,
        "FileHash-MD5": 47,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 1951,
        "domain": 1394,
        "hostname": 4095
      },
      "indicator_count": 16112,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://lb.nasigolang.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://lb.nasigolang.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642784.2800584
}