{ "type": "URL", "indicator": "https://licensing.secureteam.net", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://licensing.secureteam.net", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4064604049, "indicator": "https://licensing.secureteam.net", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "68245681009c35da8f04b45b", "name": "2606:4700:3036::ac43:a8cb (2606:4700:3000::/42)", "description": "Here is a full set of words and phrases used by the BBC to describe the various types of ransomware that can be used to target victims of the Windows operating system, as well as the UK.", "modified": "2025-06-13T07:02:14.919000", "created": "2025-05-14T08:38:25.425000", "tags": [ "assignment", "cloudflare", "admin", "cloudflarenet", "allocation", "cloud14", "townsend stnsan", "warp abuse", "service", "arin rdapwhois", "rdapwhois", "reporting", "copyright", "registry", "wallet", "azaz09", "firefox", "windows nt", "windows", "data", "value", "sandbox", "edge", "msie", "example", "terminal", "phantom", "anubis", "bitcoin", "crypto", "exodus", "android", "keeper", "steam", "webdav", "explorer", "finger", "malware", "schmidti", "dllimport", "emotet", "mozilla", "win64", "insta", "solo", "union", "discord", "liberty", "saturn", "terra", "temple", "harmony", "core", "easy", "ultimate", "cash", "therat", "python image", "load", "python core", "python script", "py2exe", "john", "open threat", "research", "files", "comment", "python dll", "sideloading id", "dll sideloading", "poudel date", "filespython3", "studio", "python dlls", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [ "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "indicator_suspicious.yar", "Python Image Load By Non-Python Process.yml", "Potential Python DLL SideLoading.yml", "indicator_packed.yar" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TheRat", "display_name": "TheRat", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 870, "email": 4, "hostname": 148, "FileHash-SHA256": 471, "domain": 47, "FileHash-MD5": 2, "FileHash-SHA1": 2, "YARA": 163, "CVE": 1 }, "indicator_count": 1710, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "681320d95f6e474a321ec559", "name": "4056765cf00bae778eb840e2612a0d9ebf5508e0b2ec1774a2e791b3871ea010 Opera.Client.Common.dll", "description": "https://www.virustotal.com/gui/file/4056765cf00bae778eb840e2612a0d9ebf5508e0b2ec1774a2e791b3871ea010/behavior\nrule INDICATOR_XE_Packed AgileDotNet, which detects executables packed with SmartAssembly, has been published by CliSecure, the company that co-created the security software.", "modified": "2025-05-14T20:54:07.533000", "created": "2025-05-01T07:20:57.235000", "tags": [ "smartassembly", "agiledotnetrt", "clisecure", "agiledotnetrt64", "agiledotnet", "callvirt", "domainunload", "detect tool", "serioussam", "globalroot", "device", "block level", "backup engine", "service exe", "revise uint16", "vhash", "authentihash", "ssdeep", "sha1", "sha512" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 216, "YARA": 3, "domain": 33, "CVE": 1, "FileHash-MD5": 2, "FileHash-SHA1": 1, "FileHash-SHA256": 112, "hostname": 96 }, "indicator_count": 464, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "339 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "681f89cbab1a4574c464ad5b", "name": "f83991c8-f2d9-5583-845a-d105034783ab", "description": "https://www.virustotal.com/gui/file/e79f57b603370d4cd4ab1d757833995b89c7d79c9071c75d72c6d082ba0a7ea4/detection\nA chronology of key events in the history of the United States:-1.1-2 January 2020.. and 1 February 2021.. (c.9/11):.", "modified": "2025-05-10T17:15:55.933000", "created": "2025-05-10T17:15:55.933000", "tags": [ "detects", "xored url", "roth", "nextron", "deepgit", "avast software", "gmbh", "perl dev", "digiread", "avid editor", "confuserex mod", "aspirecrypt", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 12, "FileHash-SHA1": 11, "FileHash-SHA256": 17, "YARA": 53, "URL": 55, "domain": 4, "hostname": 7, "CVE": 1 }, "indicator_count": 160, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "343 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "Python Image Load By Non-Python Process.yml", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "indicator_packed.yar", "Potential Python DLL SideLoading.yml", "indicator_suspicious.yar", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Therat" ], "industries": [], "unique_indicators": 2186 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/secureteam.net", "whois": "http://whois.domaintools.com/secureteam.net", "domain": "secureteam.net", "hostname": "licensing.secureteam.net" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "68245681009c35da8f04b45b", "name": "2606:4700:3036::ac43:a8cb (2606:4700:3000::/42)", "description": "Here is a full set of words and phrases used by the BBC to describe the various types of ransomware that can be used to target victims of the Windows operating system, as well as the UK.", "modified": "2025-06-13T07:02:14.919000", "created": "2025-05-14T08:38:25.425000", "tags": [ "assignment", "cloudflare", "admin", "cloudflarenet", "allocation", "cloud14", "townsend stnsan", "warp abuse", "service", "arin rdapwhois", "rdapwhois", "reporting", "copyright", "registry", "wallet", "azaz09", "firefox", "windows nt", "windows", "data", "value", "sandbox", "edge", "msie", "example", "terminal", "phantom", "anubis", "bitcoin", "crypto", "exodus", "android", "keeper", "steam", "webdav", "explorer", "finger", "malware", "schmidti", "dllimport", "emotet", "mozilla", "win64", "insta", "solo", "union", "discord", "liberty", "saturn", "terra", "temple", "harmony", "core", "easy", "ultimate", "cash", "therat", "python image", "load", "python core", "python script", "py2exe", "john", "open threat", "research", "files", "comment", "python dll", "sideloading id", "dll sideloading", "poudel date", "filespython3", "studio", "python dlls", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [ "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "indicator_suspicious.yar", "Python Image Load By Non-Python Process.yml", "Potential Python DLL SideLoading.yml", "indicator_packed.yar" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TheRat", "display_name": "TheRat", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 870, "email": 4, "hostname": 148, "FileHash-SHA256": 471, "domain": 47, "FileHash-MD5": 2, "FileHash-SHA1": 2, "YARA": 163, "CVE": 1 }, "indicator_count": 1710, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "681320d95f6e474a321ec559", "name": "4056765cf00bae778eb840e2612a0d9ebf5508e0b2ec1774a2e791b3871ea010 Opera.Client.Common.dll", "description": "https://www.virustotal.com/gui/file/4056765cf00bae778eb840e2612a0d9ebf5508e0b2ec1774a2e791b3871ea010/behavior\nrule INDICATOR_XE_Packed AgileDotNet, which detects executables packed with SmartAssembly, has been published by CliSecure, the company that co-created the security software.", "modified": "2025-05-14T20:54:07.533000", "created": "2025-05-01T07:20:57.235000", "tags": [ "smartassembly", "agiledotnetrt", "clisecure", "agiledotnetrt64", "agiledotnet", "callvirt", "domainunload", "detect tool", "serioussam", "globalroot", "device", "block level", "backup engine", "service exe", "revise uint16", "vhash", "authentihash", "ssdeep", "sha1", "sha512" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 216, "YARA": 3, "domain": 33, "CVE": 1, "FileHash-MD5": 2, "FileHash-SHA1": 1, "FileHash-SHA256": 112, "hostname": 96 }, "indicator_count": 464, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "339 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "681f89cbab1a4574c464ad5b", "name": "f83991c8-f2d9-5583-845a-d105034783ab", "description": "https://www.virustotal.com/gui/file/e79f57b603370d4cd4ab1d757833995b89c7d79c9071c75d72c6d082ba0a7ea4/detection\nA chronology of key events in the history of the United States:-1.1-2 January 2020.. and 1 February 2021.. (c.9/11):.", "modified": "2025-05-10T17:15:55.933000", "created": "2025-05-10T17:15:55.933000", "tags": [ "detects", "xored url", "roth", "nextron", "deepgit", "avast software", "gmbh", "perl dev", "digiread", "avid editor", "confuserex mod", "aspirecrypt", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 12, "FileHash-SHA1": 11, "FileHash-SHA256": 17, "YARA": 53, "URL": 55, "domain": 4, "hostname": 7, "CVE": 1 }, "indicator_count": 160, "is_author": false, "is_subscribing": null, "subscriber_count": 123, "modified_text": "343 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://licensing.secureteam.net", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://licensing.secureteam.net", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776596651.7393658 }