{
  "type": "URL",
  "indicator": "https://nc-dl.wdjcdn.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://nc-dl.wdjcdn.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3491269659,
      "indicator": "https://nc-dl.wdjcdn.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "693de4a8a72cf95b028365f0",
          "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee",
          "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets",
          "modified": "2026-01-12T21:02:35.560000",
          "created": "2025-12-13T22:11:52.474000",
          "tags": [
            "network",
            "ip address",
            "subnet",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "windows",
            "united",
            "write",
            "tofsee",
            "stream",
            "win64",
            "push",
            "urls",
            "url analysis",
            "dnssec",
            "script domains",
            "encrypt",
            "url add",
            "http",
            "related nids",
            "flag united",
            "germany",
            "address google",
            "passive dns",
            "ipv4 add",
            "files",
            "asn as13335",
            "dns resolutions",
            "domains top",
            "level",
            "unique tlds",
            "location united",
            "asn asnone",
            "present dec",
            "backdoor",
            "lowfi",
            "win32autoit mar",
            "urls show",
            "date checked",
            "connection",
            "httponly",
            "secure",
            "path",
            "expiressat",
            "dynamic cfray",
            "medium",
            "delete c",
            "displayname",
            "show",
            "unknown",
            "next",
            "rndhex",
            "malware",
            "cname",
            "next associated",
            "url hostname",
            "server response",
            "google safe",
            "read c",
            "unicode",
            "png image",
            "rgba",
            "memcommit",
            "dock",
            "execution",
            "files location",
            "china flag",
            "china hostname",
            "hostname",
            "domain",
            "files ip",
            "address",
            "asn as45102",
            "gmt content",
            "certificate",
            "associated urls",
            "location china",
            "china asn",
            "as4808 china",
            "present aug",
            "object",
            "present apr",
            "present oct",
            "alman",
            "present sep",
            "error",
            "present jul",
            "rmndrp",
            "present feb",
            "expiration",
            "url https",
            "url http",
            "iocs",
            "review iocs",
            "expireswed",
            "samesitenone",
            "maxage86400",
            "maxage0",
            "server",
            "expires",
            "victina nulcac",
            "data upload",
            "extraction",
            "enter",
            "enter source",
            "url data",
            "type",
            "extract indic",
            "included iocs",
            "china unknown",
            "botnet",
            "folk in browser",
            "japan unknown",
            "asnone country",
            "as13335",
            "a domains",
            "script urls",
            "servers",
            "title",
            "moved",
            "record value",
            "entries",
            "whitelisted",
            "powershell",
            "xf9xb5xf9",
            "xxcexf6x8fr",
            "k2xe7xcbxxeaxa2",
            "x99x19",
            "x88yxf9xc858",
            "x83x12x8da",
            "zx9bx8ex84",
            "attempts",
            "yara detections",
            "contacted",
            "tags none",
            "file type",
            "pe packer",
            "dll compilation",
            "guard",
            "botnets"
          ],
          "references": [
            "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
            "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
            "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
            "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
            "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America",
            "Russian Federation",
            "T\u00fcrkiye",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "Backdoor:Win32/Tofsee",
              "display_name": "Backdoor:Win32/Tofsee",
              "target": "/malware/Backdoor:Win32/Tofsee"
            },
            {
              "id": "AutoIT",
              "display_name": "AutoIT",
              "target": null
            },
            {
              "id": "HtBot",
              "display_name": "HtBot",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1195.001",
              "name": "Compromise Software Dependencies and Development Tools",
              "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1593.001",
              "name": "Social Media",
              "display_name": "T1593.001 - Social Media"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1185",
              "name": "Man in the Browser",
              "display_name": "T1185 - Man in the Browser"
            },
            {
              "id": "T1481",
              "name": "Web Service",
              "display_name": "T1481 - Web Service"
            },
            {
              "id": "T1534",
              "name": "Internal Spearphishing",
              "display_name": "T1534 - Internal Spearphishing"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1459",
              "name": "Device Unlock Code Guessing or Brute Force",
              "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8145,
            "domain": 1389,
            "FileHash-SHA256": 1545,
            "CIDR": 2,
            "hostname": 2533,
            "FileHash-MD5": 209,
            "FileHash-SHA1": 190,
            "email": 6,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 14023,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "139 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65709475d5d03a86a11b0c87",
          "name": "http://apk.wdjcdn.com/5/9c/ - Hybrid-A Suspicious",
          "description": "",
          "modified": "2023-12-06T15:34:13.291000",
          "created": "2023-12-06T15:34:13.291000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 26,
            "FileHash-SHA1": 27,
            "FileHash-SHA256": 85,
            "domain": 35,
            "URL": 235,
            "hostname": 16
          },
          "indicator_count": 424,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570946d73716a30cdfcc2c4",
          "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
          "description": "",
          "modified": "2023-12-06T15:34:05.864000",
          "created": "2023-12-06T15:34:05.864000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1853,
            "hostname": 563,
            "URL": 1230,
            "domain": 195,
            "FileHash-MD5": 31,
            "FileHash-SHA1": 15
          },
          "indicator_count": 3888,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570946a8cfe788ecc4b0a79",
          "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
          "description": "",
          "modified": "2023-12-06T15:34:02.331000",
          "created": "2023-12-06T15:34:02.331000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1865,
            "hostname": 600,
            "URL": 1330,
            "domain": 213,
            "FileHash-MD5": 42,
            "FileHash-SHA1": 26
          },
          "indicator_count": 4077,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708fd16e0eec6ed07a100b",
          "name": "analysis for 'https://rnetcontents.com/' - CVE-2021-22941",
          "description": "",
          "modified": "2023-12-06T15:14:25.718000",
          "created": "2023-12-06T15:14:25.718000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 122,
            "hostname": 67,
            "URL": 354,
            "domain": 58,
            "email": 2,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 36
          },
          "indicator_count": 682,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6382dda475c0d772f1d03c7f",
          "name": "http://apk.wdjcdn.com/5/9c/ - Hybrid-A Suspicious",
          "description": "",
          "modified": "2022-12-27T03:03:45.688000",
          "created": "2022-11-27T03:46:44.234000",
          "tags": [
            "size",
            "runtime process",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "hash seen",
            "sha1",
            "sha256",
            "localappdata",
            "submit",
            "strings",
            "hybrid",
            "general",
            "click",
            "hosts",
            "malicious",
            "suspicious"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/606158ec3c88dff5bc6f42a2d365274cbfd9e276f99716579baa57cef9da58d7/63821d0304c6b204277eb07a"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 85,
            "URL": 235,
            "hostname": 16,
            "domain": 35,
            "FileHash-MD5": 26,
            "FileHash-SHA1": 27
          },
          "indicator_count": 424,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 393,
          "modified_text": "1251 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "638215ed0dd1e3c9ad89133e",
          "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
          "description": "",
          "modified": "2022-12-26T13:03:37.522000",
          "created": "2022-11-26T13:34:37.426000",
          "tags": [
            "windows nt",
            "united",
            "date",
            "flag",
            "osint",
            "china china",
            "size",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "strings",
            "april",
            "hybrid",
            "malicious",
            "suspicious",
            "general",
            "click",
            "hosts",
            "path"
          ],
          "references": [
            "https://www.virustotal.com/gui/domain/arms-retcode.aliyuncs.com/relations",
            "https://www.virustotal.com/graph/g6e343036222d4be1888ba1165e41e4a8ef55e8add1304460bd3824ddf295d65e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1342,
            "hostname": 614,
            "FileHash-SHA256": 1866,
            "domain": 215,
            "CVE": 1,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 27
          },
          "indicator_count": 4108,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1252 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "638215f174ccf184b5ec48a4",
          "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
          "description": "",
          "modified": "2022-12-26T13:03:37.522000",
          "created": "2022-11-26T13:34:41.401000",
          "tags": [
            "windows nt",
            "united",
            "date",
            "flag",
            "osint",
            "china china",
            "size",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "strings",
            "april",
            "hybrid",
            "malicious",
            "suspicious",
            "general",
            "click",
            "hosts",
            "path"
          ],
          "references": [
            "https://www.virustotal.com/gui/domain/arms-retcode.aliyuncs.com/relations",
            "https://www.virustotal.com/graph/g6e343036222d4be1888ba1165e41e4a8ef55e8add1304460bd3824ddf295d65e"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1230,
            "hostname": 563,
            "FileHash-SHA256": 1853,
            "domain": 195,
            "CVE": 1,
            "FileHash-MD5": 31,
            "FileHash-SHA1": 15
          },
          "indicator_count": 3888,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 397,
          "modified_text": "1252 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62ba1520a930af9596f24745",
          "name": "analysis for 'https://rnetcontents.com/' - CVE-2021-22941",
          "description": "",
          "modified": "2022-07-27T00:02:05.219000",
          "created": "2022-06-27T20:37:52.947000",
          "tags": [
            "trojan",
            "apt",
            "unicode",
            "pcap",
            "mozilla",
            "team",
            "february",
            "streams hash",
            "CVE-2021-22941"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/dd9a0e915401c09fb975e0a474b144178bec3f27923f975901059feeb7ba7347/62b9ff31a0693042a621ff56",
            "https://hybrid-analysis.com/sample/663c712eec158b857ddb4cb79bfaa88a261daadb45fbb84246ee528f0150de19/62ba0f7d981e6308af5aba59",
            "CVE-2021-22941"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 354,
            "hostname": 67,
            "FileHash-SHA256": 122,
            "domain": 58,
            "FileHash-MD5": 43,
            "FileHash-SHA1": 36,
            "email": 2
          },
          "indicator_count": 682,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1404 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
        "https://www.virustotal.com/gui/domain/arms-retcode.aliyuncs.com/relations",
        "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
        "https://hybrid-analysis.com/sample/606158ec3c88dff5bc6f42a2d365274cbfd9e276f99716579baa57cef9da58d7/63821d0304c6b204277eb07a",
        "https://hybrid-analysis.com/sample/663c712eec158b857ddb4cb79bfaa88a261daadb45fbb84246ee528f0150de19/62ba0f7d981e6308af5aba59",
        "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
        "https://www.virustotal.com/graph/g6e343036222d4be1888ba1165e41e4a8ef55e8add1304460bd3824ddf295d65e",
        "https://hybrid-analysis.com/sample/dd9a0e915401c09fb975e0a474b144178bec3f27923f975901059feeb7ba7347/62b9ff31a0693042a621ff56",
        "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com",
        "CVE-2021-22941",
        "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Autoit",
            "Backdoor:win32/tofsee",
            "Htbot",
            "Mirai"
          ],
          "industries": [],
          "unique_indicators": 18942
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/wdjcdn.com",
    "whois": "http://whois.domaintools.com/wdjcdn.com",
    "domain": "wdjcdn.com",
    "hostname": "nc-dl.wdjcdn.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "693de4a8a72cf95b028365f0",
      "name": "Bot Block 162.159.128.0/19 | X Fake tweets | Tofsee",
      "description": "Tofsee.Trojan.T malware infection affects infected devices. \n\n\n#unlocked #injection #dead_host #compromised_devices #folk_in _browser #botnets",
      "modified": "2026-01-12T21:02:35.560000",
      "created": "2025-12-13T22:11:52.474000",
      "tags": [
        "network",
        "ip address",
        "subnet",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "windows",
        "united",
        "write",
        "tofsee",
        "stream",
        "win64",
        "push",
        "urls",
        "url analysis",
        "dnssec",
        "script domains",
        "encrypt",
        "url add",
        "http",
        "related nids",
        "flag united",
        "germany",
        "address google",
        "passive dns",
        "ipv4 add",
        "files",
        "asn as13335",
        "dns resolutions",
        "domains top",
        "level",
        "unique tlds",
        "location united",
        "asn asnone",
        "present dec",
        "backdoor",
        "lowfi",
        "win32autoit mar",
        "urls show",
        "date checked",
        "connection",
        "httponly",
        "secure",
        "path",
        "expiressat",
        "dynamic cfray",
        "medium",
        "delete c",
        "displayname",
        "show",
        "unknown",
        "next",
        "rndhex",
        "malware",
        "cname",
        "next associated",
        "url hostname",
        "server response",
        "google safe",
        "read c",
        "unicode",
        "png image",
        "rgba",
        "memcommit",
        "dock",
        "execution",
        "files location",
        "china flag",
        "china hostname",
        "hostname",
        "domain",
        "files ip",
        "address",
        "asn as45102",
        "gmt content",
        "certificate",
        "associated urls",
        "location china",
        "china asn",
        "as4808 china",
        "present aug",
        "object",
        "present apr",
        "present oct",
        "alman",
        "present sep",
        "error",
        "present jul",
        "rmndrp",
        "present feb",
        "expiration",
        "url https",
        "url http",
        "iocs",
        "review iocs",
        "expireswed",
        "samesitenone",
        "maxage86400",
        "maxage0",
        "server",
        "expires",
        "victina nulcac",
        "data upload",
        "extraction",
        "enter",
        "enter source",
        "url data",
        "type",
        "extract indic",
        "included iocs",
        "china unknown",
        "botnet",
        "folk in browser",
        "japan unknown",
        "asnone country",
        "as13335",
        "a domains",
        "script urls",
        "servers",
        "title",
        "moved",
        "record value",
        "entries",
        "whitelisted",
        "powershell",
        "xf9xb5xf9",
        "xxcexf6x8fr",
        "k2xe7xcbxxeaxa2",
        "x99x19",
        "x88yxf9xc858",
        "x83x12x8da",
        "zx9bx8ex84",
        "attempts",
        "yara detections",
        "contacted",
        "tags none",
        "file type",
        "pe packer",
        "dll compilation",
        "guard",
        "botnets"
      ],
      "references": [
        "https://x.com/DenverPolice/status/1999710339584475507?ref_src=twsrc%5Egoogle%7Ctwcamp%5Eserp%7Ctwgr%5Etweet",
        "x.com | 162.159.140.229 (162.159.128.0/19) AS 13335 ( CLOUDFLARENET )",
        "foundry.neconsside.com \u2022 http://foundry.neconsside.com",
        "http://foundry.neconsside.com/ \u2022 https://foundry.neconsside.com \u2022 https://foundry.neconsside",
        "IT Mirai | https://otx.alienvault.com/indicator/domain/miraitranslate.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America",
        "Russian Federation",
        "T\u00fcrkiye",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "Backdoor:Win32/Tofsee",
          "display_name": "Backdoor:Win32/Tofsee",
          "target": "/malware/Backdoor:Win32/Tofsee"
        },
        {
          "id": "AutoIT",
          "display_name": "AutoIT",
          "target": null
        },
        {
          "id": "HtBot",
          "display_name": "HtBot",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1195.001",
          "name": "Compromise Software Dependencies and Development Tools",
          "display_name": "T1195.001 - Compromise Software Dependencies and Development Tools"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1593.001",
          "name": "Social Media",
          "display_name": "T1593.001 - Social Media"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1185",
          "name": "Man in the Browser",
          "display_name": "T1185 - Man in the Browser"
        },
        {
          "id": "T1481",
          "name": "Web Service",
          "display_name": "T1481 - Web Service"
        },
        {
          "id": "T1534",
          "name": "Internal Spearphishing",
          "display_name": "T1534 - Internal Spearphishing"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1459",
          "name": "Device Unlock Code Guessing or Brute Force",
          "display_name": "T1459 - Device Unlock Code Guessing or Brute Force"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8145,
        "domain": 1389,
        "FileHash-SHA256": 1545,
        "CIDR": 2,
        "hostname": 2533,
        "FileHash-MD5": 209,
        "FileHash-SHA1": 190,
        "email": 6,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 14023,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "139 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65709475d5d03a86a11b0c87",
      "name": "http://apk.wdjcdn.com/5/9c/ - Hybrid-A Suspicious",
      "description": "",
      "modified": "2023-12-06T15:34:13.291000",
      "created": "2023-12-06T15:34:13.291000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 26,
        "FileHash-SHA1": 27,
        "FileHash-SHA256": 85,
        "domain": 35,
        "URL": 235,
        "hostname": 16
      },
      "indicator_count": 424,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570946d73716a30cdfcc2c4",
      "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
      "description": "",
      "modified": "2023-12-06T15:34:05.864000",
      "created": "2023-12-06T15:34:05.864000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 1853,
        "hostname": 563,
        "URL": 1230,
        "domain": 195,
        "FileHash-MD5": 31,
        "FileHash-SHA1": 15
      },
      "indicator_count": 3888,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570946a8cfe788ecc4b0a79",
      "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
      "description": "",
      "modified": "2023-12-06T15:34:02.331000",
      "created": "2023-12-06T15:34:02.331000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 1865,
        "hostname": 600,
        "URL": 1330,
        "domain": 213,
        "FileHash-MD5": 42,
        "FileHash-SHA1": 26
      },
      "indicator_count": 4077,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708fd16e0eec6ed07a100b",
      "name": "analysis for 'https://rnetcontents.com/' - CVE-2021-22941",
      "description": "",
      "modified": "2023-12-06T15:14:25.718000",
      "created": "2023-12-06T15:14:25.718000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 122,
        "hostname": 67,
        "URL": 354,
        "domain": 58,
        "email": 2,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 36
      },
      "indicator_count": 682,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6382dda475c0d772f1d03c7f",
      "name": "http://apk.wdjcdn.com/5/9c/ - Hybrid-A Suspicious",
      "description": "",
      "modified": "2022-12-27T03:03:45.688000",
      "created": "2022-11-27T03:46:44.234000",
      "tags": [
        "size",
        "runtime process",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "hash seen",
        "sha1",
        "sha256",
        "localappdata",
        "submit",
        "strings",
        "hybrid",
        "general",
        "click",
        "hosts",
        "malicious",
        "suspicious"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/606158ec3c88dff5bc6f42a2d365274cbfd9e276f99716579baa57cef9da58d7/63821d0304c6b204277eb07a"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 85,
        "URL": 235,
        "hostname": 16,
        "domain": 35,
        "FileHash-MD5": 26,
        "FileHash-SHA1": 27
      },
      "indicator_count": 424,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 393,
      "modified_text": "1251 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "638215ed0dd1e3c9ad89133e",
      "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
      "description": "",
      "modified": "2022-12-26T13:03:37.522000",
      "created": "2022-11-26T13:34:37.426000",
      "tags": [
        "windows nt",
        "united",
        "date",
        "flag",
        "osint",
        "china china",
        "size",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "strings",
        "april",
        "hybrid",
        "malicious",
        "suspicious",
        "general",
        "click",
        "hosts",
        "path"
      ],
      "references": [
        "https://www.virustotal.com/gui/domain/arms-retcode.aliyuncs.com/relations",
        "https://www.virustotal.com/graph/g6e343036222d4be1888ba1165e41e4a8ef55e8add1304460bd3824ddf295d65e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1342,
        "hostname": 614,
        "FileHash-SHA256": 1866,
        "domain": 215,
        "CVE": 1,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 27
      },
      "indicator_count": 4108,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 395,
      "modified_text": "1252 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "638215f174ccf184b5ec48a4",
      "name": "a.map.com - many nit updated ntp.org urls - cobaltstrike c2 -",
      "description": "",
      "modified": "2022-12-26T13:03:37.522000",
      "created": "2022-11-26T13:34:41.401000",
      "tags": [
        "windows nt",
        "united",
        "date",
        "flag",
        "osint",
        "china china",
        "size",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "strings",
        "april",
        "hybrid",
        "malicious",
        "suspicious",
        "general",
        "click",
        "hosts",
        "path"
      ],
      "references": [
        "https://www.virustotal.com/gui/domain/arms-retcode.aliyuncs.com/relations",
        "https://www.virustotal.com/graph/g6e343036222d4be1888ba1165e41e4a8ef55e8add1304460bd3824ddf295d65e"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1230,
        "hostname": 563,
        "FileHash-SHA256": 1853,
        "domain": 195,
        "CVE": 1,
        "FileHash-MD5": 31,
        "FileHash-SHA1": 15
      },
      "indicator_count": 3888,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 397,
      "modified_text": "1252 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62ba1520a930af9596f24745",
      "name": "analysis for 'https://rnetcontents.com/' - CVE-2021-22941",
      "description": "",
      "modified": "2022-07-27T00:02:05.219000",
      "created": "2022-06-27T20:37:52.947000",
      "tags": [
        "trojan",
        "apt",
        "unicode",
        "pcap",
        "mozilla",
        "team",
        "february",
        "streams hash",
        "CVE-2021-22941"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/dd9a0e915401c09fb975e0a474b144178bec3f27923f975901059feeb7ba7347/62b9ff31a0693042a621ff56",
        "https://hybrid-analysis.com/sample/663c712eec158b857ddb4cb79bfaa88a261daadb45fbb84246ee528f0150de19/62ba0f7d981e6308af5aba59",
        "CVE-2021-22941"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 354,
        "hostname": 67,
        "FileHash-SHA256": 122,
        "domain": 58,
        "FileHash-MD5": 43,
        "FileHash-SHA1": 36,
        "email": 2
      },
      "indicator_count": 682,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 392,
      "modified_text": "1404 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://nc-dl.wdjcdn.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://nc-dl.wdjcdn.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780271385.0193474
}