{
  "type": "URL",
  "indicator": "https://nerds.technology/pages/en/domains.html",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://nerds.technology/pages/en/domains.html",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2862082543,
      "indicator": "https://nerds.technology/pages/en/domains.html",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "665ec0cfd110b0694c51fbe2",
          "name": "Eset - Dorkbot",
          "description": "Dorkbot a self-propagating program that can spread itself from one computer to another threatening to perform numerous f actions of a malicious hacker's choice on PC. Found on an updated windows machine. Hacker named  machine, installed apple viewing software programs, partitioned 'zombie' machine.  Network of compromised, sketchy remote transfer agents of a professional in the service industry.  Serious impact on or companies impact on remote workers contracted by company in question due to the abrupt cessation of business of a recognized brand it's industry. Unfortunately, the documentation of this Eset programs behavior has been misplaced. From recall. this install identified and allowed threats, d. It was a weird see with the names eye experience. Incoming request/ Remote operators, disallowed many transactions and other basic use of software. Workers potentially working a database from individuals whose PII & PHI was leaked.",
          "modified": "2024-07-04T06:01:28.799000",
          "created": "2024-06-04T07:22:55.572000",
          "tags": [
            "historical ssl",
            "referrer",
            "algorithm",
            "v3 serial",
            "number",
            "cus cnamazon",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "first",
            "server",
            "registrar abuse",
            "date",
            "csl computer",
            "gmbh dba",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "contact email",
            "code",
            "united",
            "unknown",
            "aaaa",
            "as14061",
            "cname",
            "search",
            "emails",
            "dnssec",
            "showing",
            "win32",
            "title error",
            "passive dns",
            "open ports",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "body",
            "dns replication",
            "domain",
            "lookups",
            "email",
            "name server",
            "slovensko",
            "tech contact",
            "valid",
            "admin contact",
            "a domains",
            "a li",
            "span h3",
            "header link",
            "option option",
            "united kingdom",
            "test",
            "april",
            "meta",
            "paris",
            "eset",
            "yara detections",
            "nod32",
            "amon",
            "internalname",
            "online payment",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "amz cf",
            "creation date",
            "record value",
            "expiration date",
            "name servers",
            "servers",
            "status",
            "next",
            "asnone united",
            "moved",
            "certificate",
            "ipv4",
            "urls",
            "files",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "cf2a",
            "xaax04x00",
            "high",
            "dns reply",
            "noip domain",
            "et trojan",
            "createsuspended",
            "malware traffic",
            "dorkbot",
            "malware",
            "copy",
            "name verdict",
            "falcon sandbox",
            "windows nt",
            "appdata",
            "png image",
            "pattern match",
            "indicator",
            "ascii text",
            "rgba",
            "get collect",
            "vj98",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "path",
            "ms windows",
            "pe32",
            "intel",
            "microsoft asf",
            "pe32 executable",
            "database",
            "english",
            "installer",
            "template",
            "tue jun",
            "service",
            "crlf line",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "tip"
          ],
          "references": [
            "bpp.eset.com",
            "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
            "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
            "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
            "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
            "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
            "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
            "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
            "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
            "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
            "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
            "appleremotesupport.com | http://thickapple.net/index.php",
            "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
            "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
            "https://appleid-verify.servecounterstrike.com/",
            "http://schoolgirl.uxxxporn.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:GenMalicious-KAG\\ [Trj]",
              "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
              "target": null
            },
            {
              "id": ",  Win.Trojan.Agent-1286703",
              "display_name": ",  Win.Trojan.Agent-1286703",
              "target": null
            },
            {
              "id": "Trojan:Win32/DorkBot.DU",
              "display_name": "Trojan:Win32/DorkBot.DU",
              "target": "/malware/Trojan:Win32/DorkBot.DU"
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win.Trojan.Cosmu-1058",
              "display_name": "Win.Trojan.Cosmu-1058",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [
            "Finance",
            "Healthcare",
            "Telecommunications",
            "Technology"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 758,
            "FileHash-SHA1": 478,
            "FileHash-SHA256": 2561,
            "URL": 8210,
            "domain": 2202,
            "hostname": 2760,
            "email": 22,
            "CVE": 3
          },
          "indicator_count": 16994,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 235,
          "modified_text": "699 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6650751b8dd6c7d00f0d7478",
          "name": "ET INFO Terse | Apple | Win.Trojan.Zbot-6598057-0",
          "description": "Tags, results generated by Level Blue OTX. AlienVault\nMy limited research results: \nApple | CIDR\n17.0.0.0/8\nFileHash-SHA256 d9ff17dd19a01ad64a77df6837e566319d16a235ac7223b9f565f470e57154c8 | Antivirus Detections\nWin32:Dropper-gen, Adware.Xadupi.B, Mirai, Win.Trojan.Zbot-6598057-0,\na variant of Win32/ELEX.IE potentially unwanted, Adware.Xadupi.B, Artemis!69E9EFD2E75E\nIDS Detections:\nET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile.\nYara Detections: dbgdetect_funcs,\nAlerts: injection_runpe,\nnetwork_icmp,\nallocates_execute_remote_process,\npersistence_autorun,\ncreates_service,\ninjection_modifies_memory,\ninjection_write_memory,\nprocess_martian,\nransomware_extensions,\nransomware_mass_file_delete",
          "modified": "2024-06-23T10:00:24.005000",
          "created": "2024-05-24T11:08:10.044000",
          "tags": [
            "technology",
            "apple computer",
            "dns replication",
            "date",
            "domain",
            "lookups",
            "city",
            "apple abuse",
            "orgid",
            "rtechhandle",
            "june",
            "threat roundup",
            "triad",
            "usps",
            "us citizens",
            "data theft",
            "august",
            "apple",
            "sweet quadreams",
            "spyware vendor",
            "get http",
            "png image",
            "rgba",
            "ms windows",
            "united",
            "intel",
            "windows nt",
            "as16509",
            "pe32",
            "crlf line",
            "win32",
            "write",
            "next",
            "artemis",
            "malware",
            "copy",
            "cname",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "urls",
            "pagewritecopy",
            "pageexecuteread",
            "nx00xffxe2",
            "nx00xc7d",
            "memcommit",
            "pagenoaccess",
            "memreserve",
            "service",
            "high process",
            "injection t1055"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1524,
            "CIDR": 1,
            "URL": 5189,
            "email": 2,
            "hostname": 867,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 27,
            "domain": 403
          },
          "indicator_count": 8130,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "710 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66507a6eb3fde0552a6ebd9d",
          "name": "Sweet QuaDreams Apple | Hostile Spy campaign | Service modifier (Updated) ",
          "description": "",
          "modified": "2024-06-23T10:00:24.005000",
          "created": "2024-05-24T11:30:54.138000",
          "tags": [
            "technology",
            "apple computer",
            "dns replication",
            "date",
            "domain",
            "lookups",
            "city",
            "apple abuse",
            "orgid",
            "rtechhandle",
            "june",
            "threat roundup",
            "triad",
            "usps",
            "us citizens",
            "data theft",
            "august",
            "apple",
            "sweet quadreams",
            "spyware vendor",
            "get http",
            "png image",
            "rgba",
            "ms windows",
            "united",
            "intel",
            "windows nt",
            "as16509",
            "pe32",
            "crlf line",
            "win32",
            "write",
            "next",
            "artemis",
            "malware",
            "copy",
            "cname",
            "unknown",
            "passive dns",
            "scan endpoints",
            "all scoreblue",
            "pulse submit",
            "url analysis",
            "urls",
            "pagewritecopy",
            "pageexecuteread",
            "nx00xffxe2",
            "nx00xc7d",
            "memcommit",
            "pagenoaccess",
            "memreserve",
            "service",
            "high process",
            "injection t1055"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6650751b8dd6c7d00f0d7478",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1524,
            "CIDR": 1,
            "URL": 5189,
            "email": 2,
            "hostname": 867,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 27,
            "domain": 403
          },
          "indicator_count": 8130,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "710 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708f1d9c1be22930c7a9ca",
          "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host",
          "description": "",
          "modified": "2023-12-06T15:11:25.389000",
          "created": "2023-12-06T15:11:25.389000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1341,
            "CVE": 1,
            "FileHash-SHA256": 3239,
            "domain": 1303,
            "URL": 8470,
            "FileHash-MD5": 893,
            "FileHash-SHA1": 795
          },
          "indicator_count": 16042,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "910 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707f519ef27fa72eb62598",
          "name": "CambridgeAnalytica.org",
          "description": "",
          "modified": "2023-12-06T14:04:01.301000",
          "created": "2023-12-06T14:04:01.301000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 335,
            "URL": 13379,
            "hostname": 2501,
            "domain": 1501,
            "FileHash-SHA1": 15
          },
          "indicator_count": 17731,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "910 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6294d3c37b2f4fd77a5ca483",
          "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host",
          "description": "Twitter's link shortner from original tweet\nhttps://t.co/1Snx7jYTvZ posted by itspmagazine How many #ransomware predictions by \n@cylanceinc's  have/will come true?  maybe this adware camp is utilising older podcasts and audio to exfil data.  Its taken two days to do this pulse and its far from complete given the original had over 22k indicators",
          "modified": "2022-06-29T00:00:46.963000",
          "created": "2022-05-30T14:25:07.820000",
          "tags": [
            "www.quantic-systems.com",
            "https://itspmagazine.com/from-the-newsroom/ransomware-prediction",
            "https://t.co/1Snx7jYTvZ"
          ],
          "references": [
            "ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac 2.json",
            "https://www.virustotal.com/graph/ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac",
            "https://mobile.twitter.com/Quantic_Systems/with_replies",
            "https://mobile.twitter.com/ITSPmagazine/status/810428296995274752",
            "https://t.co/1Snx7jYTvZ",
            "How many #ransomware predictions by  @cylanceinc 's",
            "https://docplayer.net/56678996-The-cyber-defense-review.html",
            "https://itspmagazine.com/from-the-newsroom/ransomware-predictions-past-present-future-future",
            "www.quantic-systems.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3239,
            "hostname": 1341,
            "URL": 8470,
            "domain": 1303,
            "CVE": 1,
            "FileHash-MD5": 893,
            "FileHash-SHA1": 795
          },
          "indicator_count": 16042,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 395,
          "modified_text": "1435 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "621927dd57ee9ed86aeb9cb4",
          "name": "CambridgeAnalytica.org",
          "description": "",
          "modified": "2022-03-27T00:00:39.057000",
          "created": "2022-02-25T19:02:53.023000",
          "tags": [
            "win32 exe",
            "scott hanselman",
            "win32 dll",
            "llc creation",
            "date",
            "passive dns",
            "subdomains",
            "detections type",
            "name",
            "rich text",
            "format",
            "music",
            "first"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 13379,
            "hostname": 2501,
            "domain": 1501,
            "FileHash-SHA256": 335,
            "FileHash-SHA1": 15
          },
          "indicator_count": 17731,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 405,
          "modified_text": "1529 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "How many #ransomware predictions by  @cylanceinc 's",
        "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
        "https://appleid-verify.servecounterstrike.com/",
        "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
        "https://t.co/1Snx7jYTvZ",
        "https://www.virustotal.com/graph/ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac",
        "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
        "https://itspmagazine.com/from-the-newsroom/ransomware-predictions-past-present-future-future",
        "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
        "bpp.eset.com",
        "http://schoolgirl.uxxxporn.com",
        "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
        "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
        "https://mobile.twitter.com/ITSPmagazine/status/810428296995274752",
        "www.quantic-systems.com",
        "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
        "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
        "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
        "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
        "https://mobile.twitter.com/Quantic_Systems/with_replies",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
        "https://docplayer.net/56678996-The-cyber-defense-review.html",
        "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
        "appleremotesupport.com | http://thickapple.net/index.php",
        "ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac 2.json"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Win32:malware-gen",
            ",  win.trojan.agent-1286703",
            "Trojan:win32/zombie.a",
            "Win.trojan.cosmu-1058",
            "Win32:genmalicious-kag\\ [trj]",
            "Trojan:win32/dorkbot.du"
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Healthcare",
            "Finance"
          ],
          "unique_indicators": 58813
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/nerds.technology",
    "whois": "http://whois.domaintools.com/nerds.technology",
    "domain": "nerds.technology",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "665ec0cfd110b0694c51fbe2",
      "name": "Eset - Dorkbot",
      "description": "Dorkbot a self-propagating program that can spread itself from one computer to another threatening to perform numerous f actions of a malicious hacker's choice on PC. Found on an updated windows machine. Hacker named  machine, installed apple viewing software programs, partitioned 'zombie' machine.  Network of compromised, sketchy remote transfer agents of a professional in the service industry.  Serious impact on or companies impact on remote workers contracted by company in question due to the abrupt cessation of business of a recognized brand it's industry. Unfortunately, the documentation of this Eset programs behavior has been misplaced. From recall. this install identified and allowed threats, d. It was a weird see with the names eye experience. Incoming request/ Remote operators, disallowed many transactions and other basic use of software. Workers potentially working a database from individuals whose PII & PHI was leaked.",
      "modified": "2024-07-04T06:01:28.799000",
      "created": "2024-06-04T07:22:55.572000",
      "tags": [
        "historical ssl",
        "referrer",
        "algorithm",
        "v3 serial",
        "number",
        "cus cnamazon",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "first",
        "server",
        "registrar abuse",
        "date",
        "csl computer",
        "gmbh dba",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "contact email",
        "code",
        "united",
        "unknown",
        "aaaa",
        "as14061",
        "cname",
        "search",
        "emails",
        "dnssec",
        "showing",
        "win32",
        "title error",
        "passive dns",
        "open ports",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "body",
        "dns replication",
        "domain",
        "lookups",
        "email",
        "name server",
        "slovensko",
        "tech contact",
        "valid",
        "admin contact",
        "a domains",
        "a li",
        "span h3",
        "header link",
        "option option",
        "united kingdom",
        "test",
        "april",
        "meta",
        "paris",
        "eset",
        "yara detections",
        "nod32",
        "amon",
        "internalname",
        "online payment",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "amz cf",
        "creation date",
        "record value",
        "expiration date",
        "name servers",
        "servers",
        "status",
        "next",
        "asnone united",
        "moved",
        "certificate",
        "ipv4",
        "urls",
        "files",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "cf2a",
        "xaax04x00",
        "high",
        "dns reply",
        "noip domain",
        "et trojan",
        "createsuspended",
        "malware traffic",
        "dorkbot",
        "malware",
        "copy",
        "name verdict",
        "falcon sandbox",
        "windows nt",
        "appdata",
        "png image",
        "pattern match",
        "indicator",
        "ascii text",
        "rgba",
        "get collect",
        "vj98",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "path",
        "ms windows",
        "pe32",
        "intel",
        "microsoft asf",
        "pe32 executable",
        "database",
        "english",
        "installer",
        "template",
        "tue jun",
        "service",
        "crlf line",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "tip"
      ],
      "references": [
        "bpp.eset.com",
        "IDS Detections: Win32/IRCBrute/Floder.ej/TKcik.A Checkin Dorkbot GeoIP Lookup to wipmania DNS Reply Sinkhole Microsoft NO-IP",
        "IDS Detections: Domain Win32/IRCBrute/Floder.ej/TKcik.A Pass Checkin External IP Lookup Attempt To Wipmania Suspicious Mozilla User-Agent - Likely Fake",
        "High Priority Alerts: nids_malware_alert injection_runpe network_icmp dumped_buffer2 network_irc nolookup_communication",
        "High Priority Alerts: allocates_execute_remote_process persistence_autorun injection_createremotethread injection_modifies_memory",
        "High Priority Alerts: injection_write_memory injection_write_memory_exe modifies_proxy_wpad injection_ntsetcontextthread injection_resumethread dumped_buffer network_http nids_alert suspicious_tld allocates_rwx .",
        "IP\u2019s Contacted: 172.217.14.226  172.217.14.234  162.217.99.134  204.95.99.243  212.83.168.196  216.58.193.67  216.58.217.42  99.86.38.99",
        "Domains Contacted: n.jntbxduhz.ru n.yqqufklho.ru n.lotys.ru api.wipmania.com n.vbemnggcj.ru n.hmiblgoja.ru dns.msftncsi.com n.ezjhyxxbf.ru",
        "https://otx.alienvault.com/indicator/file/8ad6f89c763315bf59bc3619139f8478f6bcc57d902123c8b5c413f251ff8778",
        "Alerts: dead_host network_icmp nolookup_communication packer_polymorphic origin_langid peid_packer",
        "https://healthinsurancecompanion.com/affordable-health-insurance?Landing_Page=https://healthinsurancecompanion.com/affordable-health-insurance&SRC=iDr_E",
        "appleremotesupport.com | http://thickapple.net/index.php",
        "https://normalexchange.com/v/155e44b6-11dc-11e8-9dff-01407350b0f6/c/1e289258-e09c-11e5-bea8-021988c520a1/?clickid=9023100005531544085-201802-3",
        "https://asserts.turbovpn.co/web/images/download/icons/apple-icon.png",
        "https://appleid-verify.servecounterstrike.com/",
        "http://schoolgirl.uxxxporn.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:GenMalicious-KAG\\ [Trj]",
          "display_name": "Win32:GenMalicious-KAG\\ [Trj]",
          "target": null
        },
        {
          "id": ",  Win.Trojan.Agent-1286703",
          "display_name": ",  Win.Trojan.Agent-1286703",
          "target": null
        },
        {
          "id": "Trojan:Win32/DorkBot.DU",
          "display_name": "Trojan:Win32/DorkBot.DU",
          "target": "/malware/Trojan:Win32/DorkBot.DU"
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win.Trojan.Cosmu-1058",
          "display_name": "Win.Trojan.Cosmu-1058",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        }
      ],
      "industries": [
        "Finance",
        "Healthcare",
        "Telecommunications",
        "Technology"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 32,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 758,
        "FileHash-SHA1": 478,
        "FileHash-SHA256": 2561,
        "URL": 8210,
        "domain": 2202,
        "hostname": 2760,
        "email": 22,
        "CVE": 3
      },
      "indicator_count": 16994,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 235,
      "modified_text": "699 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6650751b8dd6c7d00f0d7478",
      "name": "ET INFO Terse | Apple | Win.Trojan.Zbot-6598057-0",
      "description": "Tags, results generated by Level Blue OTX. AlienVault\nMy limited research results: \nApple | CIDR\n17.0.0.0/8\nFileHash-SHA256 d9ff17dd19a01ad64a77df6837e566319d16a235ac7223b9f565f470e57154c8 | Antivirus Detections\nWin32:Dropper-gen, Adware.Xadupi.B, Mirai, Win.Trojan.Zbot-6598057-0,\na variant of Win32/ELEX.IE potentially unwanted, Adware.Xadupi.B, Artemis!69E9EFD2E75E\nIDS Detections:\nET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile.\nYara Detections: dbgdetect_funcs,\nAlerts: injection_runpe,\nnetwork_icmp,\nallocates_execute_remote_process,\npersistence_autorun,\ncreates_service,\ninjection_modifies_memory,\ninjection_write_memory,\nprocess_martian,\nransomware_extensions,\nransomware_mass_file_delete",
      "modified": "2024-06-23T10:00:24.005000",
      "created": "2024-05-24T11:08:10.044000",
      "tags": [
        "technology",
        "apple computer",
        "dns replication",
        "date",
        "domain",
        "lookups",
        "city",
        "apple abuse",
        "orgid",
        "rtechhandle",
        "june",
        "threat roundup",
        "triad",
        "usps",
        "us citizens",
        "data theft",
        "august",
        "apple",
        "sweet quadreams",
        "spyware vendor",
        "get http",
        "png image",
        "rgba",
        "ms windows",
        "united",
        "intel",
        "windows nt",
        "as16509",
        "pe32",
        "crlf line",
        "win32",
        "write",
        "next",
        "artemis",
        "malware",
        "copy",
        "cname",
        "unknown",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "urls",
        "pagewritecopy",
        "pageexecuteread",
        "nx00xffxe2",
        "nx00xc7d",
        "memcommit",
        "pagenoaccess",
        "memreserve",
        "service",
        "high process",
        "injection t1055"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1524,
        "CIDR": 1,
        "URL": 5189,
        "email": 2,
        "hostname": 867,
        "FileHash-MD5": 117,
        "FileHash-SHA1": 27,
        "domain": 403
      },
      "indicator_count": 8130,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "710 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66507a6eb3fde0552a6ebd9d",
      "name": "Sweet QuaDreams Apple | Hostile Spy campaign | Service modifier (Updated) ",
      "description": "",
      "modified": "2024-06-23T10:00:24.005000",
      "created": "2024-05-24T11:30:54.138000",
      "tags": [
        "technology",
        "apple computer",
        "dns replication",
        "date",
        "domain",
        "lookups",
        "city",
        "apple abuse",
        "orgid",
        "rtechhandle",
        "june",
        "threat roundup",
        "triad",
        "usps",
        "us citizens",
        "data theft",
        "august",
        "apple",
        "sweet quadreams",
        "spyware vendor",
        "get http",
        "png image",
        "rgba",
        "ms windows",
        "united",
        "intel",
        "windows nt",
        "as16509",
        "pe32",
        "crlf line",
        "win32",
        "write",
        "next",
        "artemis",
        "malware",
        "copy",
        "cname",
        "unknown",
        "passive dns",
        "scan endpoints",
        "all scoreblue",
        "pulse submit",
        "url analysis",
        "urls",
        "pagewritecopy",
        "pageexecuteread",
        "nx00xffxe2",
        "nx00xc7d",
        "memcommit",
        "pagenoaccess",
        "memreserve",
        "service",
        "high process",
        "injection t1055"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6650751b8dd6c7d00f0d7478",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1524,
        "CIDR": 1,
        "URL": 5189,
        "email": 2,
        "hostname": 867,
        "FileHash-MD5": 117,
        "FileHash-SHA1": 27,
        "domain": 403
      },
      "indicator_count": 8130,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "710 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708f1d9c1be22930c7a9ca",
      "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host",
      "description": "",
      "modified": "2023-12-06T15:11:25.389000",
      "created": "2023-12-06T15:11:25.389000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1341,
        "CVE": 1,
        "FileHash-SHA256": 3239,
        "domain": 1303,
        "URL": 8470,
        "FileHash-MD5": 893,
        "FileHash-SHA1": 795
      },
      "indicator_count": 16042,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "910 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707f519ef27fa72eb62598",
      "name": "CambridgeAnalytica.org",
      "description": "",
      "modified": "2023-12-06T14:04:01.301000",
      "created": "2023-12-06T14:04:01.301000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 335,
        "URL": 13379,
        "hostname": 2501,
        "domain": 1501,
        "FileHash-SHA1": 15
      },
      "indicator_count": 17731,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "910 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6294d3c37b2f4fd77a5ca483",
      "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host",
      "description": "Twitter's link shortner from original tweet\nhttps://t.co/1Snx7jYTvZ posted by itspmagazine How many #ransomware predictions by \n@cylanceinc's  have/will come true?  maybe this adware camp is utilising older podcasts and audio to exfil data.  Its taken two days to do this pulse and its far from complete given the original had over 22k indicators",
      "modified": "2022-06-29T00:00:46.963000",
      "created": "2022-05-30T14:25:07.820000",
      "tags": [
        "www.quantic-systems.com",
        "https://itspmagazine.com/from-the-newsroom/ransomware-prediction",
        "https://t.co/1Snx7jYTvZ"
      ],
      "references": [
        "ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac 2.json",
        "https://www.virustotal.com/graph/ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac",
        "https://mobile.twitter.com/Quantic_Systems/with_replies",
        "https://mobile.twitter.com/ITSPmagazine/status/810428296995274752",
        "https://t.co/1Snx7jYTvZ",
        "How many #ransomware predictions by  @cylanceinc 's",
        "https://docplayer.net/56678996-The-cyber-defense-review.html",
        "https://itspmagazine.com/from-the-newsroom/ransomware-predictions-past-present-future-future",
        "www.quantic-systems.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 3239,
        "hostname": 1341,
        "URL": 8470,
        "domain": 1303,
        "CVE": 1,
        "FileHash-MD5": 893,
        "FileHash-SHA1": 795
      },
      "indicator_count": 16042,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 395,
      "modified_text": "1435 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "621927dd57ee9ed86aeb9cb4",
      "name": "CambridgeAnalytica.org",
      "description": "",
      "modified": "2022-03-27T00:00:39.057000",
      "created": "2022-02-25T19:02:53.023000",
      "tags": [
        "win32 exe",
        "scott hanselman",
        "win32 dll",
        "llc creation",
        "date",
        "passive dns",
        "subdomains",
        "detections type",
        "name",
        "rich text",
        "format",
        "music",
        "first"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 13379,
        "hostname": 2501,
        "domain": 1501,
        "FileHash-SHA256": 335,
        "FileHash-SHA1": 15
      },
      "indicator_count": 17731,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 405,
      "modified_text": "1529 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://nerds.technology/pages/en/domains.html",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://nerds.technology/pages/en/domains.html",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780513854.2034287
}