{
  "type": "URL",
  "indicator": "https://ns-1006.awsdns-61.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns-1006.awsdns-61.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 2983567914,
      "indicator": "https://ns-1006.awsdns-61.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 12,
      "pulses": [
        {
          "id": "6608aaf7ca0e965e593ed1d4",
          "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e",
          "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.",
          "modified": "2025-10-17T11:03:07.034000",
          "created": "2024-03-31T00:14:47.183000",
          "tags": [
            "sha256",
            "ssdeep",
            "reputacja",
            "tworzy pliki",
            "informacje",
            "bardzo duga",
            "tworzy",
            "adresy url",
            "tworzy katalog",
            "win64",
            "ameryki",
            "typ pliku",
            "serwer nazw",
            "san jose",
            "adres",
            "digital",
            "data wyganicia",
            "csc corporate",
            "domains",
            "ca data",
            "data utworzenia",
            "dnssec"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6432,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2140,
            "hostname": 5874,
            "FileHash-SHA256": 12539,
            "FileHash-MD5": 3686,
            "FileHash-SHA1": 2751,
            "IPv4": 503,
            "URL": 10770,
            "email": 26,
            "CVE": 88,
            "YARA": 6,
            "JA3": 2,
            "IPv6": 28,
            "SSLCertFingerprint": 5,
            "BitcoinAddress": 3,
            "CIDR": 1
          },
          "indicator_count": 38422,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "184 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6894f30905efa56990bb10f6",
          "name": "Expanded device-local-****remotewd.com",
          "description": "device-local-2ffdbd74-9f90-41fa-beb8-454ed65788c5.remotewd.com",
          "modified": "2025-09-06T06:03:31.462000",
          "created": "2025-08-07T18:40:09.876000",
          "tags": [
            "hostname",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "nameservers",
            "date hash",
            "avast avg",
            "entries",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "itre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "domain",
            "hostname add",
            "files ip",
            "address",
            "location united",
            "hash avast",
            "avg clamav",
            "msdefender aug",
            "united",
            "port",
            "destination",
            "as16509",
            "search",
            "unknown",
            "ocloudflare",
            "medium",
            "memcommit",
            "service",
            "write",
            "next",
            "persistence",
            "execution",
            "malware",
            "copy",
            "encrypt",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "next associated",
            "urls show",
            "date checked",
            "virtool",
            "win64",
            "worm",
            "mtb may",
            "files show",
            "heur",
            "script",
            "dropper",
            "ransom",
            "vitro",
            "pe32",
            "intel",
            "ms windows",
            "as15169",
            "read c",
            "asnone",
            "show",
            "packing t1045",
            "t1045",
            "delphi",
            "code",
            "june"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6741,
            "domain": 5822,
            "FileHash-SHA256": 1550,
            "URL": 16348,
            "FileHash-MD5": 287,
            "FileHash-SHA1": 242,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 31000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6894f4e6c41982f405592b55",
          "name": "Worm:Win32/Mydoom | Expanded device-local-****remotewd.com",
          "description": "",
          "modified": "2025-09-06T06:03:31.462000",
          "created": "2025-08-07T18:48:06.557000",
          "tags": [
            "hostname",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "nameservers",
            "date hash",
            "avast avg",
            "entries",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "itre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "mitre att",
            "pattern match",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "domain",
            "hostname add",
            "files ip",
            "address",
            "location united",
            "hash avast",
            "avg clamav",
            "msdefender aug",
            "united",
            "port",
            "destination",
            "as16509",
            "search",
            "unknown",
            "ocloudflare",
            "medium",
            "memcommit",
            "service",
            "write",
            "next",
            "persistence",
            "execution",
            "malware",
            "copy",
            "encrypt",
            "win32",
            "mtb feb",
            "trojan",
            "susp",
            "trojandropper",
            "msr feb",
            "trojanspy",
            "next associated",
            "urls show",
            "date checked",
            "virtool",
            "win64",
            "worm",
            "mtb may",
            "files show",
            "heur",
            "script",
            "dropper",
            "ransom",
            "vitro",
            "pe32",
            "intel",
            "ms windows",
            "as15169",
            "read c",
            "asnone",
            "show",
            "packing t1045",
            "t1045",
            "delphi",
            "code",
            "june"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6894f30905efa56990bb10f6",
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6741,
            "domain": 5822,
            "FileHash-SHA256": 1550,
            "URL": 16348,
            "FileHash-MD5": 287,
            "FileHash-SHA1": 242,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 31000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "662edc10a9158fb6cbe169ee",
          "name": "pulse2",
          "description": "",
          "modified": "2024-05-28T00:05:10.890000",
          "created": "2024-04-28T23:30:24.222000",
          "tags": [
            "sha256",
            "ssdeep",
            "reputacja",
            "tworzy pliki",
            "informacje",
            "bardzo duga",
            "tworzy",
            "adresy url",
            "tworzy katalog",
            "win64",
            "ameryki",
            "typ pliku",
            "serwer nazw",
            "san jose",
            "adres",
            "digital",
            "data wyganicia",
            "csc corporate",
            "domains",
            "ca data",
            "data utworzenia",
            "dnssec"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6608aaf7ca0e965e593ed1d4",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Mina_Miss",
            "id": "280300",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1212,
            "hostname": 3156,
            "FileHash-SHA256": 4928,
            "FileHash-MD5": 1215,
            "FileHash-SHA1": 1123,
            "IPv4": 297,
            "URL": 6066,
            "email": 8,
            "CVE": 62,
            "YARA": 1,
            "JA3": 1,
            "IPv6": 27,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 18099,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 24,
          "modified_text": "691 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b2909ffdc623904cbfd91d",
          "name": "PEXE - DOS executable (COM)",
          "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-25T16:47:26.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757a662a146889c60b6c",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:10.970000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4757d6dd7dae344aed3f5",
          "name": "PEXE - DOS executable (COM)",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-27T03:16:13.209000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b2909ffdc623904cbfd91d",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85dca7d8bf0aea33abc3a",
          "name": "PEXE - DOS executable ",
          "description": "",
          "modified": "2024-02-24T16:01:22.095000",
          "created": "2024-01-30T02:24:10.454000",
          "tags": [
            "network_icmp",
            "sha256",
            "yara detections",
            "alerts",
            "icmp traffic",
            "scan endpoints",
            "all scoreblue",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "spain unknown",
            "search",
            "date",
            "status",
            "passive dns",
            "urls",
            "pulse submit",
            "url analysis",
            "files",
            "domain",
            "next",
            "as197068 hll",
            "russia unknown",
            "ipv4",
            "body",
            "alive",
            "belarus unknown",
            "aaaa",
            "moved",
            "domain names",
            "creation date",
            "record value",
            "expiration date",
            "a domains",
            "facebook",
            "twitter",
            "encrypt",
            "httponly",
            "url http",
            "http",
            "ip address",
            "related nids",
            "germany unknown",
            "united",
            "as3320 deutsche",
            "france unknown",
            "united kingdom",
            "italy unknown",
            "as7922 comcast",
            "as701 verizon",
            "as3209 vodafone",
            "china unknown",
            "unknown",
            "as44273 host",
            "msie",
            "chrome",
            "name servers",
            "hostname",
            "maxage86400",
            "ip asn",
            "maxage2592000",
            "gmt server",
            "amazons3",
            "unique",
            "as58061 scalaxy",
            "all search",
            "otx scoreblue",
            "cyprus unknown",
            "as26347",
            "customer",
            "entries",
            "sexkompas",
            "script urls",
            "meta",
            "as29182 jsc",
            "gmt content",
            "script domains",
            "gmt etag",
            "as61400",
            "screenshot",
            "apache",
            "path",
            "as59711 hz",
            "asn as59711",
            "dns resolutions",
            "non dsp",
            "cor cura",
            "url https",
            "as199386 zilore",
            "showing",
            "admitad meta",
            "as44066",
            "connection",
            "date sat",
            "server amazons3",
            "cloudfront",
            "xcache miss",
            "contentlength",
            "acceptranges",
            "server",
            "gmt expires",
            "code",
            "title error",
            "trojan",
            "body doctype",
            "html public",
            "w3cdtd html",
            "html head",
            "meta http",
            "win32",
            "as3326",
            "present jan",
            "reverse dns",
            "gmt path",
            "set cookie",
            "certificate",
            "pragma",
            "location united",
            "show",
            "medium",
            "authenticode",
            "delete",
            "productversion",
            "fileversion",
            "thawte",
            "copy",
            "malware",
            "write",
            "etpro",
            "as14061",
            "whitelisted",
            "as9009 m247",
            "paris",
            "otx telemetry",
            "for privacy",
            "redacted for",
            "dns",
            "DNSpionage",
            "apple",
            "ios",
            "global",
            "cyber threat",
            "tracking",
            "legal abuse",
            "privilege escalation",
            "network",
            "redirect",
            "exploit kit",
            "mey",
            "spyware",
            "dropper",
            "x adblock",
            "virgin islands",
            "type",
            "content length",
            "dga",
            "as3175 filanco",
            "cname",
            "thawte code",
            "as32244 liquid",
            "as24940 hetzner",
            "head body",
            "center hr",
            "gmt contenttype",
            "title",
            "registrar",
            "markmonitor",
            "internet",
            "iana",
            "nethandle",
            "net192",
            "net1920000",
            "iana special",
            "icann",
            "please refer",
            "ietf",
            "best current",
            "whois whois",
            "resolutions",
            "communicating",
            "referrer",
            "win32 exe",
            "putty",
            "java",
            "type name",
            "pe32 executable",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "info compiler",
            "products",
            "vs2005",
            "vs2008 sp1",
            "vs2008",
            "header x64",
            "name md5",
            "virtualalloc"
          ],
          "references": [
            "PEXE - DOS executable (COM)",
            "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
            "Found in: https://jbplegal.com",
            "http://sexkompas.xyz",
            "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
            "tracking2youdu.com , cdn.livechatinc.com",
            "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
            "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Netherlands",
            "China",
            "United States of America",
            "Chile",
            "Germany",
            "France"
          ],
          "malware_families": [
            {
              "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
              "target": null
            },
            {
              "id": "Win.Malware.Vtflooder-6260355-1",
              "display_name": "Win.Malware.Vtflooder-6260355-1",
              "target": null
            },
            {
              "id": "Win.Trojan.Buzus-5453",
              "display_name": "Win.Trojan.Buzus-5453",
              "target": null
            },
            {
              "id": "Win32:Malware-gen",
              "display_name": "Win32:Malware-gen",
              "target": null
            },
            {
              "id": "Win32:PWSX-gen",
              "display_name": "Win32:PWSX-gen",
              "target": null
            },
            {
              "id": "Trojan:Win32/Glupteba.MT!MTB",
              "display_name": "Trojan:Win32/Glupteba.MT!MTB",
              "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
            },
            {
              "id": "ETPRO",
              "display_name": "ETPRO",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b4757a662a146889c60b6c",
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 71,
            "FileHash-SHA256": 1690,
            "URL": 9526,
            "domain": 4882,
            "hostname": 6120,
            "email": 250,
            "CVE": 2
          },
          "indicator_count": 22694,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a9b81da64500aa609122",
          "name": "APPLE CVE",
          "description": "",
          "modified": "2023-12-06T17:04:56.966000",
          "created": "2023-12-06T17:04:56.966000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 705,
            "FileHash-MD5": 171,
            "domain": 242,
            "hostname": 361,
            "URL": 496,
            "email": 3,
            "FileHash-SHA1": 123,
            "CVE": 1,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 2106,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 114,
          "modified_text": "864 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6556878669ae5d5aa6b1a61f",
          "name": "APPLE CVE",
          "description": "",
          "modified": "2023-11-16T21:20:06.454000",
          "created": "2023-11-16T21:20:06.454000",
          "tags": [
            "scan endpoints",
            "all cve",
            "ellenmmm cve",
            "pulse pulses",
            "files",
            "exploits",
            "targeted",
            "cve overview",
            "ventura",
            "creation date",
            "impact"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "652e0a354e1ed460e652842c",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 523,
            "domain": 263,
            "hostname": 460,
            "FileHash-SHA256": 1269,
            "FileHash-MD5": 385,
            "FileHash-SHA1": 329,
            "SSLCertFingerprint": 4,
            "email": 3
          },
          "indicator_count": 3237,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "884 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652e0a354e1ed460e652842c",
          "name": "APPLE CVE",
          "description": "Apple has fixed a bug in its operating system that may cause files to be infected with malware and then be opened and downloaded without a quarantine flag being put on the file, as well as a security check.",
          "modified": "2023-11-16T16:02:38.424000",
          "created": "2023-10-17T04:14:45.289000",
          "tags": [
            "scan endpoints",
            "all cve",
            "ellenmmm cve",
            "pulse pulses",
            "files",
            "exploits",
            "targeted",
            "cve overview",
            "ventura",
            "creation date",
            "impact"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 523,
            "domain": 263,
            "hostname": 460,
            "FileHash-SHA256": 1269,
            "FileHash-MD5": 385,
            "FileHash-SHA1": 329,
            "SSLCertFingerprint": 4,
            "email": 3
          },
          "indicator_count": 3237,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 86,
          "modified_text": "884 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "627dc2b351508c06ee07883d",
          "name": "BestCoinTrust@polybest.io",
          "description": "",
          "modified": "2022-05-13T02:57:10.184000",
          "created": "2022-05-13T02:30:11.080000",
          "tags": [
            "date",
            "status",
            "passive dns",
            "urls",
            "files ip",
            "address",
            "less whois",
            "registrar",
            "creation date",
            "pulses",
            "virustotal",
            "unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "61bae37ed6f0bec920be0668",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "BestCoinTrust0x",
            "id": "192725",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 598,
            "domain": 375,
            "URL": 563,
            "FileHash-SHA256": 5,
            "email": 1
          },
          "indicator_count": 1542,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1,
          "modified_text": "1437 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "PEXE - DOS executable (COM)",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "tracking2youdu.com , cdn.livechatinc.com",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojan:win32/glupteba.mt!mtb",
            "Win.malware.vtflooder-6260355-1",
            "Win32:malware-gen",
            "Etpro",
            "Win32:pwsx-gen",
            "Win.trojan.buzus-5453",
            "Win32:injector-cvf\\ [trj]\t\twin.mal"
          ],
          "industries": [
            "Healthcare",
            "Legal",
            "Civil society"
          ],
          "unique_indicators": 92251
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/awsdns-61.net",
    "whois": "http://whois.domaintools.com/awsdns-61.net",
    "domain": "awsdns-61.net",
    "hostname": "ns-1006.awsdns-61.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 12,
  "pulses": [
    {
      "id": "6608aaf7ca0e965e593ed1d4",
      "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e",
      "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.",
      "modified": "2025-10-17T11:03:07.034000",
      "created": "2024-03-31T00:14:47.183000",
      "tags": [
        "sha256",
        "ssdeep",
        "reputacja",
        "tworzy pliki",
        "informacje",
        "bardzo duga",
        "tworzy",
        "adresy url",
        "tworzy katalog",
        "win64",
        "ameryki",
        "typ pliku",
        "serwer nazw",
        "san jose",
        "adres",
        "digital",
        "data wyganicia",
        "csc corporate",
        "domains",
        "ca data",
        "data utworzenia",
        "dnssec"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6432,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2140,
        "hostname": 5874,
        "FileHash-SHA256": 12539,
        "FileHash-MD5": 3686,
        "FileHash-SHA1": 2751,
        "IPv4": 503,
        "URL": 10770,
        "email": 26,
        "CVE": 88,
        "YARA": 6,
        "JA3": 2,
        "IPv6": 28,
        "SSLCertFingerprint": 5,
        "BitcoinAddress": 3,
        "CIDR": 1
      },
      "indicator_count": 38422,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "184 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6894f30905efa56990bb10f6",
      "name": "Expanded device-local-****remotewd.com",
      "description": "device-local-2ffdbd74-9f90-41fa-beb8-454ed65788c5.remotewd.com",
      "modified": "2025-09-06T06:03:31.462000",
      "created": "2025-08-07T18:40:09.876000",
      "tags": [
        "hostname",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "nameservers",
        "date hash",
        "avast avg",
        "entries",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "itre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "domain",
        "hostname add",
        "files ip",
        "address",
        "location united",
        "hash avast",
        "avg clamav",
        "msdefender aug",
        "united",
        "port",
        "destination",
        "as16509",
        "search",
        "unknown",
        "ocloudflare",
        "medium",
        "memcommit",
        "service",
        "write",
        "next",
        "persistence",
        "execution",
        "malware",
        "copy",
        "encrypt",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "next associated",
        "urls show",
        "date checked",
        "virtool",
        "win64",
        "worm",
        "mtb may",
        "files show",
        "heur",
        "script",
        "dropper",
        "ransom",
        "vitro",
        "pe32",
        "intel",
        "ms windows",
        "as15169",
        "read c",
        "asnone",
        "show",
        "packing t1045",
        "t1045",
        "delphi",
        "code",
        "june"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6741,
        "domain": 5822,
        "FileHash-SHA256": 1550,
        "URL": 16348,
        "FileHash-MD5": 287,
        "FileHash-SHA1": 242,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 31000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6894f4e6c41982f405592b55",
      "name": "Worm:Win32/Mydoom | Expanded device-local-****remotewd.com",
      "description": "",
      "modified": "2025-09-06T06:03:31.462000",
      "created": "2025-08-07T18:48:06.557000",
      "tags": [
        "hostname",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "nameservers",
        "date hash",
        "avast avg",
        "entries",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "itre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "mitre att",
        "pattern match",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "domain",
        "hostname add",
        "files ip",
        "address",
        "location united",
        "hash avast",
        "avg clamav",
        "msdefender aug",
        "united",
        "port",
        "destination",
        "as16509",
        "search",
        "unknown",
        "ocloudflare",
        "medium",
        "memcommit",
        "service",
        "write",
        "next",
        "persistence",
        "execution",
        "malware",
        "copy",
        "encrypt",
        "win32",
        "mtb feb",
        "trojan",
        "susp",
        "trojandropper",
        "msr feb",
        "trojanspy",
        "next associated",
        "urls show",
        "date checked",
        "virtool",
        "win64",
        "worm",
        "mtb may",
        "files show",
        "heur",
        "script",
        "dropper",
        "ransom",
        "vitro",
        "pe32",
        "intel",
        "ms windows",
        "as15169",
        "read c",
        "asnone",
        "show",
        "packing t1045",
        "t1045",
        "delphi",
        "code",
        "june"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6894f30905efa56990bb10f6",
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6741,
        "domain": 5822,
        "FileHash-SHA256": 1550,
        "URL": 16348,
        "FileHash-MD5": 287,
        "FileHash-SHA1": 242,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 31000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "662edc10a9158fb6cbe169ee",
      "name": "pulse2",
      "description": "",
      "modified": "2024-05-28T00:05:10.890000",
      "created": "2024-04-28T23:30:24.222000",
      "tags": [
        "sha256",
        "ssdeep",
        "reputacja",
        "tworzy pliki",
        "informacje",
        "bardzo duga",
        "tworzy",
        "adresy url",
        "tworzy katalog",
        "win64",
        "ameryki",
        "typ pliku",
        "serwer nazw",
        "san jose",
        "adres",
        "digital",
        "data wyganicia",
        "csc corporate",
        "domains",
        "ca data",
        "data utworzenia",
        "dnssec"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6608aaf7ca0e965e593ed1d4",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Mina_Miss",
        "id": "280300",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1212,
        "hostname": 3156,
        "FileHash-SHA256": 4928,
        "FileHash-MD5": 1215,
        "FileHash-SHA1": 1123,
        "IPv4": 297,
        "URL": 6066,
        "email": 8,
        "CVE": 62,
        "YARA": 1,
        "JA3": 1,
        "IPv6": 27,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 18099,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 24,
      "modified_text": "691 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b2909ffdc623904cbfd91d",
      "name": "PEXE - DOS executable (COM)",
      "description": "I don't have a very good description. I can say this was found in a law firms website and it's not uncommon. Certain attorneys may be under attack based on clients represented. I other instances attorneys use a tool box of malware and other cyber weaponry to track, intimidating and spy on opposition. Very aggressive tactics use. Unfortunately attacks against opponents aren't limited to \"contactless\" attacks. Tracking. cyber espionage, malvertizing, iOS 'remotwd' , location tracking, reputation abuse.",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-25T16:47:26.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757a662a146889c60b6c",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:10.970000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b4757d6dd7dae344aed3f5",
      "name": "PEXE - DOS executable (COM)",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-27T03:16:13.209000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b2909ffdc623904cbfd91d",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85dca7d8bf0aea33abc3a",
      "name": "PEXE - DOS executable ",
      "description": "",
      "modified": "2024-02-24T16:01:22.095000",
      "created": "2024-01-30T02:24:10.454000",
      "tags": [
        "network_icmp",
        "sha256",
        "yara detections",
        "alerts",
        "icmp traffic",
        "scan endpoints",
        "all scoreblue",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "spain unknown",
        "search",
        "date",
        "status",
        "passive dns",
        "urls",
        "pulse submit",
        "url analysis",
        "files",
        "domain",
        "next",
        "as197068 hll",
        "russia unknown",
        "ipv4",
        "body",
        "alive",
        "belarus unknown",
        "aaaa",
        "moved",
        "domain names",
        "creation date",
        "record value",
        "expiration date",
        "a domains",
        "facebook",
        "twitter",
        "encrypt",
        "httponly",
        "url http",
        "http",
        "ip address",
        "related nids",
        "germany unknown",
        "united",
        "as3320 deutsche",
        "france unknown",
        "united kingdom",
        "italy unknown",
        "as7922 comcast",
        "as701 verizon",
        "as3209 vodafone",
        "china unknown",
        "unknown",
        "as44273 host",
        "msie",
        "chrome",
        "name servers",
        "hostname",
        "maxage86400",
        "ip asn",
        "maxage2592000",
        "gmt server",
        "amazons3",
        "unique",
        "as58061 scalaxy",
        "all search",
        "otx scoreblue",
        "cyprus unknown",
        "as26347",
        "customer",
        "entries",
        "sexkompas",
        "script urls",
        "meta",
        "as29182 jsc",
        "gmt content",
        "script domains",
        "gmt etag",
        "as61400",
        "screenshot",
        "apache",
        "path",
        "as59711 hz",
        "asn as59711",
        "dns resolutions",
        "non dsp",
        "cor cura",
        "url https",
        "as199386 zilore",
        "showing",
        "admitad meta",
        "as44066",
        "connection",
        "date sat",
        "server amazons3",
        "cloudfront",
        "xcache miss",
        "contentlength",
        "acceptranges",
        "server",
        "gmt expires",
        "code",
        "title error",
        "trojan",
        "body doctype",
        "html public",
        "w3cdtd html",
        "html head",
        "meta http",
        "win32",
        "as3326",
        "present jan",
        "reverse dns",
        "gmt path",
        "set cookie",
        "certificate",
        "pragma",
        "location united",
        "show",
        "medium",
        "authenticode",
        "delete",
        "productversion",
        "fileversion",
        "thawte",
        "copy",
        "malware",
        "write",
        "etpro",
        "as14061",
        "whitelisted",
        "as9009 m247",
        "paris",
        "otx telemetry",
        "for privacy",
        "redacted for",
        "dns",
        "DNSpionage",
        "apple",
        "ios",
        "global",
        "cyber threat",
        "tracking",
        "legal abuse",
        "privilege escalation",
        "network",
        "redirect",
        "exploit kit",
        "mey",
        "spyware",
        "dropper",
        "x adblock",
        "virgin islands",
        "type",
        "content length",
        "dga",
        "as3175 filanco",
        "cname",
        "thawte code",
        "as32244 liquid",
        "as24940 hetzner",
        "head body",
        "center hr",
        "gmt contenttype",
        "title",
        "registrar",
        "markmonitor",
        "internet",
        "iana",
        "nethandle",
        "net192",
        "net1920000",
        "iana special",
        "icann",
        "please refer",
        "ietf",
        "best current",
        "whois whois",
        "resolutions",
        "communicating",
        "referrer",
        "win32 exe",
        "putty",
        "java",
        "type name",
        "pe32 executable",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "info compiler",
        "products",
        "vs2005",
        "vs2008 sp1",
        "vs2008",
        "header x64",
        "name md5",
        "virtualalloc"
      ],
      "references": [
        "PEXE - DOS executable (COM)",
        "redirect_keitaro_exploit_kit_compromised_site_se_referrer",
        "Found in: https://jbplegal.com",
        "http://sexkompas.xyz",
        "DGA Malware Mall Domains: hackingapple.com, video.import-apple.com, DGA- appledreamz.com",
        "tracking2youdu.com , cdn.livechatinc.com",
        "device-local-bf56eb52-6fc6-435b-aadb-9fa1dd89702c.remotewd.com | remotewd.com | 192.168.56.108",
        "http://www.mobiset.ru/photos/2011/march/15/samsung_s3850/img_9.jpg"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Netherlands",
        "China",
        "United States of America",
        "Chile",
        "Germany",
        "France"
      ],
      "malware_families": [
        {
          "id": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "display_name": "Win32:Injector-CVF\\ [Trj]\t\tWin.Mal",
          "target": null
        },
        {
          "id": "Win.Malware.Vtflooder-6260355-1",
          "display_name": "Win.Malware.Vtflooder-6260355-1",
          "target": null
        },
        {
          "id": "Win.Trojan.Buzus-5453",
          "display_name": "Win.Trojan.Buzus-5453",
          "target": null
        },
        {
          "id": "Win32:Malware-gen",
          "display_name": "Win32:Malware-gen",
          "target": null
        },
        {
          "id": "Win32:PWSX-gen",
          "display_name": "Win32:PWSX-gen",
          "target": null
        },
        {
          "id": "Trojan:Win32/Glupteba.MT!MTB",
          "display_name": "Trojan:Win32/Glupteba.MT!MTB",
          "target": "/malware/Trojan:Win32/Glupteba.MT!MTB"
        },
        {
          "id": "ETPRO",
          "display_name": "ETPRO",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b4757a662a146889c60b6c",
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 71,
        "FileHash-SHA256": 1690,
        "URL": 9526,
        "domain": 4882,
        "hostname": 6120,
        "email": 250,
        "CVE": 2
      },
      "indicator_count": 22694,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a9b81da64500aa609122",
      "name": "APPLE CVE",
      "description": "",
      "modified": "2023-12-06T17:04:56.966000",
      "created": "2023-12-06T17:04:56.966000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 705,
        "FileHash-MD5": 171,
        "domain": 242,
        "hostname": 361,
        "URL": 496,
        "email": 3,
        "FileHash-SHA1": 123,
        "CVE": 1,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 2106,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 114,
      "modified_text": "864 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6556878669ae5d5aa6b1a61f",
      "name": "APPLE CVE",
      "description": "",
      "modified": "2023-11-16T21:20:06.454000",
      "created": "2023-11-16T21:20:06.454000",
      "tags": [
        "scan endpoints",
        "all cve",
        "ellenmmm cve",
        "pulse pulses",
        "files",
        "exploits",
        "targeted",
        "cve overview",
        "ventura",
        "creation date",
        "impact"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "652e0a354e1ed460e652842c",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "URL": 523,
        "domain": 263,
        "hostname": 460,
        "FileHash-SHA256": 1269,
        "FileHash-MD5": 385,
        "FileHash-SHA1": 329,
        "SSLCertFingerprint": 4,
        "email": 3
      },
      "indicator_count": 3237,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "884 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns-1006.awsdns-61.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns-1006.awsdns-61.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776599084.1681223
}