{ "type": "URL", "indicator": "https://ns-1250.awsdns-28.org", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://ns-1250.awsdns-28.org", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3022221596, "indicator": "https://ns-1250.awsdns-28.org", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 13, "pulses": [ { "id": "69dba8a0f375964d468b9ba0", "name": "Credit: DorkingBeauty1- Charles-152.199.19.160- from scan various dupont domains- malicious- Oracle Supply Chain or Turning Blind eye", "description": "", "modified": "2026-05-12T00:09:20.348000", "created": "2026-04-12T14:13:52.560000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "data", "decrypted ssl", "windows nt", "threat level", "ecacc", "gmtetag", "date", "sha256", "pcap", "path", "accept", "back", "close", "click", "solid", "class", "flame", "splash", "verify", "direct", "suspicious", "malicious", "sybuex", "core", "agent", "code", "model", "next", "first", "phase", "impact", "trim", "hybrid", "hosts", "format", "general", "strings", "dupont", "meta", "body", "local", "trident", "gynx", "mozilla" ], "references": [ "https://hybrid-analysis.com/sample/62b6cea0e6e2b40533d835de1968ce767764a36f1f9de2b603ddc2d72aa5e246?environmentId=100", "https://hybrid-analysis.com/sample/1e018f44cfe693f0cd2a5e6491a21eb65bdd0f02fb694eb131eaf5d9118f39ee?environmentId=100", "https://hybrid-analysis.com/sample/e9425c4658ad484851e6b207e7c1ebb7df9da7f793bc35216c46285ef224aa83?environmentId=100", "ok12110.ok1.chatbot.lab.works-hi.co.jp", "ns-19.awsdns-02.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": "622772a53274b509660d46af", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 902, "domain": 338, "URL": 1721, "FileHash-SHA256": 558, "email": 4, "CVE": 1, "FileHash-MD5": 159, "FileHash-SHA1": 128 }, "indicator_count": 3811, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "22 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570908823f97b5559b71806", "name": ";http://tiktok.hop3.pw/EaL8Ufp - Hybrid A report upliad", "description": "", "modified": "2023-12-06T15:17:28.460000", "created": "2023-12-06T15:17:28.460000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 239, "domain": 403, "email": 10, "URL": 1032, "hostname": 561, "FileHash-MD5": 84, "FileHash-SHA1": 49 }, "indicator_count": 2378, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d3fec7eeee20ce02403", "name": "www.access.service.gov.uk - http mal apple .crl fake godaddy asn and execution via chronme log file - total carnage", "description": "", "modified": "2023-12-06T15:03:27.390000", "created": "2023-12-06T15:03:27.390000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 1374, "hostname": 792, "domain": 517, "URL": 1529, "FileHash-MD5": 81, "FileHash-SHA1": 71 }, "indicator_count": 4366, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708a8f3203633312147d1e", "name": "www.virgilio. various Malacious tld's", "description": "", "modified": "2023-12-06T14:51:59.166000", "created": "2023-12-06T14:51:59.166000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 238, "URL": 818, "domain": 177, "hostname": 336, "email": 6, "FileHash-MD5": 79, "FileHash-SHA1": 47 }, "indicator_count": 1702, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d7cc6525322cdb9052", "name": "Charles-152.199.19.160- from scan various dupont domains- malicious- Oracle Supply Chain or Turning Blind eye", "description": "", "modified": "2023-12-06T14:10:31.519000", "created": "2023-12-06T14:10:31.519000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 537, "hostname": 888, "URL": 1698, "email": 4, "domain": 337, "CVE": 1, "FileHash-MD5": 159, "FileHash-SHA1": 127 }, "indicator_count": 3751, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e80d56fba248bac0744780", "name": "\ud83e\udd14\ud83d\udea8 Could this be the source of all Evil? \ud83d\udea8\ud83e\udd14 Nubotnet - Team:KU Leuven/test2 - 2021.igem.org", "description": "", "modified": "2022-08-31T00:01:05.509000", "created": "2022-08-01T17:28:54.991000", "tags": [ "apt", "runtime data", "decrypted ssl", "pcap", "windows nt", "tops", "cookie", "typeof t", "element", "error", "matrix", "typeerror", "bmfloor", "frameelement", "null", "skew", "parade" ], "references": [ "https://2021.igem.org/Team:KU_Leuven/test2", "https://hybrid-analysis.com/sample/e126ff94aac3340dc05a27f062c4267cbfeaa998248bef0e72f000bba711aa76/62e6fb475edc950b894aa7b0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1696, "domain": 586, "hostname": 613, "FileHash-SHA256": 533, "FileHash-MD5": 34, "FileHash-SHA1": 33, "email": 1 }, "indicator_count": 3496, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1372 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62d9e3e8f8a916986b59d0fb", "name": ";http://tiktok.hop3.pw/EaL8Ufp - Hybrid A report upliad", "description": "", "modified": "2022-08-21T00:01:29.251000", "created": "2022-07-21T23:40:24.902000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "data", "decrypted ssl", "threat level", "date", "windows nt", "pcap", "sha256", "pcap processing", "report domain", "accept", "core", "roboto", "gondi", "twitter", "obfa", "hybrid", "close", "click", "hosts", "malicious", "general", "local", "lana", "mozi", "trident", "strings", "suspicious", "hop3.pw" ], "references": [ "https://www.hybrid-analysis.com/sample/facdbc6b7b2cb2a4ba4d45dc831c29834813a8690a81d206e3472b2aacd926bd/62d6a6da34c2b45239660f93" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 561, "domain": 403, "FileHash-SHA256": 239, "URL": 1032, "email": 10, "FileHash-MD5": 84, "FileHash-SHA1": 49 }, "indicator_count": 2378, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62b05f8c261c86a70d541ee2", "name": "http://irs.gov/efile", "description": "", "modified": "2022-07-20T00:04:04.226000", "created": "2022-06-20T11:52:44.182000", "tags": [ "malware", "trojan", "apt", "windows nt", "patch", "june", "local", "team", "february", "b3sitos" ], "references": [ "Hybrid-A gives clean bill of health with all this nastyness ??????", "Found malicious artifacts related to \"108.156.107.37\": ... URL: https://daycoval.facildepagar.com.br/ (AV positives: 8/95 scanned on 06/19/2022 01:54:19) URL: https://search.thejobspotter.com/ (AV positives: 1/95 scanned on 06/17/2022 18:02:39) URL: http://www.onlyonesearch.com/?q=caixa%20geral%20de%20dep%C3%B3sitos%20caixadirecta (AV positives: 1/95 scanned on 06/17/2022 04:21:41) URL: https://dp.la/search (AV positives: 1/95 scanned on 06/14/2022 18:12:11) URL: http://www.ute.com/templates/email_signatur", "https://hybrid-analysis.com/sample/f5c28aaa1eed64eb2abcc9bf3208dbd597b01d0eff7cb0abbcecaf70b77eec3c/62afaa107abd8e4632069a53" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 333, "URL": 509, "domain": 285, "FileHash-SHA256": 196, "CVE": 1, "FileHash-MD5": 56, "FileHash-SHA1": 51, "email": 2 }, "indicator_count": 1433, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1414 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "629b50216b11e3d786f4a5e9", "name": "- GNS3", "description": "", "modified": "2022-07-04T00:03:29.389000", "created": "2022-06-04T12:29:21.310000", "tags": [ "decrypted ssl", "windows nt", "local", "factory", "february" ], "references": [ "http://reviews.gns3.com/", "https://hybrid-analysis.com/sample/ec9301fa384e42acecc146ee968746c58a5f2d5d89bc458a34cccbff67a7fec9/629317f648d8dd3f412c289a" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 436, "URL": 873, "domain": 313, "FileHash-SHA256": 108, "FileHash-MD5": 54, "CVE": 1, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 1836, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1430 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62727ce7b14807e910b72bb7", "name": "www.access.service.gov.uk - http mal apple .crl fake godaddy asn and execution via chronme log file - total carnage", "description": "and that 72 ip at edgcast thats listed as false positive....\n\ud83e\udee2\ud83e\udd2f\ud83e\udd2c everything communucating with it is MALICIOUS and font and lang file corruption means the www is causing it!!!", "modified": "2022-06-03T00:01:00.120000", "created": "2022-05-04T13:17:27.444000", "tags": [], "references": [ "https://hybrid-analysis.com/sample/fcf01007f38956f164a86deda652684fe6c76c41db32f5ac38a43712615154dc/6271a3fc12c9eb6e7053caf1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1529, "hostname": 792, "domain": 517, "FileHash-SHA256": 1374, "CVE": 2, "FileHash-MD5": 81, "FileHash-SHA1": 71 }, "indicator_count": 4366, "is_author": false, "is_subscribing": null, "subscriber_count": 398, "modified_text": "1461 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6264b524008ccee1d221f967", "name": "statcounter nefarious ad and analytics in platform webapp delivered ads", "description": "", "modified": "2022-05-24T00:01:27.321000", "created": "2022-04-24T02:25:40.062000", "tags": [ "associated urls", "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "section", "ansi", "threat level", "header", "messages", "surveymonkey", "chrome", "firefox", "safari", "microsoft", "date", "span", "path", "body", "accept", "explorer", "suspicious", "main", "hybrid", "close", "click", "hosts", "april", "malicious", "general", "local", "factory", "strings", "team", "february", "hybrid analysis", "input", "report", "falcon sandbox", "please note", "data protection", "policy", "https", "memoryfile scan", "windir", "openurl c", "urlhttps", "pmuid", "no expiration", "filehashsha256", "url http", "expiration" ], "references": [ "https://onetag-sys.com/usync/?pubId=6b859b96c564fbe", "https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&consentString=CPX4AJgPX4AJgDlBEAENCMCsAP_AAH_AACiQIsNf_X__b3_n-_7___t0eY1f9_7__-0zjhfdt-8N3f_X_L8X_2M7vF36tr4KuR4ku3bBIQdtHOncTUmx6olVrzPsbk2cr7NKJ7Pkmnsbe2dYGH9_n93T_ZKZ7______7________________________-_____9____________________________8EWACTDUvIAuxLHBk2jSKFECMKwkOoFABRQDC0RWEDq4KdlcBPqCFgAgFQEYEQIMQUYMAgAEAgCQiICQA8EAiAIgEAAIAFQCEABGwCCwAsDAIABQDQsQIoAhAkIMigiOUwICJEooJ7KxBKDvY0whDrLACgUf0VCAiUAIFgZCQsHMcASAlwskCzFC-QAjAAAA&ccpa_", "https://ssbsync.smartadserver.com/api/sync?callerId=43&gdpr=1&gdpr_consent=CPX4AJgPX4AJgDlBEAENCMCsAP_AAH_AACiQIsNf_X__b3_n-_7___t0eY1f9_7__-0zjhfdt-8N3f_X_L8X_2M7vF36tr4KuR4ku3bBIQdtHOncTUmx6olVrzPsbk2cr7NKJ7Pkmnsbe2dYGH9_n93T_ZKZ7______7________________________-_____9____________________________8EWACTDUvIAuxLHBk2jSKFECMKwkOoFABRQDC0RWEDq4KdlcBPqCFgAgFQEYEQIMQUYMAgAEAgCQiICQA8EAiAIgEAAIAFQCEABGwCCwAsDAIABQDQsQIoAhAkIMigiOUwICJEooJ7KxBKDvY0whDrLACgUf0VCAiUAIFgZCQsHMcASAlwskCzFC-QAjAAAA", "https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159110&gdpr=1&gdpr_consent=CPX4AJgPX4AJgDlBEAENCMCsAP_AAH_AACiQIsNf_X__b3_n-_7___t0eY1f9_7__-0zjhfdt-8N3f_X_L8X_2M7vF36tr4KuR4ku3bBIQdtHOncTUmx6olVrzPsbk2cr7NKJ7Pkmnsbe2dYGH9_n93T_ZKZ7______7________________________-_____9____________________________8EWACTDUvIAuxLHBk2jSKFECMKwkOoFABRQDC0RWEDq4KdlcBPqCFgAgFQEYEQIMQUYMAgAEAgCQiICQA8EAiAIgEAAIAFQCEABGwCCwAsDAIABQDQsQIoAhAkIMigiOUwICJEooJ7KxBKDvY0whDrLACgUf0VCAiUAIFgZCQsHMcASAlwskCzFC-QAjAAAA&us_privacy=1---", "https://hybrid-analysis.com/sample/de66bd83860e9dc66969b28f3b93b36c07c5f9d9568f13b07f0e1928490d6945/62649e273fcef808fa4c2bbb", "https://hybrid-analysis.com/sample/9116e707b9da6b1047df9412e29b816726ba3aa6ebc91d77f7f47741ccb7b7bd/6264a22fa3836270e73495b3", "https://hybrid-analysis.com/sample/b3d7008253008166b2abeb2fcc642d9c5e354435f7cb83a681b3cba82840002e/62626a096a89191d343c4546", "usync.html" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 693, "hostname": 325, "domain": 205, "FileHash-SHA256": 148, "FileHash-MD5": 31, "CVE": 1, "FileHash-SHA1": 22, "email": 3 }, "indicator_count": 1428, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1471 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62498485afc3d6ebba050b8b", "name": "www.virgilio. various Malacious tld's", "description": "", "modified": "2022-05-03T00:01:26.398000", "created": "2022-04-03T11:27:01.556000", "tags": [ "virgillo" ], "references": [ "https://hybrid-analysis.com/sample/c914c5cc1371bbc7d2285bbbeec77a94a0d1586c73d3a3f95b48766f1452cca8/6248c9f1f90df91459524ac8" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 336, "domain": 177, "URL": 818, "FileHash-SHA256": 238, "CVE": 1, "FileHash-MD5": 79, "FileHash-SHA1": 47, "email": 6 }, "indicator_count": 1702, "is_author": false, "is_subscribing": null, "subscriber_count": 398, "modified_text": "1492 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "622772a53274b509660d46af", "name": "Charles-152.199.19.160- from scan various dupont domains- malicious- Oracle Supply Chain or Turning Blind eye", "description": "so much familiarity here from the last 5 Years, this is by far compromise on supply chain of the century all the big boys are featured no surprise to me. The question is just how many are compromised from home routers and personal devices", "modified": "2022-04-07T00:04:02.553000", "created": "2022-03-08T15:13:41.976000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "data", "decrypted ssl", "windows nt", "threat level", "ecacc", "gmtetag", "date", "sha256", "pcap", "path", "accept", "back", "close", "click", "solid", "class", "flame", "splash", "verify", "direct", "suspicious", "malicious", "sybuex", "core", "agent", "code", "model", "next", "first", "phase", "impact", "trim", "hybrid", "hosts", "format", "general", "strings", "dupont", "meta", "body", "local", "trident", "gynx", "mozilla" ], "references": [ "https://hybrid-analysis.com/sample/62b6cea0e6e2b40533d835de1968ce767764a36f1f9de2b603ddc2d72aa5e246?environmentId=100", "https://hybrid-analysis.com/sample/1e018f44cfe693f0cd2a5e6491a21eb65bdd0f02fb694eb131eaf5d9118f39ee?environmentId=100", "https://hybrid-analysis.com/sample/e9425c4658ad484851e6b207e7c1ebb7df9da7f793bc35216c46285ef224aa83?environmentId=100", "ok12110.ok1.chatbot.lab.works-hi.co.jp", "ns-19.awsdns-02.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 888, "domain": 337, "URL": 1698, "FileHash-SHA256": 537, "email": 4, "CVE": 1, "FileHash-MD5": 159, "FileHash-SHA1": 127 }, "indicator_count": 3751, "is_author": false, "is_subscribing": null, "subscriber_count": 395, "modified_text": "1518 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://hybrid-analysis.com/sample/e126ff94aac3340dc05a27f062c4267cbfeaa998248bef0e72f000bba711aa76/62e6fb475edc950b894aa7b0", "https://ssbsync.smartadserver.com/api/sync?callerId=43&gdpr=1&gdpr_consent=CPX4AJgPX4AJgDlBEAENCMCsAP_AAH_AACiQIsNf_X__b3_n-_7___t0eY1f9_7__-0zjhfdt-8N3f_X_L8X_2M7vF36tr4KuR4ku3bBIQdtHOncTUmx6olVrzPsbk2cr7NKJ7Pkmnsbe2dYGH9_n93T_ZKZ7______7________________________-_____9____________________________8EWACTDUvIAuxLHBk2jSKFECMKwkOoFABRQDC0RWEDq4KdlcBPqCFgAgFQEYEQIMQUYMAgAEAgCQiICQA8EAiAIgEAAIAFQCEABGwCCwAsDAIABQDQsQIoAhAkIMigiOUwICJEooJ7KxBKDvY0whDrLACgUf0VCAiUAIFgZCQsHMcASAlwskCzFC-QAjAAAA", "https://onetag-sys.com/usync/?pubId=6b859b96c564fbe", "https://hybrid-analysis.com/sample/1e018f44cfe693f0cd2a5e6491a21eb65bdd0f02fb694eb131eaf5d9118f39ee?environmentId=100", "https://ads.pubmatic.com/AdServer/js/user_sync.html?p=159110&gdpr=1&gdpr_consent=CPX4AJgPX4AJgDlBEAENCMCsAP_AAH_AACiQIsNf_X__b3_n-_7___t0eY1f9_7__-0zjhfdt-8N3f_X_L8X_2M7vF36tr4KuR4ku3bBIQdtHOncTUmx6olVrzPsbk2cr7NKJ7Pkmnsbe2dYGH9_n93T_ZKZ7______7________________________-_____9____________________________8EWACTDUvIAuxLHBk2jSKFECMKwkOoFABRQDC0RWEDq4KdlcBPqCFgAgFQEYEQIMQUYMAgAEAgCQiICQA8EAiAIgEAAIAFQCEABGwCCwAsDAIABQDQsQIoAhAkIMigiOUwICJEooJ7KxBKDvY0whDrLACgUf0VCAiUAIFgZCQsHMcASAlwskCzFC-QAjAAAA&us_privacy=1---", "https://hybrid-analysis.com/sample/b3d7008253008166b2abeb2fcc642d9c5e354435f7cb83a681b3cba82840002e/62626a096a89191d343c4546", "https://hybrid-analysis.com/sample/de66bd83860e9dc66969b28f3b93b36c07c5f9d9568f13b07f0e1928490d6945/62649e273fcef808fa4c2bbb", "ns-19.awsdns-02.com", "https://hybrid-analysis.com/sample/c914c5cc1371bbc7d2285bbbeec77a94a0d1586c73d3a3f95b48766f1452cca8/6248c9f1f90df91459524ac8", "ok12110.ok1.chatbot.lab.works-hi.co.jp", "https://2021.igem.org/Team:KU_Leuven/test2", "https://hybrid-analysis.com/sample/fcf01007f38956f164a86deda652684fe6c76c41db32f5ac38a43712615154dc/6271a3fc12c9eb6e7053caf1", "https://hybrid-analysis.com/sample/e9425c4658ad484851e6b207e7c1ebb7df9da7f793bc35216c46285ef224aa83?environmentId=100", "https://hybrid-analysis.com/sample/f5c28aaa1eed64eb2abcc9bf3208dbd597b01d0eff7cb0abbcecaf70b77eec3c/62afaa107abd8e4632069a53", "https://hybrid-analysis.com/sample/9116e707b9da6b1047df9412e29b816726ba3aa6ebc91d77f7f47741ccb7b7bd/6264a22fa3836270e73495b3", "http://reviews.gns3.com/", "https://hybrid-analysis.com/sample/ec9301fa384e42acecc146ee968746c58a5f2d5d89bc458a34cccbff67a7fec9/629317f648d8dd3f412c289a", "https://www.hybrid-analysis.com/sample/facdbc6b7b2cb2a4ba4d45dc831c29834813a8690a81d206e3472b2aacd926bd/62d6a6da34c2b45239660f93", "Found malicious artifacts related to \"108.156.107.37\": ... URL: https://daycoval.facildepagar.com.br/ (AV positives: 8/95 scanned on 06/19/2022 01:54:19) URL: https://search.thejobspotter.com/ (AV positives: 1/95 scanned on 06/17/2022 18:02:39) URL: http://www.onlyonesearch.com/?q=caixa%20geral%20de%20dep%C3%B3sitos%20caixadirecta (AV positives: 1/95 scanned on 06/17/2022 04:21:41) URL: https://dp.la/search (AV positives: 1/95 scanned on 06/14/2022 18:12:11) URL: http://www.ute.com/templates/email_signatur", "usync.html", "https://sync.richaudience.com/74889303289e27f327ad0c6de7be7264/?p=1BTOoaD22a&consentString=CPX4AJgPX4AJgDlBEAENCMCsAP_AAH_AACiQIsNf_X__b3_n-_7___t0eY1f9_7__-0zjhfdt-8N3f_X_L8X_2M7vF36tr4KuR4ku3bBIQdtHOncTUmx6olVrzPsbk2cr7NKJ7Pkmnsbe2dYGH9_n93T_ZKZ7______7________________________-_____9____________________________8EWACTDUvIAuxLHBk2jSKFECMKwkOoFABRQDC0RWEDq4KdlcBPqCFgAgFQEYEQIMQUYMAgAEAgCQiICQA8EAiAIgEAAIAFQCEABGwCCwAsDAIABQDQsQIoAhAkIMigiOUwICJEooJ7KxBKDvY0whDrLACgUf0VCAiUAIFgZCQsHMcASAlwskCzFC-QAjAAAA&ccpa_", "https://hybrid-analysis.com/sample/62b6cea0e6e2b40533d835de1968ce767764a36f1f9de2b603ddc2d72aa5e246?environmentId=100", "Hybrid-A gives clean bill of health with all this nastyness ??????" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 19350 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/awsdns-28.org", "whois": "http://whois.domaintools.com/awsdns-28.org", "domain": "awsdns-28.org", "hostname": "ns-1250.awsdns-28.org" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 13, "pulses": [ { "id": "69dba8a0f375964d468b9ba0", "name": "Credit: DorkingBeauty1- Charles-152.199.19.160- from scan various dupont domains- malicious- Oracle Supply Chain or Turning Blind eye", "description": "", "modified": "2026-05-12T00:09:20.348000", "created": "2026-04-12T14:13:52.560000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "data", "decrypted ssl", "windows nt", "threat level", "ecacc", "gmtetag", "date", "sha256", "pcap", "path", "accept", "back", "close", "click", "solid", "class", "flame", "splash", "verify", "direct", "suspicious", "malicious", "sybuex", "core", "agent", "code", "model", "next", "first", "phase", "impact", "trim", "hybrid", "hosts", "format", "general", "strings", "dupont", "meta", "body", "local", "trident", "gynx", "mozilla" ], "references": [ "https://hybrid-analysis.com/sample/62b6cea0e6e2b40533d835de1968ce767764a36f1f9de2b603ddc2d72aa5e246?environmentId=100", "https://hybrid-analysis.com/sample/1e018f44cfe693f0cd2a5e6491a21eb65bdd0f02fb694eb131eaf5d9118f39ee?environmentId=100", "https://hybrid-analysis.com/sample/e9425c4658ad484851e6b207e7c1ebb7df9da7f793bc35216c46285ef224aa83?environmentId=100", "ok12110.ok1.chatbot.lab.works-hi.co.jp", "ns-19.awsdns-02.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": "622772a53274b509660d46af", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 902, "domain": 338, "URL": 1721, "FileHash-SHA256": 558, "email": 4, "CVE": 1, "FileHash-MD5": 159, "FileHash-SHA1": 128 }, "indicator_count": 3811, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "22 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570908823f97b5559b71806", "name": ";http://tiktok.hop3.pw/EaL8Ufp - Hybrid A report upliad", "description": "", "modified": "2023-12-06T15:17:28.460000", "created": "2023-12-06T15:17:28.460000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 239, "domain": 403, "email": 10, "URL": 1032, "hostname": 561, "FileHash-MD5": 84, "FileHash-SHA1": 49 }, "indicator_count": 2378, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708d3fec7eeee20ce02403", "name": "www.access.service.gov.uk - http mal apple .crl fake godaddy asn and execution via chronme log file - total carnage", "description": "", "modified": "2023-12-06T15:03:27.390000", "created": "2023-12-06T15:03:27.390000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 1374, "hostname": 792, "domain": 517, "URL": 1529, "FileHash-MD5": 81, "FileHash-SHA1": 71 }, "indicator_count": 4366, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708a8f3203633312147d1e", "name": "www.virgilio. various Malacious tld's", "description": "", "modified": "2023-12-06T14:51:59.166000", "created": "2023-12-06T14:51:59.166000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 238, "URL": 818, "domain": 177, "hostname": 336, "email": 6, "FileHash-MD5": 79, "FileHash-SHA1": 47 }, "indicator_count": 1702, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657080d7cc6525322cdb9052", "name": "Charles-152.199.19.160- from scan various dupont domains- malicious- Oracle Supply Chain or Turning Blind eye", "description": "", "modified": "2023-12-06T14:10:31.519000", "created": "2023-12-06T14:10:31.519000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 537, "hostname": 888, "URL": 1698, "email": 4, "domain": 337, "CVE": 1, "FileHash-MD5": 159, "FileHash-SHA1": 127 }, "indicator_count": 3751, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "910 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62e80d56fba248bac0744780", "name": "\ud83e\udd14\ud83d\udea8 Could this be the source of all Evil? \ud83d\udea8\ud83e\udd14 Nubotnet - Team:KU Leuven/test2 - 2021.igem.org", "description": "", "modified": "2022-08-31T00:01:05.509000", "created": "2022-08-01T17:28:54.991000", "tags": [ "apt", "runtime data", "decrypted ssl", "pcap", "windows nt", "tops", "cookie", "typeof t", "element", "error", "matrix", "typeerror", "bmfloor", "frameelement", "null", "skew", "parade" ], "references": [ "https://2021.igem.org/Team:KU_Leuven/test2", "https://hybrid-analysis.com/sample/e126ff94aac3340dc05a27f062c4267cbfeaa998248bef0e72f000bba711aa76/62e6fb475edc950b894aa7b0" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1696, "domain": 586, "hostname": 613, "FileHash-SHA256": 533, "FileHash-MD5": 34, "FileHash-SHA1": 33, "email": 1 }, "indicator_count": 3496, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1372 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62d9e3e8f8a916986b59d0fb", "name": ";http://tiktok.hop3.pw/EaL8Ufp - Hybrid A report upliad", "description": "", "modified": "2022-08-21T00:01:29.251000", "created": "2022-07-21T23:40:24.902000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "ansi", "data", "decrypted ssl", "threat level", "date", "windows nt", "pcap", "sha256", "pcap processing", "report domain", "accept", "core", "roboto", "gondi", "twitter", "obfa", "hybrid", "close", "click", "hosts", "malicious", "general", "local", "lana", "mozi", "trident", "strings", "suspicious", "hop3.pw" ], "references": [ "https://www.hybrid-analysis.com/sample/facdbc6b7b2cb2a4ba4d45dc831c29834813a8690a81d206e3472b2aacd926bd/62d6a6da34c2b45239660f93" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 561, "domain": 403, "FileHash-SHA256": 239, "URL": 1032, "email": 10, "FileHash-MD5": 84, "FileHash-SHA1": 49 }, "indicator_count": 2378, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1382 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62b05f8c261c86a70d541ee2", "name": "http://irs.gov/efile", "description": "", "modified": "2022-07-20T00:04:04.226000", "created": "2022-06-20T11:52:44.182000", "tags": [ "malware", "trojan", "apt", "windows nt", "patch", "june", "local", "team", "february", "b3sitos" ], "references": [ "Hybrid-A gives clean bill of health with all this nastyness ??????", "Found malicious artifacts related to \"108.156.107.37\": ... URL: https://daycoval.facildepagar.com.br/ (AV positives: 8/95 scanned on 06/19/2022 01:54:19) URL: https://search.thejobspotter.com/ (AV positives: 1/95 scanned on 06/17/2022 18:02:39) URL: http://www.onlyonesearch.com/?q=caixa%20geral%20de%20dep%C3%B3sitos%20caixadirecta (AV positives: 1/95 scanned on 06/17/2022 04:21:41) URL: https://dp.la/search (AV positives: 1/95 scanned on 06/14/2022 18:12:11) URL: http://www.ute.com/templates/email_signatur", "https://hybrid-analysis.com/sample/f5c28aaa1eed64eb2abcc9bf3208dbd597b01d0eff7cb0abbcecaf70b77eec3c/62afaa107abd8e4632069a53" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 333, "URL": 509, "domain": 285, "FileHash-SHA256": 196, "CVE": 1, "FileHash-MD5": 56, "FileHash-SHA1": 51, "email": 2 }, "indicator_count": 1433, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1414 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "629b50216b11e3d786f4a5e9", "name": "- GNS3", "description": "", "modified": "2022-07-04T00:03:29.389000", "created": "2022-06-04T12:29:21.310000", "tags": [ "decrypted ssl", "windows nt", "local", "factory", "february" ], "references": [ "http://reviews.gns3.com/", "https://hybrid-analysis.com/sample/ec9301fa384e42acecc146ee968746c58a5f2d5d89bc458a34cccbff67a7fec9/629317f648d8dd3f412c289a" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 436, "URL": 873, "domain": 313, "FileHash-SHA256": 108, "FileHash-MD5": 54, "CVE": 1, "FileHash-SHA1": 50, "email": 1 }, "indicator_count": 1836, "is_author": false, "is_subscribing": null, "subscriber_count": 393, "modified_text": "1430 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "62727ce7b14807e910b72bb7", "name": "www.access.service.gov.uk - http mal apple .crl fake godaddy asn and execution via chronme log file - total carnage", "description": "and that 72 ip at edgcast thats listed as false positive....\n\ud83e\udee2\ud83e\udd2f\ud83e\udd2c everything communucating with it is MALICIOUS and font and lang file corruption means the www is causing it!!!", "modified": "2022-06-03T00:01:00.120000", "created": "2022-05-04T13:17:27.444000", "tags": [], "references": [ "https://hybrid-analysis.com/sample/fcf01007f38956f164a86deda652684fe6c76c41db32f5ac38a43712615154dc/6271a3fc12c9eb6e7053caf1" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1529, "hostname": 792, "domain": 517, "FileHash-SHA256": 1374, "CVE": 2, "FileHash-MD5": 81, "FileHash-SHA1": 71 }, "indicator_count": 4366, "is_author": false, "is_subscribing": null, "subscriber_count": 398, "modified_text": "1461 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://ns-1250.awsdns-28.org", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://ns-1250.awsdns-28.org", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780514960.0786514 }