{
  "type": "URL",
  "indicator": "https://ns-523.awsdns-01.net",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns-523.awsdns-01.net",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3176871127,
      "indicator": "https://ns-523.awsdns-01.net",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "69f2dc7e076cbfe2d0f7eb90",
          "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
          "description": "",
          "modified": "2026-05-30T00:28:12.957000",
          "created": "2026-04-30T04:37:18.870000",
          "tags": [
            "united",
            "as397240",
            "search",
            "showing",
            "as54113",
            "as397241",
            "unknown",
            "moved",
            "creation date",
            "record value",
            "next",
            "date",
            "body",
            "a domains",
            "passive dns",
            "formbook cnc",
            "checkin",
            "entries",
            "github pages",
            "sea x",
            "accept",
            "status",
            "name servers",
            "certificate",
            "urls",
            "aaaa",
            "cname",
            "meta",
            "whitelisted ip",
            "address",
            "location united",
            "asn as36459",
            "github",
            "less whois",
            "registrar",
            "markmonitor",
            "related tags",
            "as36459",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "ninite",
            "expiration date",
            "domain",
            "hostname",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "document file",
            "v2 document",
            "utf8",
            "crlf line",
            "beginstring",
            "size",
            "null",
            "hybrid",
            "refresh",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "url https",
            "tulach type",
            "role title",
            "added active",
            "pulses url",
            "url http",
            "nextc type",
            "type indicator",
            "related pulses",
            "filehashsha256",
            "copyright",
            "ipv6",
            "germany",
            "italy",
            "trojan",
            "trojanspy",
            "worm",
            "trojanclicker",
            "virtool",
            "service",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "collisionbox",
            "runner",
            "gameoverpanel",
            "trex",
            "orgtechhandle",
            "orgtechref",
            "director",
            "university",
            "nethandle",
            "net168",
            "net1680000",
            "ucha",
            "orgid",
            "east",
            "report spam",
            "as8075",
            "servers",
            "secure server",
            "error all",
            "typeof",
            "error f",
            "crazy doll",
            "created",
            "filehashmd5",
            "types of",
            "russia",
            "emotet type",
            "mirai type",
            "mirai",
            "mtb description",
            "win32 type",
            "as31034 aruba",
            "italy unknown",
            "as19527 google",
            "encrypt",
            "health type",
            "miori hackers",
            "brute force",
            "backdoor",
            "aurora",
            "ip address",
            "path",
            "unis",
            "dotcisoffer",
            "bladabindi",
            "artro",
            "script urls",
            "as46606",
            "brazil unknown",
            "as11284",
            "as10906",
            "apache",
            "lanc type",
            "telper",
            "win32",
            "win64",
            "pulses email",
            "as9009 m247",
            "as7296 alchemy",
            "as14061",
            "as16276",
            "trojandropper",
            "ransom",
            "mtb sep",
            "msie",
            "chrome",
            "ip check",
            "gmt content",
            "pulse submit",
            "url analysis",
            "files ip",
            "aaaa nxdomain",
            "nxdomain",
            "a nxdomain",
            "as22612",
            "dnssec",
            "meta http",
            "accept encoding",
            "request id",
            "united kingdom",
            "div div",
            "arial helvetica",
            "emails",
            "as15169 google",
            "cryp",
            "gmt cache",
            "sameorigin",
            "domain name",
            "code",
            "false",
            "command type",
            "roleselfservice",
            "mcig sep",
            "all search",
            "author avatar",
            "days ago",
            "http",
            "related nids",
            "files location",
            "as30081",
            "gmt contenttype",
            "mozilla",
            "as15133 verizon",
            "whitelisted",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "softcnapp",
            "overview ip",
            "flag united",
            "files related",
            "as62597 nsone",
            "as31898 oracle",
            "mtb aug",
            "class",
            "twitter",
            "april",
            "secure",
            "httponly",
            "expiresthu",
            "pragma",
            "as13414 twitter",
            "smoke loader",
            "reverse dns",
            "asnone united",
            "idlogin sep",
            "uid38009",
            "expiration",
            "hack type",
            "porn type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Aruba"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66fc29a49b5ac693c8d75122",
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3851,
            "FileHash-MD5": 6012,
            "FileHash-SHA1": 5906,
            "domain": 3330,
            "email": 33,
            "hostname": 4231,
            "CVE": 2,
            "FileHash-SHA256": 8407,
            "CIDR": 2,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 31781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1 day ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f2dc7db0bb5c5cdaec5a6c",
          "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
          "description": "",
          "modified": "2026-04-30T04:53:09.713000",
          "created": "2026-04-30T04:37:17.546000",
          "tags": [
            "united",
            "as397240",
            "search",
            "showing",
            "as54113",
            "as397241",
            "unknown",
            "moved",
            "creation date",
            "record value",
            "next",
            "date",
            "body",
            "a domains",
            "passive dns",
            "formbook cnc",
            "checkin",
            "entries",
            "github pages",
            "sea x",
            "accept",
            "status",
            "name servers",
            "certificate",
            "urls",
            "aaaa",
            "cname",
            "meta",
            "whitelisted ip",
            "address",
            "location united",
            "asn as36459",
            "github",
            "less whois",
            "registrar",
            "markmonitor",
            "related tags",
            "as36459",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "ninite",
            "expiration date",
            "domain",
            "hostname",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "document file",
            "v2 document",
            "utf8",
            "crlf line",
            "beginstring",
            "size",
            "null",
            "hybrid",
            "refresh",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "url https",
            "tulach type",
            "role title",
            "added active",
            "pulses url",
            "url http",
            "nextc type",
            "type indicator",
            "related pulses",
            "filehashsha256",
            "copyright",
            "ipv6",
            "germany",
            "italy",
            "trojan",
            "trojanspy",
            "worm",
            "trojanclicker",
            "virtool",
            "service",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "collisionbox",
            "runner",
            "gameoverpanel",
            "trex",
            "orgtechhandle",
            "orgtechref",
            "director",
            "university",
            "nethandle",
            "net168",
            "net1680000",
            "ucha",
            "orgid",
            "east",
            "report spam",
            "as8075",
            "servers",
            "secure server",
            "error all",
            "typeof",
            "error f",
            "crazy doll",
            "created",
            "filehashmd5",
            "types of",
            "russia",
            "emotet type",
            "mirai type",
            "mirai",
            "mtb description",
            "win32 type",
            "as31034 aruba",
            "italy unknown",
            "as19527 google",
            "encrypt",
            "health type",
            "miori hackers",
            "brute force",
            "backdoor",
            "aurora",
            "ip address",
            "path",
            "unis",
            "dotcisoffer",
            "bladabindi",
            "artro",
            "script urls",
            "as46606",
            "brazil unknown",
            "as11284",
            "as10906",
            "apache",
            "lanc type",
            "telper",
            "win32",
            "win64",
            "pulses email",
            "as9009 m247",
            "as7296 alchemy",
            "as14061",
            "as16276",
            "trojandropper",
            "ransom",
            "mtb sep",
            "msie",
            "chrome",
            "ip check",
            "gmt content",
            "pulse submit",
            "url analysis",
            "files ip",
            "aaaa nxdomain",
            "nxdomain",
            "a nxdomain",
            "as22612",
            "dnssec",
            "meta http",
            "accept encoding",
            "request id",
            "united kingdom",
            "div div",
            "arial helvetica",
            "emails",
            "as15169 google",
            "cryp",
            "gmt cache",
            "sameorigin",
            "domain name",
            "code",
            "false",
            "command type",
            "roleselfservice",
            "mcig sep",
            "all search",
            "author avatar",
            "days ago",
            "http",
            "related nids",
            "files location",
            "as30081",
            "gmt contenttype",
            "mozilla",
            "as15133 verizon",
            "whitelisted",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "softcnapp",
            "overview ip",
            "flag united",
            "files related",
            "as62597 nsone",
            "as31898 oracle",
            "mtb aug",
            "class",
            "twitter",
            "april",
            "secure",
            "httponly",
            "expiresthu",
            "pragma",
            "as13414 twitter",
            "smoke loader",
            "reverse dns",
            "asnone united",
            "idlogin sep",
            "uid38009",
            "expiration",
            "hack type",
            "porn type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Aruba"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66fc29a49b5ac693c8d75122",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3851,
            "FileHash-MD5": 6012,
            "FileHash-SHA1": 5906,
            "domain": 3330,
            "email": 33,
            "hostname": 4231,
            "CVE": 2,
            "FileHash-SHA256": 8407,
            "CIDR": 2,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 31781,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "31 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66fc29a49b5ac693c8d75122",
          "name": "Medical Campus - Aurora, Co | Recheck",
          "description": "This weekend we found a busybox MIORI Hackers - serious attack Aurora, Medical Campus -Mirai. This recheck is generic. All results generated automatically by LevelBlue, sourced by ScoreBlue.\nMaybe it will be clean today. Complaints of pop up auto logins on locked screens and autonomous system running alongside actual system. System root.\nMalware Families:\nTrojanDownloader:Win32/Bulilit, ELF:Mirai-TO\\ [Trj], Backdoor:Linux/Mirai.B, TELPER:HSTR:DotCisOffer, TrojanSpy:Win32/Nivdort, Backdoor:Win32/Bladabindi, ALF:E5, Win.Malware.Midie-9950743-0, Trojan:Win32/Emotet.ARJ!MTB",
          "modified": "2024-10-31T16:03:52.240000",
          "created": "2024-10-01T16:56:04.004000",
          "tags": [
            "united",
            "as397240",
            "search",
            "showing",
            "as54113",
            "as397241",
            "unknown",
            "moved",
            "creation date",
            "record value",
            "next",
            "date",
            "body",
            "a domains",
            "passive dns",
            "formbook cnc",
            "checkin",
            "entries",
            "github pages",
            "sea x",
            "accept",
            "status",
            "name servers",
            "certificate",
            "urls",
            "aaaa",
            "cname",
            "meta",
            "whitelisted ip",
            "address",
            "location united",
            "asn as36459",
            "github",
            "less whois",
            "registrar",
            "markmonitor",
            "related tags",
            "as36459",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse pulses",
            "files",
            "ninite",
            "expiration date",
            "domain",
            "hostname",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "document file",
            "v2 document",
            "utf8",
            "crlf line",
            "beginstring",
            "size",
            "null",
            "hybrid",
            "refresh",
            "span",
            "local",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "contact",
            "url https",
            "tulach type",
            "role title",
            "added active",
            "pulses url",
            "url http",
            "nextc type",
            "type indicator",
            "related pulses",
            "filehashsha256",
            "copyright",
            "ipv6",
            "germany",
            "italy",
            "trojan",
            "trojanspy",
            "worm",
            "trojanclicker",
            "virtool",
            "service",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "collisionbox",
            "runner",
            "gameoverpanel",
            "trex",
            "orgtechhandle",
            "orgtechref",
            "director",
            "university",
            "nethandle",
            "net168",
            "net1680000",
            "ucha",
            "orgid",
            "east",
            "report spam",
            "as8075",
            "servers",
            "secure server",
            "error all",
            "typeof",
            "error f",
            "crazy doll",
            "created",
            "filehashmd5",
            "types of",
            "russia",
            "emotet type",
            "mirai type",
            "mirai",
            "mtb description",
            "win32 type",
            "as31034 aruba",
            "italy unknown",
            "as19527 google",
            "encrypt",
            "health type",
            "miori hackers",
            "brute force",
            "backdoor",
            "aurora",
            "ip address",
            "path",
            "unis",
            "dotcisoffer",
            "bladabindi",
            "artro",
            "script urls",
            "as46606",
            "brazil unknown",
            "as11284",
            "as10906",
            "apache",
            "lanc type",
            "telper",
            "win32",
            "win64",
            "pulses email",
            "as9009 m247",
            "as7296 alchemy",
            "as14061",
            "as16276",
            "trojandropper",
            "ransom",
            "mtb sep",
            "msie",
            "chrome",
            "ip check",
            "gmt content",
            "pulse submit",
            "url analysis",
            "files ip",
            "aaaa nxdomain",
            "nxdomain",
            "a nxdomain",
            "as22612",
            "dnssec",
            "meta http",
            "accept encoding",
            "request id",
            "united kingdom",
            "div div",
            "arial helvetica",
            "emails",
            "as15169 google",
            "cryp",
            "gmt cache",
            "sameorigin",
            "domain name",
            "code",
            "false",
            "command type",
            "roleselfservice",
            "mcig sep",
            "all search",
            "author avatar",
            "days ago",
            "http",
            "related nids",
            "files location",
            "as30081",
            "gmt contenttype",
            "mozilla",
            "as15133 verizon",
            "whitelisted",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "softcnapp",
            "overview ip",
            "flag united",
            "files related",
            "as62597 nsone",
            "as31898 oracle",
            "mtb aug",
            "class",
            "twitter",
            "april",
            "secure",
            "httponly",
            "expiresthu",
            "pragma",
            "as13414 twitter",
            "smoke loader",
            "reverse dns",
            "asnone united",
            "idlogin sep",
            "uid38009",
            "expiration",
            "hack type",
            "porn type"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Italy",
            "Aruba"
          ],
          "malware_families": [
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Artro",
              "display_name": "Artro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 53,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3850,
            "FileHash-MD5": 6012,
            "FileHash-SHA1": 5906,
            "domain": 3329,
            "email": 33,
            "hostname": 4231,
            "CVE": 2,
            "FileHash-SHA256": 8407,
            "CIDR": 2,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 31779,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 236,
          "modified_text": "576 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "665bb7679843a6dabe4560e3",
          "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
          "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
          "modified": "2024-09-05T06:11:17.325000",
          "created": "2024-06-02T00:05:59.160000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 2008,
            "URL": 11241,
            "domain": 1853,
            "hostname": 4198,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 19615,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "632 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6681f6738d3aa876f83738d0",
          "name": "USZoom [New York , USA] | iPostal1",
          "description": "",
          "modified": "2024-07-01T23:00:42.052000",
          "created": "2024-07-01T00:21:07.491000",
          "tags": [
            "strong",
            "story contact",
            "us leadership",
            "open menu",
            "close menu",
            "digital",
            "thank",
            "us zoom",
            "skip",
            "content home",
            "enterprise",
            "contact",
            "threat roundup",
            "august",
            "historical ssl",
            "april",
            "referrer",
            "formbook",
            "ip check",
            "vt graph",
            "relacionada",
            "cobalt strike",
            "hiddentear",
            "life",
            "malware",
            "open",
            "mumblehard",
            "sparkrat",
            "attack",
            "uszoom og",
            "submission",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "graph api",
            "status",
            "content type",
            "date",
            "anchor hrefs",
            "hrefs",
            "cart contact",
            "leadership",
            "html info",
            "title uszoom",
            "meta tags",
            "uszoom twitter",
            "script tags",
            "vhash htm",
            "ssdeep",
            "file type",
            "html internet",
            "magic html",
            "ascii text",
            "trid file",
            "magika cttxt",
            "file size",
            "united",
            "as20940",
            "aaaa",
            "canada",
            "search",
            "showing",
            "cname",
            "as35994 akamai",
            "passive dns",
            "next",
            "as21928",
            "unknown",
            "urls",
            "domain",
            "creation date",
            "emails",
            "ipcounsel",
            "scan endpoints",
            "all scoreblue",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "invalid url",
            "body",
            "name servers",
            "akamai",
            "expiration date",
            "asnone united",
            "a nxdomain",
            "india",
            "as15224 adobe",
            "bdclid",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "yara rule",
            "high",
            "explorer",
            "alerts",
            "less see",
            "contacted",
            "service",
            "attempts",
            "guard",
            "url http",
            "pulse pulses",
            "http",
            "related nids",
            "files location",
            "ip related",
            "hostname",
            "files ip",
            "address domain",
            "as46606",
            "td td",
            "script script",
            "gmt path",
            "create",
            "website",
            "set cookie",
            "a td",
            "win32",
            "flash",
            "pragma",
            "cookie",
            "xmpmm",
            "png image",
            "rgba",
            "documentid",
            "instanceid",
            "creatortool",
            "pattern match",
            "adobe photoshop",
            "macintosh",
            "june",
            "hybrid",
            "local",
            "encrypt",
            "click",
            "strings",
            "anomalous_deletefile",
            "info_stealer",
            "et trojan",
            "banload http",
            "banload",
            "ids detections",
            "yara detections",
            "bancos variant",
            "c2 checkin",
            "ntkrnlpacker",
            "copy",
            "meredrop",
            "injection",
            "e0e2edee",
            "push",
            "read",
            "write",
            "delete",
            "entries",
            "crlf line",
            "anomalous file",
            "medium",
            "filehash",
            "av detections",
            "analysis date",
            "file score",
            "medium risk",
            "detections none",
            "related pulses",
            "apple",
            "apple id",
            "apple private data collection",
            "apple staging",
            "t-mobile",
            "metroby",
            "keylogger"
          ],
          "references": [
            "https://uszoom.com/",
            "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
            "Malicious Score: 10",
            "Yara Detections: DotNET_Reactor",
            "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
            "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
            "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
            "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
            "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
            "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
            "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
            "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
            "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
            "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
            "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
            "Yara Detections stack_string ,  Armadillov1xxv2xx",
            "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
            "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Keylogger.Susppack-9876601-0",
              "display_name": "Win.Keylogger.Susppack-9876601-0",
              "target": null
            },
            {
              "id": "Win.Trojan.Sdum-9807706-0",
              "display_name": "Win.Trojan.Sdum-9807706-0",
              "target": null
            },
            {
              "id": "Win32.Meredrop Checkin",
              "display_name": "Win32.Meredrop Checkin",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
              "target": null
            },
            {
              "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1048.002",
              "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
              "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
            },
            {
              "id": "T1102.002",
              "name": "Bidirectional Communication",
              "display_name": "T1102.002 - Bidirectional Communication"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1184",
              "name": "SSH Hijacking",
              "display_name": "T1184 - SSH Hijacking"
            },
            {
              "id": "T1198",
              "name": "SIP and Trust Provider Hijacking",
              "display_name": "T1198 - SIP and Trust Provider Hijacking"
            },
            {
              "id": "T1416",
              "name": "URI Hijacking",
              "display_name": "T1416 - URI Hijacking"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1434",
              "name": "App Delivered via Email Attachment",
              "display_name": "T1434 - App Delivered via Email Attachment"
            }
          ],
          "industries": [
            "Technology",
            "Telecommunications",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": "665bb7679843a6dabe4560e3",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "email": 8,
            "FileHash-MD5": 167,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1890,
            "URL": 10360,
            "domain": 1799,
            "hostname": 3994,
            "SSLCertFingerprint": 10,
            "CVE": 1
          },
          "indicator_count": 18358,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "698 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708fe97242b201bad932be",
          "name": "GitHub - jh00nbr/sebrae_licitacoes_crawler: Sebrae Licitacoes Crawler",
          "description": "",
          "modified": "2023-12-06T15:14:49.557000",
          "created": "2023-12-06T15:14:49.557000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 273,
            "hostname": 423,
            "domain": 254,
            "URL": 435,
            "FileHash-SHA1": 2,
            "email": 4,
            "FileHash-MD5": 2
          },
          "indicator_count": 1393,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "906 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62bc2dc6c1c5ac64fe297b85",
          "name": "GitHub - jh00nbr/sebrae_licitacoes_crawler: Sebrae Licitacoes Crawler",
          "description": "Sebastian Clark - Essex's was centraserve.com\nstole my domains 1 of those domains  getsetpet.co.uk and abused via cross-breed-profiles pages which was moved to google hosting\nsholwill.co.uk -shows only 1 pdf upload. so mych data is missing from the history of the 20 odd domains that I owned",
          "modified": "2022-07-29T00:00:24.010000",
          "created": "2022-06-29T10:47:34",
          "tags": [
            "centraserve ltd",
            "buy domain",
            "names",
            "buy company",
            "number",
            "my index",
            "company",
            "books",
            "dvds",
            "computer games",
            "github",
            "jump",
            "sign",
            "github sponsors",
            "strong",
            "repository",
            "code issues",
            "pull",
            "wiki security",
            "view",
            "contact",
            "star",
            "code",
            "ghost",
            "stars",
            "windows",
            "safe exam",
            "browser",
            "exam browser",
            "spring",
            "mozilla",
            "xcode",
            "apple",
            "xcode project",
            "search",
            "seb how",
            "support",
            "caps",
            "field",
            "scrapysebug",
            "python",
            "xulrunner",
            "download",
            "stefan",
            "shell",
            "sebuilder",
            "firefox",
            "new relic",
            "yourprofile",
            "builder",
            "important",
            "sebuilder v2",
            "synthetics",
            "tools",
            "launch",
            "write",
            "click",
            "sebrae",
            "quantidade",
            "crawler",
            "banco"
          ],
          "references": [
            "https://github.com/jh00nbr/sebrae_licitacoes_crawler",
            "https://github.com/sschwartzman/newrelic-synthetics-sebuilder",
            "https://github.com/eqsoft/seb",
            "https://github.com/Hongxs/scrapy-sebug",
            "https://github.com/SafeExamBrowser/seb-mac",
            "https://github.com/SafeExamBrowser/seb-win",
            "https://github.com/sebastianruder/sebastianruder",
            "https://github.com/jh00nbr/sebrae_licitacoes_crawler/commit/8ac1601bca371820755671f205ffdbfd12f72311/rollup",
            "https://centraserve.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 512,
            "hostname": 482,
            "domain": 276,
            "FileHash-SHA256": 294,
            "FileHash-SHA1": 2,
            "email": 4,
            "FileHash-MD5": 2
          },
          "indicator_count": 1572,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1402 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "Malicious Score: 10",
        "https://uszoom.com/",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "https://github.com/sebastianruder/sebastianruder",
        "https://github.com/eqsoft/seb",
        "https://github.com/SafeExamBrowser/seb-win",
        "https://github.com/Hongxs/scrapy-sebug",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "https://github.com/SafeExamBrowser/seb-mac",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "Yara Detections: DotNET_Reactor",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "https://github.com/jh00nbr/sebrae_licitacoes_crawler/commit/8ac1601bca371820755671f205ffdbfd12f72311/rollup",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "https://github.com/sschwartzman/newrelic-synthetics-sebuilder",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://github.com/jh00nbr/sebrae_licitacoes_crawler",
        "https://centraserve.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Artro",
            "Win.trojan.sdum-9807706-0",
            "Win32.meredrop checkin",
            "#lowfi:hstr:trojanspy:win32/bancos",
            "Mirai",
            "Pdf.phishing.ttraffrobotinstall-7605656-0",
            "Win.keylogger.susppack-9876601-0"
          ],
          "industries": [
            "Telecommunications",
            "Technology",
            "Civil society"
          ],
          "unique_indicators": 54954
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/awsdns-01.net",
    "whois": "http://whois.domaintools.com/awsdns-01.net",
    "domain": "awsdns-01.net",
    "hostname": "ns-523.awsdns-01.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "69f2dc7e076cbfe2d0f7eb90",
      "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
      "description": "",
      "modified": "2026-05-30T00:28:12.957000",
      "created": "2026-04-30T04:37:18.870000",
      "tags": [
        "united",
        "as397240",
        "search",
        "showing",
        "as54113",
        "as397241",
        "unknown",
        "moved",
        "creation date",
        "record value",
        "next",
        "date",
        "body",
        "a domains",
        "passive dns",
        "formbook cnc",
        "checkin",
        "entries",
        "github pages",
        "sea x",
        "accept",
        "status",
        "name servers",
        "certificate",
        "urls",
        "aaaa",
        "cname",
        "meta",
        "whitelisted ip",
        "address",
        "location united",
        "asn as36459",
        "github",
        "less whois",
        "registrar",
        "markmonitor",
        "related tags",
        "as36459",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "ninite",
        "expiration date",
        "domain",
        "hostname",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "document file",
        "v2 document",
        "utf8",
        "crlf line",
        "beginstring",
        "size",
        "null",
        "hybrid",
        "refresh",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "url https",
        "tulach type",
        "role title",
        "added active",
        "pulses url",
        "url http",
        "nextc type",
        "type indicator",
        "related pulses",
        "filehashsha256",
        "copyright",
        "ipv6",
        "germany",
        "italy",
        "trojan",
        "trojanspy",
        "worm",
        "trojanclicker",
        "virtool",
        "service",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "collisionbox",
        "runner",
        "gameoverpanel",
        "trex",
        "orgtechhandle",
        "orgtechref",
        "director",
        "university",
        "nethandle",
        "net168",
        "net1680000",
        "ucha",
        "orgid",
        "east",
        "report spam",
        "as8075",
        "servers",
        "secure server",
        "error all",
        "typeof",
        "error f",
        "crazy doll",
        "created",
        "filehashmd5",
        "types of",
        "russia",
        "emotet type",
        "mirai type",
        "mirai",
        "mtb description",
        "win32 type",
        "as31034 aruba",
        "italy unknown",
        "as19527 google",
        "encrypt",
        "health type",
        "miori hackers",
        "brute force",
        "backdoor",
        "aurora",
        "ip address",
        "path",
        "unis",
        "dotcisoffer",
        "bladabindi",
        "artro",
        "script urls",
        "as46606",
        "brazil unknown",
        "as11284",
        "as10906",
        "apache",
        "lanc type",
        "telper",
        "win32",
        "win64",
        "pulses email",
        "as9009 m247",
        "as7296 alchemy",
        "as14061",
        "as16276",
        "trojandropper",
        "ransom",
        "mtb sep",
        "msie",
        "chrome",
        "ip check",
        "gmt content",
        "pulse submit",
        "url analysis",
        "files ip",
        "aaaa nxdomain",
        "nxdomain",
        "a nxdomain",
        "as22612",
        "dnssec",
        "meta http",
        "accept encoding",
        "request id",
        "united kingdom",
        "div div",
        "arial helvetica",
        "emails",
        "as15169 google",
        "cryp",
        "gmt cache",
        "sameorigin",
        "domain name",
        "code",
        "false",
        "command type",
        "roleselfservice",
        "mcig sep",
        "all search",
        "author avatar",
        "days ago",
        "http",
        "related nids",
        "files location",
        "as30081",
        "gmt contenttype",
        "mozilla",
        "as15133 verizon",
        "whitelisted",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "softcnapp",
        "overview ip",
        "flag united",
        "files related",
        "as62597 nsone",
        "as31898 oracle",
        "mtb aug",
        "class",
        "twitter",
        "april",
        "secure",
        "httponly",
        "expiresthu",
        "pragma",
        "as13414 twitter",
        "smoke loader",
        "reverse dns",
        "asnone united",
        "idlogin sep",
        "uid38009",
        "expiration",
        "hack type",
        "porn type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Aruba"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66fc29a49b5ac693c8d75122",
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3851,
        "FileHash-MD5": 6012,
        "FileHash-SHA1": 5906,
        "domain": 3330,
        "email": 33,
        "hostname": 4231,
        "CVE": 2,
        "FileHash-SHA256": 8407,
        "CIDR": 2,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 31781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "1 day ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f2dc7db0bb5c5cdaec5a6c",
      "name": "credit scoreblue [Medical Campus - Aurora, Co | Recheck]",
      "description": "",
      "modified": "2026-04-30T04:53:09.713000",
      "created": "2026-04-30T04:37:17.546000",
      "tags": [
        "united",
        "as397240",
        "search",
        "showing",
        "as54113",
        "as397241",
        "unknown",
        "moved",
        "creation date",
        "record value",
        "next",
        "date",
        "body",
        "a domains",
        "passive dns",
        "formbook cnc",
        "checkin",
        "entries",
        "github pages",
        "sea x",
        "accept",
        "status",
        "name servers",
        "certificate",
        "urls",
        "aaaa",
        "cname",
        "meta",
        "whitelisted ip",
        "address",
        "location united",
        "asn as36459",
        "github",
        "less whois",
        "registrar",
        "markmonitor",
        "related tags",
        "as36459",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "ninite",
        "expiration date",
        "domain",
        "hostname",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "document file",
        "v2 document",
        "utf8",
        "crlf line",
        "beginstring",
        "size",
        "null",
        "hybrid",
        "refresh",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "url https",
        "tulach type",
        "role title",
        "added active",
        "pulses url",
        "url http",
        "nextc type",
        "type indicator",
        "related pulses",
        "filehashsha256",
        "copyright",
        "ipv6",
        "germany",
        "italy",
        "trojan",
        "trojanspy",
        "worm",
        "trojanclicker",
        "virtool",
        "service",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "collisionbox",
        "runner",
        "gameoverpanel",
        "trex",
        "orgtechhandle",
        "orgtechref",
        "director",
        "university",
        "nethandle",
        "net168",
        "net1680000",
        "ucha",
        "orgid",
        "east",
        "report spam",
        "as8075",
        "servers",
        "secure server",
        "error all",
        "typeof",
        "error f",
        "crazy doll",
        "created",
        "filehashmd5",
        "types of",
        "russia",
        "emotet type",
        "mirai type",
        "mirai",
        "mtb description",
        "win32 type",
        "as31034 aruba",
        "italy unknown",
        "as19527 google",
        "encrypt",
        "health type",
        "miori hackers",
        "brute force",
        "backdoor",
        "aurora",
        "ip address",
        "path",
        "unis",
        "dotcisoffer",
        "bladabindi",
        "artro",
        "script urls",
        "as46606",
        "brazil unknown",
        "as11284",
        "as10906",
        "apache",
        "lanc type",
        "telper",
        "win32",
        "win64",
        "pulses email",
        "as9009 m247",
        "as7296 alchemy",
        "as14061",
        "as16276",
        "trojandropper",
        "ransom",
        "mtb sep",
        "msie",
        "chrome",
        "ip check",
        "gmt content",
        "pulse submit",
        "url analysis",
        "files ip",
        "aaaa nxdomain",
        "nxdomain",
        "a nxdomain",
        "as22612",
        "dnssec",
        "meta http",
        "accept encoding",
        "request id",
        "united kingdom",
        "div div",
        "arial helvetica",
        "emails",
        "as15169 google",
        "cryp",
        "gmt cache",
        "sameorigin",
        "domain name",
        "code",
        "false",
        "command type",
        "roleselfservice",
        "mcig sep",
        "all search",
        "author avatar",
        "days ago",
        "http",
        "related nids",
        "files location",
        "as30081",
        "gmt contenttype",
        "mozilla",
        "as15133 verizon",
        "whitelisted",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "softcnapp",
        "overview ip",
        "flag united",
        "files related",
        "as62597 nsone",
        "as31898 oracle",
        "mtb aug",
        "class",
        "twitter",
        "april",
        "secure",
        "httponly",
        "expiresthu",
        "pragma",
        "as13414 twitter",
        "smoke loader",
        "reverse dns",
        "asnone united",
        "idlogin sep",
        "uid38009",
        "expiration",
        "hack type",
        "porn type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Aruba"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66fc29a49b5ac693c8d75122",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3851,
        "FileHash-MD5": 6012,
        "FileHash-SHA1": 5906,
        "domain": 3330,
        "email": 33,
        "hostname": 4231,
        "CVE": 2,
        "FileHash-SHA256": 8407,
        "CIDR": 2,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 31781,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "31 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66fc29a49b5ac693c8d75122",
      "name": "Medical Campus - Aurora, Co | Recheck",
      "description": "This weekend we found a busybox MIORI Hackers - serious attack Aurora, Medical Campus -Mirai. This recheck is generic. All results generated automatically by LevelBlue, sourced by ScoreBlue.\nMaybe it will be clean today. Complaints of pop up auto logins on locked screens and autonomous system running alongside actual system. System root.\nMalware Families:\nTrojanDownloader:Win32/Bulilit, ELF:Mirai-TO\\ [Trj], Backdoor:Linux/Mirai.B, TELPER:HSTR:DotCisOffer, TrojanSpy:Win32/Nivdort, Backdoor:Win32/Bladabindi, ALF:E5, Win.Malware.Midie-9950743-0, Trojan:Win32/Emotet.ARJ!MTB",
      "modified": "2024-10-31T16:03:52.240000",
      "created": "2024-10-01T16:56:04.004000",
      "tags": [
        "united",
        "as397240",
        "search",
        "showing",
        "as54113",
        "as397241",
        "unknown",
        "moved",
        "creation date",
        "record value",
        "next",
        "date",
        "body",
        "a domains",
        "passive dns",
        "formbook cnc",
        "checkin",
        "entries",
        "github pages",
        "sea x",
        "accept",
        "status",
        "name servers",
        "certificate",
        "urls",
        "aaaa",
        "cname",
        "meta",
        "whitelisted ip",
        "address",
        "location united",
        "asn as36459",
        "github",
        "less whois",
        "registrar",
        "markmonitor",
        "related tags",
        "as36459",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse pulses",
        "files",
        "ninite",
        "expiration date",
        "domain",
        "hostname",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "document file",
        "v2 document",
        "utf8",
        "crlf line",
        "beginstring",
        "size",
        "null",
        "hybrid",
        "refresh",
        "span",
        "local",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "contact",
        "url https",
        "tulach type",
        "role title",
        "added active",
        "pulses url",
        "url http",
        "nextc type",
        "type indicator",
        "related pulses",
        "filehashsha256",
        "copyright",
        "ipv6",
        "germany",
        "italy",
        "trojan",
        "trojanspy",
        "worm",
        "trojanclicker",
        "virtool",
        "service",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "collisionbox",
        "runner",
        "gameoverpanel",
        "trex",
        "orgtechhandle",
        "orgtechref",
        "director",
        "university",
        "nethandle",
        "net168",
        "net1680000",
        "ucha",
        "orgid",
        "east",
        "report spam",
        "as8075",
        "servers",
        "secure server",
        "error all",
        "typeof",
        "error f",
        "crazy doll",
        "created",
        "filehashmd5",
        "types of",
        "russia",
        "emotet type",
        "mirai type",
        "mirai",
        "mtb description",
        "win32 type",
        "as31034 aruba",
        "italy unknown",
        "as19527 google",
        "encrypt",
        "health type",
        "miori hackers",
        "brute force",
        "backdoor",
        "aurora",
        "ip address",
        "path",
        "unis",
        "dotcisoffer",
        "bladabindi",
        "artro",
        "script urls",
        "as46606",
        "brazil unknown",
        "as11284",
        "as10906",
        "apache",
        "lanc type",
        "telper",
        "win32",
        "win64",
        "pulses email",
        "as9009 m247",
        "as7296 alchemy",
        "as14061",
        "as16276",
        "trojandropper",
        "ransom",
        "mtb sep",
        "msie",
        "chrome",
        "ip check",
        "gmt content",
        "pulse submit",
        "url analysis",
        "files ip",
        "aaaa nxdomain",
        "nxdomain",
        "a nxdomain",
        "as22612",
        "dnssec",
        "meta http",
        "accept encoding",
        "request id",
        "united kingdom",
        "div div",
        "arial helvetica",
        "emails",
        "as15169 google",
        "cryp",
        "gmt cache",
        "sameorigin",
        "domain name",
        "code",
        "false",
        "command type",
        "roleselfservice",
        "mcig sep",
        "all search",
        "author avatar",
        "days ago",
        "http",
        "related nids",
        "files location",
        "as30081",
        "gmt contenttype",
        "mozilla",
        "as15133 verizon",
        "whitelisted",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "softcnapp",
        "overview ip",
        "flag united",
        "files related",
        "as62597 nsone",
        "as31898 oracle",
        "mtb aug",
        "class",
        "twitter",
        "april",
        "secure",
        "httponly",
        "expiresthu",
        "pragma",
        "as13414 twitter",
        "smoke loader",
        "reverse dns",
        "asnone united",
        "idlogin sep",
        "uid38009",
        "expiration",
        "hack type",
        "porn type"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Italy",
        "Aruba"
      ],
      "malware_families": [
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Artro",
          "display_name": "Artro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 53,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3850,
        "FileHash-MD5": 6012,
        "FileHash-SHA1": 5906,
        "domain": 3329,
        "email": 33,
        "hostname": 4231,
        "CVE": 2,
        "FileHash-SHA256": 8407,
        "CIDR": 2,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 31779,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 236,
      "modified_text": "576 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "665bb7679843a6dabe4560e3",
      "name": "USZoom [New York , USA] | iPostal1 | Where's my check & mailbox?",
      "description": "According to some victims, malicious activities including/ not limited to mail filtering fulfillment center resulting in lost, tampered with, opened and glue sealed mail. Missing private documents, payment scams, needless recurring monthly fees, CSR call redirections to unaffiliated personnel. The system has been in the DW for several years. This is due to no fault of franchise owners. Bounty hunters, hackers, and cyber and mail thieves, potential aggressive law enforcement tacticts. Some use mailbox addresses for nefarious purposes, while others use it for business and address confidentiality. \n\nAuto generated: iPostal1 is the largest digital mailbox provider in the world, providing secure, easy-to-use digital mail solutions for individuals, small businesses and large businesses, and driving revenue for Workspaces.",
      "modified": "2024-09-05T06:11:17.325000",
      "created": "2024-06-02T00:05:59.160000",
      "tags": [
        "strong",
        "story contact",
        "us leadership",
        "open menu",
        "close menu",
        "digital",
        "thank",
        "us zoom",
        "skip",
        "content home",
        "enterprise",
        "contact",
        "threat roundup",
        "august",
        "historical ssl",
        "april",
        "referrer",
        "formbook",
        "ip check",
        "vt graph",
        "relacionada",
        "cobalt strike",
        "hiddentear",
        "life",
        "malware",
        "open",
        "mumblehard",
        "sparkrat",
        "attack",
        "uszoom og",
        "submission",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "graph api",
        "status",
        "content type",
        "date",
        "anchor hrefs",
        "hrefs",
        "cart contact",
        "leadership",
        "html info",
        "title uszoom",
        "meta tags",
        "uszoom twitter",
        "script tags",
        "vhash htm",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "magika cttxt",
        "file size",
        "united",
        "as20940",
        "aaaa",
        "canada",
        "search",
        "showing",
        "cname",
        "as35994 akamai",
        "passive dns",
        "next",
        "as21928",
        "unknown",
        "urls",
        "domain",
        "creation date",
        "emails",
        "ipcounsel",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "invalid url",
        "body",
        "name servers",
        "akamai",
        "expiration date",
        "asnone united",
        "a nxdomain",
        "india",
        "as15224 adobe",
        "bdclid",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "yara rule",
        "high",
        "explorer",
        "alerts",
        "less see",
        "contacted",
        "service",
        "attempts",
        "guard",
        "url http",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "ip related",
        "hostname",
        "files ip",
        "address domain",
        "as46606",
        "td td",
        "script script",
        "gmt path",
        "create",
        "website",
        "set cookie",
        "a td",
        "win32",
        "flash",
        "pragma",
        "cookie",
        "xmpmm",
        "png image",
        "rgba",
        "documentid",
        "instanceid",
        "creatortool",
        "pattern match",
        "adobe photoshop",
        "macintosh",
        "june",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "anomalous_deletefile",
        "info_stealer",
        "et trojan",
        "banload http",
        "banload",
        "ids detections",
        "yara detections",
        "bancos variant",
        "c2 checkin",
        "ntkrnlpacker",
        "copy",
        "meredrop",
        "injection",
        "e0e2edee",
        "push",
        "read",
        "write",
        "delete",
        "entries",
        "crlf line",
        "anomalous file",
        "medium",
        "filehash",
        "av detections",
        "analysis date",
        "file score",
        "medium risk",
        "detections none",
        "related pulses",
        "apple",
        "apple id",
        "apple private data collection",
        "apple staging",
        "t-mobile",
        "metroby",
        "keylogger"
      ],
      "references": [
        "https://uszoom.com/",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Malicious Score: 10",
        "Yara Detections: DotNET_Reactor",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Keylogger.Susppack-9876601-0",
          "display_name": "Win.Keylogger.Susppack-9876601-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Sdum-9807706-0",
          "display_name": "Win.Trojan.Sdum-9807706-0",
          "target": null
        },
        {
          "id": "Win32.Meredrop Checkin",
          "display_name": "Win32.Meredrop Checkin",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "target": null
        },
        {
          "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1048.002",
          "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1198",
          "name": "SIP and Trust Provider Hijacking",
          "display_name": "T1198 - SIP and Trust Provider Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1434",
          "name": "App Delivered via Email Attachment",
          "display_name": "T1434 - App Delivered via Email Attachment"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 8,
        "FileHash-MD5": 167,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 2008,
        "URL": 11241,
        "domain": 1853,
        "hostname": 4198,
        "SSLCertFingerprint": 10,
        "CVE": 1
      },
      "indicator_count": 19615,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "632 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6681f6738d3aa876f83738d0",
      "name": "USZoom [New York , USA] | iPostal1",
      "description": "",
      "modified": "2024-07-01T23:00:42.052000",
      "created": "2024-07-01T00:21:07.491000",
      "tags": [
        "strong",
        "story contact",
        "us leadership",
        "open menu",
        "close menu",
        "digital",
        "thank",
        "us zoom",
        "skip",
        "content home",
        "enterprise",
        "contact",
        "threat roundup",
        "august",
        "historical ssl",
        "april",
        "referrer",
        "formbook",
        "ip check",
        "vt graph",
        "relacionada",
        "cobalt strike",
        "hiddentear",
        "life",
        "malware",
        "open",
        "mumblehard",
        "sparkrat",
        "attack",
        "uszoom og",
        "submission",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "graph api",
        "status",
        "content type",
        "date",
        "anchor hrefs",
        "hrefs",
        "cart contact",
        "leadership",
        "html info",
        "title uszoom",
        "meta tags",
        "uszoom twitter",
        "script tags",
        "vhash htm",
        "ssdeep",
        "file type",
        "html internet",
        "magic html",
        "ascii text",
        "trid file",
        "magika cttxt",
        "file size",
        "united",
        "as20940",
        "aaaa",
        "canada",
        "search",
        "showing",
        "cname",
        "as35994 akamai",
        "passive dns",
        "next",
        "as21928",
        "unknown",
        "urls",
        "domain",
        "creation date",
        "emails",
        "ipcounsel",
        "scan endpoints",
        "all scoreblue",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "invalid url",
        "body",
        "name servers",
        "akamai",
        "expiration date",
        "asnone united",
        "a nxdomain",
        "india",
        "as15224 adobe",
        "bdclid",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "yara rule",
        "high",
        "explorer",
        "alerts",
        "less see",
        "contacted",
        "service",
        "attempts",
        "guard",
        "url http",
        "pulse pulses",
        "http",
        "related nids",
        "files location",
        "ip related",
        "hostname",
        "files ip",
        "address domain",
        "as46606",
        "td td",
        "script script",
        "gmt path",
        "create",
        "website",
        "set cookie",
        "a td",
        "win32",
        "flash",
        "pragma",
        "cookie",
        "xmpmm",
        "png image",
        "rgba",
        "documentid",
        "instanceid",
        "creatortool",
        "pattern match",
        "adobe photoshop",
        "macintosh",
        "june",
        "hybrid",
        "local",
        "encrypt",
        "click",
        "strings",
        "anomalous_deletefile",
        "info_stealer",
        "et trojan",
        "banload http",
        "banload",
        "ids detections",
        "yara detections",
        "bancos variant",
        "c2 checkin",
        "ntkrnlpacker",
        "copy",
        "meredrop",
        "injection",
        "e0e2edee",
        "push",
        "read",
        "write",
        "delete",
        "entries",
        "crlf line",
        "anomalous file",
        "medium",
        "filehash",
        "av detections",
        "analysis date",
        "file score",
        "medium risk",
        "detections none",
        "related pulses",
        "apple",
        "apple id",
        "apple private data collection",
        "apple staging",
        "t-mobile",
        "metroby",
        "keylogger"
      ],
      "references": [
        "https://uszoom.com/",
        "http://www.dead-speak.com/ElectronicVoicePhenomena_EVP.htm",
        "Malicious Score: 10",
        "Yara Detections: DotNET_Reactor",
        "Alerts: procmem_yara antisandbox_sleep persistence_autorun cape_detected_threat infostealer_cookies recon_fingerprint",
        "Alerts: stealth_hidden_extension stealth_hiddenreg antidebug_guardpages dead_connect",
        "Alerts: encrypted_ioc http_request  powershell_download powershell_request dynamic_function_loading cape_extracted_content",
        "Alerts: dropper injection_rwx network_dns_doh_tls network_http",
        "DotNET_Reactor: System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography",
        "DotNET_Reactor: System.Security.Cryptography ICryptoTransform",
        "High Priority Check-ins: Banload HTTP Checkin Detected (envia.php) Win32.Meredrop Checkin Bancos Variant C2 Checkin 1",
        "High Priority Alerts: spawns_dev_util modify_proxy infostealer_cookies",
        "Yara Detections: NTKrnlPacker, NTkrnlSecureSuite01015NTkrnlSoftware, NTkrnlSecureSuiteNTkrnlteam",
        "https://otx.alienvault.com/indicator/file/01accdb2c75f7b75e5f9744461fe927e6e1378e3bc1f943d02b0aa441bf65317",
        "https://www.hybrid-analysis.com/sample/79cab9c299164fb9a6d8f009adc2529ee79feeb0b4ad383eedee0c36bbe041ec/665b7ebee6b33f252d0e64ec",
        "Yara Detections stack_string ,  Armadillov1xxv2xx",
        "https://otx.alienvault.com/indicator/file/4d1dbf5ccc25a7f5fa24bd48d92987ff6d4dba35",
        "apple.finder-idevice.com | nr-data.net | https://appleid.com-dispositivo-perdido.com/ |"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Keylogger.Susppack-9876601-0",
          "display_name": "Win.Keylogger.Susppack-9876601-0",
          "target": null
        },
        {
          "id": "Win.Trojan.Sdum-9807706-0",
          "display_name": "Win.Trojan.Sdum-9807706-0",
          "target": null
        },
        {
          "id": "Win32.Meredrop Checkin",
          "display_name": "Win32.Meredrop Checkin",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "display_name": "#Lowfi:HSTR:TrojanSpy:Win32/Bancos",
          "target": null
        },
        {
          "id": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "display_name": "Pdf.Phishing.TtraffRobotInstall-7605656-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1048.002",
          "name": "Exfiltration Over Asymmetric Encrypted Non-C2 Protocol",
          "display_name": "T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol"
        },
        {
          "id": "T1102.002",
          "name": "Bidirectional Communication",
          "display_name": "T1102.002 - Bidirectional Communication"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1184",
          "name": "SSH Hijacking",
          "display_name": "T1184 - SSH Hijacking"
        },
        {
          "id": "T1198",
          "name": "SIP and Trust Provider Hijacking",
          "display_name": "T1198 - SIP and Trust Provider Hijacking"
        },
        {
          "id": "T1416",
          "name": "URI Hijacking",
          "display_name": "T1416 - URI Hijacking"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1434",
          "name": "App Delivered via Email Attachment",
          "display_name": "T1434 - App Delivered via Email Attachment"
        }
      ],
      "industries": [
        "Technology",
        "Telecommunications",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": "665bb7679843a6dabe4560e3",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "email": 8,
        "FileHash-MD5": 167,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1890,
        "URL": 10360,
        "domain": 1799,
        "hostname": 3994,
        "SSLCertFingerprint": 10,
        "CVE": 1
      },
      "indicator_count": 18358,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "698 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708fe97242b201bad932be",
      "name": "GitHub - jh00nbr/sebrae_licitacoes_crawler: Sebrae Licitacoes Crawler",
      "description": "",
      "modified": "2023-12-06T15:14:49.557000",
      "created": "2023-12-06T15:14:49.557000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 273,
        "hostname": 423,
        "domain": 254,
        "URL": 435,
        "FileHash-SHA1": 2,
        "email": 4,
        "FileHash-MD5": 2
      },
      "indicator_count": 1393,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "906 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "62bc2dc6c1c5ac64fe297b85",
      "name": "GitHub - jh00nbr/sebrae_licitacoes_crawler: Sebrae Licitacoes Crawler",
      "description": "Sebastian Clark - Essex's was centraserve.com\nstole my domains 1 of those domains  getsetpet.co.uk and abused via cross-breed-profiles pages which was moved to google hosting\nsholwill.co.uk -shows only 1 pdf upload. so mych data is missing from the history of the 20 odd domains that I owned",
      "modified": "2022-07-29T00:00:24.010000",
      "created": "2022-06-29T10:47:34",
      "tags": [
        "centraserve ltd",
        "buy domain",
        "names",
        "buy company",
        "number",
        "my index",
        "company",
        "books",
        "dvds",
        "computer games",
        "github",
        "jump",
        "sign",
        "github sponsors",
        "strong",
        "repository",
        "code issues",
        "pull",
        "wiki security",
        "view",
        "contact",
        "star",
        "code",
        "ghost",
        "stars",
        "windows",
        "safe exam",
        "browser",
        "exam browser",
        "spring",
        "mozilla",
        "xcode",
        "apple",
        "xcode project",
        "search",
        "seb how",
        "support",
        "caps",
        "field",
        "scrapysebug",
        "python",
        "xulrunner",
        "download",
        "stefan",
        "shell",
        "sebuilder",
        "firefox",
        "new relic",
        "yourprofile",
        "builder",
        "important",
        "sebuilder v2",
        "synthetics",
        "tools",
        "launch",
        "write",
        "click",
        "sebrae",
        "quantidade",
        "crawler",
        "banco"
      ],
      "references": [
        "https://github.com/jh00nbr/sebrae_licitacoes_crawler",
        "https://github.com/sschwartzman/newrelic-synthetics-sebuilder",
        "https://github.com/eqsoft/seb",
        "https://github.com/Hongxs/scrapy-sebug",
        "https://github.com/SafeExamBrowser/seb-mac",
        "https://github.com/SafeExamBrowser/seb-win",
        "https://github.com/sebastianruder/sebastianruder",
        "https://github.com/jh00nbr/sebrae_licitacoes_crawler/commit/8ac1601bca371820755671f205ffdbfd12f72311/rollup",
        "https://centraserve.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 512,
        "hostname": 482,
        "domain": 276,
        "FileHash-SHA256": 294,
        "FileHash-SHA1": 2,
        "email": 4,
        "FileHash-MD5": 2
      },
      "indicator_count": 1572,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 392,
      "modified_text": "1402 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns-523.awsdns-01.net",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns-523.awsdns-01.net",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780204139.037224
}