{
  "type": "URL",
  "indicator": "https://ns4.whichkill.net/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://ns4.whichkill.net/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4121233614,
      "indicator": "https://ns4.whichkill.net/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "68a23eef53f1124e8dc273fc",
          "name": "Sign in to your account - Anorocuriv",
          "description": "Short link sent to an iPhone user possibly by accident or maybe not. Unraveled :[https://ns4.whichkill.net/]\n[https://l.us-1.a.mimecastprotect.com/l]\n[https://api-glintstage.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\n\n[https://api.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\t\n\n*api.us1.glintinc.com #malta\n*ALF:Trojan:Win32/Anorocuriv.A.#virtool #LowFI:HookwowLow \n#tracking #tiaa #locate recording #userpics #movies #audio #screen #mobile_assets #https://biccerija.gov.mt/en/contact/",
          "modified": "2025-09-16T20:00:00.565000",
          "created": "2025-08-17T20:43:27.502000",
          "tags": [
            "url http",
            "url https",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "entries",
            "status",
            "msie",
            "chrome",
            "passive dns",
            "urls",
            "date",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "body",
            "http",
            "hostname",
            "files domain",
            "present jan",
            "present dec",
            "united",
            "present aug",
            "present jun",
            "unknown aaaa",
            "present mar",
            "present may",
            "present feb",
            "present jul",
            "error",
            "a domains",
            "gmt content",
            "accept encoding",
            "config nocache",
            "hostname add",
            "pulse submit",
            "content type",
            "certificate",
            "ip address",
            "cookie",
            "mita",
            "next associated",
            "please",
            "x msedge",
            "ipv4 add",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "size",
            "pattern match",
            "mitre att",
            "ascii text",
            "null",
            "click",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "refresh",
            "tools",
            "meta",
            "onload",
            "span",
            "adversaries",
            "ssl certificate",
            "logo",
            "av detection",
            "default browser",
            "guest system",
            "professional",
            "falcon sandbox",
            "response risk",
            "ck techniques",
            "detection",
            "show process",
            "prefetch8",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "post collect",
            "microsoft edge",
            "nota",
            "brand",
            "class",
            "facebook",
            "ascii",
            "hex dump",
            "extraction",
            "failed",
            "data upload",
            "pul data",
            "enter",
            "s data",
            "type",
            "extr error",
            "href",
            "mask",
            "extra",
            "uta support",
            "include review",
            "exclude sugges",
            "find",
            "wow64",
            "show",
            "observed dns",
            "query",
            "unknown",
            "virtool",
            "copy",
            "write",
            "defender",
            "expiro",
            "malware",
            "next",
            "lowfi",
            "hookwowlow dec",
            "mtb jan",
            "mtb nov",
            "hookwowlow nov",
            "trojan",
            "trojandropper",
            "http request",
            "delete",
            "yara detections",
            "pe exe",
            "dll windows",
            "minimal http",
            "february",
            "guard",
            "alerts",
            "analysis date",
            "file score",
            "detections alf",
            "detections http",
            "http executable",
            "retrieved",
            "location united",
            "america flag",
            "america asn",
            "urls show",
            "date checked",
            "url hostname",
            "server response"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 853,
            "hostname": 1835,
            "URL": 7127,
            "email": 3,
            "FileHash-SHA256": 1470,
            "FileHash-MD5": 293,
            "FileHash-SHA1": 284,
            "SSLCertFingerprint": 426,
            "CVE": 1
          },
          "indicator_count": 12292,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "215 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 12357
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/whichkill.net",
    "whois": "http://whois.domaintools.com/whichkill.net",
    "domain": "whichkill.net",
    "hostname": "ns4.whichkill.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "68a23eef53f1124e8dc273fc",
      "name": "Sign in to your account - Anorocuriv",
      "description": "Short link sent to an iPhone user possibly by accident or maybe not. Unraveled :[https://ns4.whichkill.net/]\n[https://l.us-1.a.mimecastprotect.com/l]\n[https://api-glintstage.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\n\n[https://api.glintinc.com/api/client/tiaa/token/saml2/consume/includeDeskLink]\t\n\n*api.us1.glintinc.com #malta\n*ALF:Trojan:Win32/Anorocuriv.A.#virtool #LowFI:HookwowLow \n#tracking #tiaa #locate recording #userpics #movies #audio #screen #mobile_assets #https://biccerija.gov.mt/en/contact/",
      "modified": "2025-09-16T20:00:00.565000",
      "created": "2025-08-17T20:43:27.502000",
      "tags": [
        "url http",
        "url https",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "entries",
        "status",
        "msie",
        "chrome",
        "passive dns",
        "urls",
        "date",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "body",
        "http",
        "hostname",
        "files domain",
        "present jan",
        "present dec",
        "united",
        "present aug",
        "present jun",
        "unknown aaaa",
        "present mar",
        "present may",
        "present feb",
        "present jul",
        "error",
        "a domains",
        "gmt content",
        "accept encoding",
        "config nocache",
        "hostname add",
        "pulse submit",
        "content type",
        "certificate",
        "ip address",
        "cookie",
        "mita",
        "next associated",
        "please",
        "x msedge",
        "ipv4 add",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "size",
        "pattern match",
        "mitre att",
        "ascii text",
        "null",
        "click",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "refresh",
        "tools",
        "meta",
        "onload",
        "span",
        "adversaries",
        "ssl certificate",
        "logo",
        "av detection",
        "default browser",
        "guest system",
        "professional",
        "falcon sandbox",
        "response risk",
        "ck techniques",
        "detection",
        "show process",
        "prefetch8",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "post collect",
        "microsoft edge",
        "nota",
        "brand",
        "class",
        "facebook",
        "ascii",
        "hex dump",
        "extraction",
        "failed",
        "data upload",
        "pul data",
        "enter",
        "s data",
        "type",
        "extr error",
        "href",
        "mask",
        "extra",
        "uta support",
        "include review",
        "exclude sugges",
        "find",
        "wow64",
        "show",
        "observed dns",
        "query",
        "unknown",
        "virtool",
        "copy",
        "write",
        "defender",
        "expiro",
        "malware",
        "next",
        "lowfi",
        "hookwowlow dec",
        "mtb jan",
        "mtb nov",
        "hookwowlow nov",
        "trojan",
        "trojandropper",
        "http request",
        "delete",
        "yara detections",
        "pe exe",
        "dll windows",
        "minimal http",
        "february",
        "guard",
        "alerts",
        "analysis date",
        "file score",
        "detections alf",
        "detections http",
        "http executable",
        "retrieved",
        "location united",
        "america flag",
        "america asn",
        "urls show",
        "date checked",
        "url hostname",
        "server response"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 853,
        "hostname": 1835,
        "URL": 7127,
        "email": 3,
        "FileHash-SHA256": 1470,
        "FileHash-MD5": 293,
        "FileHash-SHA1": 284,
        "SSLCertFingerprint": 426,
        "CVE": 1
      },
      "indicator_count": 12292,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "215 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://ns4.whichkill.net/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://ns4.whichkill.net/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630045.6308584
}