{
  "type": "URL",
  "indicator": "https://o.filter.call",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://o.filter.call",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3195444049,
      "indicator": "https://o.filter.call",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 34,
      "pulses": [
        {
          "id": "6608aaf7ca0e965e593ed1d4",
          "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e",
          "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.",
          "modified": "2025-10-17T11:03:07.034000",
          "created": "2024-03-31T00:14:47.183000",
          "tags": [
            "sha256",
            "ssdeep",
            "reputacja",
            "tworzy pliki",
            "informacje",
            "bardzo duga",
            "tworzy",
            "adresy url",
            "tworzy katalog",
            "win64",
            "ameryki",
            "typ pliku",
            "serwer nazw",
            "san jose",
            "adres",
            "digital",
            "data wyganicia",
            "csc corporate",
            "domains",
            "ca data",
            "data utworzenia",
            "dnssec"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6432,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2140,
            "hostname": 5874,
            "FileHash-SHA256": 12539,
            "FileHash-MD5": 3686,
            "FileHash-SHA1": 2751,
            "IPv4": 503,
            "URL": 10770,
            "email": 26,
            "CVE": 88,
            "YARA": 6,
            "JA3": 2,
            "IPv6": 28,
            "SSLCertFingerprint": 5,
            "BitcoinAddress": 3,
            "CIDR": 1
          },
          "indicator_count": 38422,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "184 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "663d2869e0f3a42bbddc42ff",
          "name": "UPX executable packer.",
          "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
          "modified": "2024-10-14T00:01:17.069000",
          "created": "2024-05-09T19:47:53.786000",
          "tags": [
            "cioch adrian",
            "centrum usug",
            "sieciowych",
            "elf binary",
            "upx compression",
            "roth",
            "nextron",
            "info",
            "javascript",
            "html",
            "office open",
            "xml document",
            "network capture",
            "win32 exe",
            "xml pakietu",
            "pdf zestawy",
            "przechwytywanie",
            "office",
            "filehashsha1",
            "url https",
            "cve cve20201070",
            "cve cve20203153",
            "cve cve20201048",
            "cve cve20211732",
            "cve20201048 apr",
            "filehashmd5",
            "cve cve20010901",
            "cve cve20021841",
            "cve20153202 apr",
            "cve cve20160728",
            "cve cve20161807",
            "cve cve20175123",
            "cve20185407 apr",
            "cve cve20054605",
            "cve cve20060745",
            "cve cve20070452",
            "cve cve20070453",
            "cve cve20070454",
            "cve cve20071355",
            "cve cve20071358",
            "cve cve20071871",
            "cve20149614 apr",
            "cve cve20151503",
            "cve cve20152080",
            "cve cve20157377",
            "cve cve20170131",
            "cve20200796 may",
            "cve cve20113403"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6861,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 5771,
            "domain": 3139,
            "URL": 14525,
            "FileHash-SHA1": 2610,
            "IPv4": 108,
            "CIDR": 40,
            "FileHash-SHA256": 10705,
            "FileHash-MD5": 3373,
            "YARA": 2,
            "CVE": 148,
            "Mutex": 7,
            "FilePath": 3,
            "SSLCertFingerprint": 3,
            "email": 23,
            "JA3": 1,
            "IPv6": 2
          },
          "indicator_count": 40460,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "553 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708eb824dc4c51811f6de9",
          "name": "Indusface  - in YOUR face ;)",
          "description": "",
          "modified": "2023-12-06T15:09:44.273000",
          "created": "2023-12-06T15:09:44.273000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 307,
            "hostname": 333,
            "domain": 192,
            "URL": 1143,
            "FileHash-MD5": 1
          },
          "indicator_count": 1976,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708d657f0895a860febf8f",
          "name": "SafeFrame Container",
          "description": "",
          "modified": "2023-12-06T15:04:05.932000",
          "created": "2023-12-06T15:04:05.932000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1416,
            "domain": 2979,
            "URL": 8250,
            "hostname": 2262
          },
          "indicator_count": 14907,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708cca842536f1582636be",
          "name": "apeiron.global",
          "description": "",
          "modified": "2023-12-06T15:01:30.558000",
          "created": "2023-12-06T15:01:30.558000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 498,
            "hostname": 388,
            "domain": 242,
            "CVE": 1,
            "URL": 1203,
            "FileHash-MD5": 1
          },
          "indicator_count": 2333,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708beba2ba8bcfb1d10237",
          "name": "hostkey - Industroyer&ReduceRight",
          "description": "",
          "modified": "2023-12-06T14:57:47.430000",
          "created": "2023-12-06T14:57:47.430000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 304,
            "hostname": 563,
            "domain": 407,
            "URL": 1776,
            "FileHash-SHA1": 2
          },
          "indicator_count": 3052,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65708aa1dca4e6c505e4fc9e",
          "name": "Botnet c&c",
          "description": "",
          "modified": "2023-12-06T14:52:16.286000",
          "created": "2023-12-06T14:52:16.286000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 214,
            "hostname": 334,
            "URL": 1182,
            "FileHash-SHA256": 33
          },
          "indicator_count": 1763,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657080d20f7e10c1e37fcf89",
          "name": "TarrantCounty.com ~ 03.01.2022",
          "description": "",
          "modified": "2023-12-06T14:10:26.301000",
          "created": "2023-12-06T14:10:26.301000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1078,
            "domain": 838,
            "hostname": 1607,
            "URL": 4134,
            "email": 3,
            "FileHash-SHA1": 2,
            "CIDR": 4,
            "FileHash-MD5": 15
          },
          "indicator_count": 7681,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "657080735501c11ddbb7a988",
          "name": "Dominionvoting.com 03.03.22",
          "description": "",
          "modified": "2023-12-06T14:08:51.329000",
          "created": "2023-12-06T14:08:51.329000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 663,
            "hostname": 588,
            "domain": 413,
            "URL": 2183,
            "FileHash-MD5": 7
          },
          "indicator_count": 3854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570805953274b32ec1f981b",
          "name": "Votebuilder.com",
          "description": "",
          "modified": "2023-12-06T14:08:25.588000",
          "created": "2023-12-06T14:08:25.588000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 869,
            "domain": 834,
            "URL": 4755,
            "hostname": 1559,
            "CIDR": 2,
            "FileHash-MD5": 10
          },
          "indicator_count": 8029,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707fe17dfdfe16066d16de",
          "name": "Bexar.org",
          "description": "",
          "modified": "2023-12-06T14:06:25.800000",
          "created": "2023-12-06T14:06:25.800000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1735,
            "hostname": 1833,
            "domain": 1025,
            "URL": 4668,
            "email": 4,
            "FileHash-MD5": 133,
            "FileHash-SHA1": 6,
            "CIDR": 5
          },
          "indicator_count": 9409,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "63f536f3d17c09ae380da074",
          "name": "webcomponents-sd-ce-pf_1_.js",
          "description": "",
          "modified": "2023-02-21T21:26:11.748000",
          "created": "2023-02-21T21:26:11.748000",
          "tags": [
            "memoryfile scan",
            "typeerror",
            "null",
            "polymer project",
            "trident",
            "generator",
            "void",
            "webcomponents-sd-ce-pf_1_.js",
            "f2c3f35a3349d92a4ce9a246fda9dc456df516c8f3d6006b219d21690575b75b",
            "c.insertbefore.call"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/f2c3f35a3349d92a4ce9a246fda9dc456df516c8f3d6006b219d21690575b75b/63f299f3c79eb479f661e947",
            "c.insertbefore.call - fail"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 723,
            "FileHash-SHA256": 39,
            "hostname": 171,
            "domain": 91,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 1
          },
          "indicator_count": 1030,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1153 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e1ca167a1591e7b4ca1129",
          "name": "VirusTotal view-source on https://www.virustotal.com/en/file/undefined/analysis/",
          "description": "someone really needs to figure out wtf this is all doing it has to be part of the net.sh",
          "modified": "2022-07-28T02:05:04.183000",
          "created": "2022-07-27T23:28:22.504000",
          "tags": [
            "array",
            "object",
            "typeof t",
            "layer1",
            "error",
            "path",
            "function",
            "typeerror",
            "date",
            "svg export",
            "span",
            "null",
            "unknown",
            "click",
            "february",
            "april",
            "june",
            "august",
            "this",
            "void",
            "bounce",
            "string",
            "regexp",
            "number",
            "sxa0",
            "amptoken",
            "optout",
            "notfound",
            "contenttype",
            "form",
            "copyright",
            "element",
            "polymer project",
            "authors",
            "bsd style",
            "code",
            "google",
            "software",
            "window",
            "generator",
            "comment",
            "trident",
            "typeof e",
            "typeof symbol",
            "typeof btoa",
            "btoa",
            "typeof reflect",
            "boolean",
            "customevent",
            "plugin",
            "build",
            "home",
            "intelligence",
            "graph",
            "report",
            "urls",
            "please",
            "javascript",
            "https://www.virustotal.com/en/file/undefined/analysis/",
            "net.sh"
          ],
          "references": [
            "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
            "14.main.bundle.91f9f7ff635e0b797de3.js",
            "5.main.bundle.e92e5e24e074f9c2a52b.js",
            "0.main.bundle.a9d68f5204cd3ac257b6.js",
            "webcomponent-polyfill.js",
            "analytics.js",
            "12.main.bundle.50be73a11d1d3745a5ee.js",
            "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
            "https://www.virustotal.com/en/file/undefined/analysis/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1538,
            "FileHash-SHA256": 138,
            "hostname": 363,
            "domain": 235
          },
          "indicator_count": 2274,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 391,
          "modified_text": "1362 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62752a3d78ce35783bfc85cc",
          "name": "SafeFrame Container",
          "description": "If you want to know what is going to happen when you create a non-iterable object, try these three pieces of code in the form of a new \"word\" or \"phrase\".",
          "modified": "2022-06-05T00:03:45.266000",
          "created": "2022-05-06T14:01:33.267000",
          "tags": [
            "public",
            "typeof",
            "typeof define",
            "array",
            "typeerror",
            "typeof symbol",
            "error",
            "typeof enulle",
            "sdkversion",
            "internal",
            "date",
            "cnzzdata",
            "czuuid",
            "umdistinctid",
            "typeof e",
            "typeof t",
            "version",
            "swiper",
            "most",
            "copyright",
            "mit license",
            "april",
            "trident",
            "win32",
            "class",
            "lh",
            "vd",
            "function",
            "overlaylevel",
            "zdhxiong",
            "customevent",
            "symbol",
            "object",
            "string",
            "number",
            "null",
            "uint8array",
            "typeof b",
            "iframe",
            "android",
            "embed",
            "meta",
            "0x14a",
            "0x104",
            "0x97",
            "0xe1",
            "0x228",
            "0x12b",
            "0x14e",
            "0xf5",
            "0x11a",
            "0xc6",
            "sxa0",
            "typeof d",
            "closure library",
            "array int8array",
            "b1342177279",
            "regexp",
            "typeof r",
            "pseudo",
            "child",
            "typeof n",
            "template",
            "void",
            "this",
            "ienew ca",
            "quota",
            "aafunction",
            "dafunction",
            "gc",
            "trackpageview",
            "trackevent",
            "gtmmdcvhgd",
            "node",
            "element",
            "path",
            "reduceright",
            "p420",
            "gc3w7t6h5qw",
            "kafunction",
            "fafafa",
            "xlfunction",
            "kkfunction",
            "nkfunction",
            "qkfunction",
            "rkfunction",
            "skfunction",
            "span",
            "edge",
            "bad idp",
            "bad event",
            "crios",
            "invalid attempt",
            "afunction",
            "ufunction",
            "kfunction"
          ],
          "references": [
            "xfe-URL-himado.com-stix2-2.1-export.json",
            "xfe-IP-146.148.236.187-stix2-2.1-export.json",
            "xfe-URL-Psychz.net-stix2-2.1-export.json",
            "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js",
            "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs",
            "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js",
            "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c",
            "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD",
            "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2",
            "https://himado.com/heihei/layui/layui.all.js",
            "https://securepubads.g.doubleclick.net/tag/js/gpt.js",
            "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000",
            "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js",
            "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js",
            "https://himado.com/heihei/js/swiper.min.js",
            "https://cdn.onesignal.com/sdks/OneSignalSDK.js",
            "https://c.cnzz.com/core.php?web_id=1280305902&t=z",
            "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902",
            "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js",
            "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html",
            "xfe-URL-Cnzz.com-stix2-2.1-export.json",
            "xfe-URL-Aliyun.com-stix2-2.1-export.json"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Lh",
              "display_name": "Lh",
              "target": null
            },
            {
              "id": "Gc",
              "display_name": "Gc",
              "target": null
            },
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            },
            {
              "id": "Vd",
              "display_name": "Vd",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2262,
            "URL": 8251,
            "FileHash-SHA256": 1416,
            "domain": 2979
          },
          "indicator_count": 14908,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 71,
          "modified_text": "1415 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62756a0d14664003affb0555",
          "name": "hush.com 301 to hushmail.com",
          "description": "var b[f, gw.b, \"dust\" - a.g - has been added to an Array by the end of the year, if there is any chance of it being added.",
          "modified": "2022-06-05T00:03:45.266000",
          "created": "2022-05-06T18:33:49.161000",
          "tags": [
            "widget",
            "null",
            "regexp",
            "array",
            "copyright",
            "license",
            "calltrkswap",
            "date",
            "typeof s",
            "xmlhttprequest",
            "typeof r",
            "script",
            "vd",
            "number",
            "string",
            "ienew ca",
            "closure library",
            "error",
            "quota",
            "aafunction",
            "dafunction",
            "function",
            "typeof o",
            "reduceright",
            "aw1070742489",
            "uint8array",
            "void",
            "code",
            "typeof symbol",
            "wickedclientid",
            "wickedemail",
            "wickedurl",
            "wickednullurl",
            "typeof e",
            "direct",
            "typeof require",
            "modulenotfound",
            "mini",
            "cnull",
            "anull",
            "nl50",
            "pnull",
            "okcancel",
            "compiled",
            "true",
            "android",
            "trident",
            "form",
            "window",
            "false",
            "acronym",
            "body",
            "canvas",
            "embed",
            "footer",
            "iframe",
            "keygen",
            "legend",
            "mark",
            "meta",
            "ruby",
            "small",
            "span",
            "template",
            "blank",
            "twitter",
            "typeof t",
            "class",
            "attr",
            "pseudo",
            "child",
            "js foundation",
            "typeof module",
            "width",
            "object",
            "this",
            "accept",
            "fnumber",
            "gtmmf25krh",
            "host",
            "path"
          ],
          "references": [
            "xfe-URL-Hush.com-stix2-2.1-export.json",
            "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c",
            "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH",
            "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js",
            "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js",
            "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js",
            "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js",
            "https://widget.wickedreports.com/widget.js",
            "https://www.googletagmanager.com/gtag/js?id=AW-1070742489",
            "https://www.hushmail.com/status/",
            "https://script.tapfiliate.com/tapfiliate.js",
            "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13",
            "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js",
            "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js",
            "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301",
            "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301",
            "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Vd",
              "display_name": "Vd",
              "target": null
            },
            {
              "id": "OkCancel",
              "display_name": "OkCancel",
              "target": null
            },
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1531",
              "name": "Account Access Removal",
              "display_name": "T1531 - Account Access Removal"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1917,
            "hostname": 698,
            "FileHash-SHA256": 116,
            "domain": 263
          },
          "indicator_count": 2994,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "1415 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6269a10ba1925979929dc566",
          "name": "apeiron.global",
          "description": "New RegExp(M) is a new type, and it will change any of the elements to the same type if you want to add them to your HTML page or add a third element.",
          "modified": "2022-05-27T00:00:15.468000",
          "created": "2022-04-27T20:01:15.714000",
          "tags": [
            "click",
            "getclicktarget",
            "date",
            "contexttrack",
            "view",
            "installtrigger",
            "processlink",
            "typeof blog",
            "msie",
            "image",
            "nonce",
            "script",
            "please do",
            "not copy",
            "and paste",
            "this code",
            "cgrecaptchacfg",
            "ngrecaptcha",
            "recaptchaapi",
            "render",
            "typeerror",
            "symbol",
            "error",
            "generator",
            "typeof e",
            "addtoany",
            "span",
            "facebook",
            "button",
            "helvetica neue",
            "subscribe",
            "email",
            "share",
            "arial",
            "helvetica",
            "light",
            "path",
            "discord",
            "find",
            "twitter",
            "push",
            "buttons",
            "typetext",
            "typeof intl",
            "intl",
            "event",
            "uefunction",
            "typeof define",
            "typeof module",
            "html tags",
            "ox20trnf",
            "dom element",
            "gc",
            "regexp",
            "typeof t",
            "class",
            "attr",
            "pseudo",
            "child",
            "function",
            "select",
            "string",
            "strong",
            "uint8array",
            "number",
            "edge",
            "null",
            "this",
            "iframe",
            "verify",
            "trident",
            "void",
            "next",
            "android",
            "stop",
            "enterprise",
            "form"
          ],
          "references": [
            "xfe-IP-103.136.42.186-stix2-2.1-export.json",
            "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js",
            "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js",
            "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js",
            "https://static.addtoany.com/menu/page.js",
            "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js",
            "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js",
            "https://stats.wp.com/e-202217.js",
            "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd",
            "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=",
            "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "GC",
              "display_name": "GC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 498,
            "domain": 242,
            "URL": 1203,
            "hostname": 388,
            "CVE": 1,
            "FileHash-MD5": 1
          },
          "indicator_count": 2333,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "1424 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "628d376ff4e346e1485cbea2",
          "name": "ZagreuS Ransomware Builder [ NEW! Ransomware as a Service ] - YouTube",
          "description": "If you want to find out more about this page, here is the full text of the code:w,c,S,R, E, T, Gd, W.S.",
          "modified": "2022-05-24T19:52:15.836000",
          "created": "2022-05-24T19:52:15.836000",
          "tags": [
            "video",
            "sharing",
            "camera phone",
            "video phone",
            "free",
            "upload",
            "builder",
            "ransomware",
            "service",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "google llc",
            "typeerror",
            "decorate",
            "customevent",
            "copyright",
            "error",
            "license",
            "array",
            "number",
            "typeof symbol",
            "generator",
            "matrix",
            "string",
            "date",
            "closure library",
            "xdfunction",
            "adfunction",
            "bdfunction",
            "lefunction",
            "qefunction",
            "0x589122",
            "0x543585",
            "0x5123f6",
            "0x1aac5a",
            "0x2762ce",
            "software",
            "a00x3d7e",
            "0x2bffcb",
            "0x4b870a",
            "0x2808ca",
            "push",
            "picasso",
            "phantom",
            "canvas",
            "nightmare",
            "slice",
            "shift",
            "hello",
            "object",
            "typeof e",
            "edge",
            "dataname",
            "intercom",
            "apple",
            "webkiti",
            "criosi",
            "trident",
            "xu",
            "select",
            "strong",
            "uint8array",
            "null",
            "math",
            "svoid",
            "this",
            "iframe",
            "verify",
            "android",
            "stop",
            "form",
            "body",
            "span",
            "enterprise",
            "click",
            "next"
          ],
          "references": [
            "https://www.gstatic.com/recaptcha/releases/1_E1Jb45wiBZrQd45oGZ-2cU/recaptcha__en.js",
            "https://www.iubenda.com/cookie-solution/confs/js/33942990.js",
            "https://www.googletagmanager.com/gtag/js?id=UA-184179078-",
            "https://widget.intercom.io/widget/j3kafOpd",
            "https://cdn.iubenda.com/cs/iubenda_Cs.js",
            "https://sellix.io/cdn-cgi/bm/cv/669835187/api.js",
            "https://unpkg.com/@lottiefiles/lottie-player@1.5.7/dist/lottie-player.js",
            "https://youtu.be/ZKxvzrxDzt0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "xU",
              "display_name": "xU",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1132,
            "hostname": 286,
            "domain": 259,
            "FileHash-SHA256": 107,
            "email": 1,
            "FileHash-MD5": 1
          },
          "indicator_count": 1786,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "1426 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "628c310ac9ae8e3e8f352e3d",
          "name": "Indusface  - in YOUR face ;)",
          "description": "function D(t,e,n), as well as window.com, has been frozen by a single function, as part of a series of \"snoopers' checks\"...",
          "modified": "2022-05-24T01:12:42.216000",
          "created": "2022-05-24T01:12:42.216000",
          "tags": [
            "fontawesome",
            "font awesome",
            "free",
            "license",
            "cc by",
            "sil ofl",
            "code",
            "mit license",
            "uf007",
            "uf017",
            "segoe ui",
            "emoji",
            "woff2",
            "roboto",
            "helvetica neue",
            "arial",
            "apple color",
            "symbol",
            "noto color",
            "type",
            "getcookie",
            "mxqueryparams",
            "samesitenone",
            "secure",
            "mxcookie",
            "date",
            "null",
            "domain",
            "orgcode",
            "message",
            "apino",
            "allow",
            "close",
            "safari",
            "large safari",
            "subscribe",
            "segment1",
            "segment2",
            "pushengage",
            "click",
            "scroll",
            "body",
            "iframe",
            "false",
            "typeof e",
            "array",
            "typeof t",
            "swiper",
            "most",
            "copyright",
            "july",
            "android",
            "win32",
            "version",
            "typeof n",
            "typeerror",
            "startr",
            "endr",
            "default",
            "typeof",
            "defaulttype",
            "function",
            "error",
            "shown",
            "flip",
            "regexp",
            "mozt",
            "mstransitionend",
            "webkitt",
            "dom element",
            "ua83948896",
            "gtmpf7h94q",
            "vendor site",
            "widget id",
            "page url",
            "write",
            "message api",
            "february",
            "april",
            "june",
            "august",
            "fbcd",
            "398410357733708",
            "prop",
            "init",
            "autoconfig",
            "protocol",
            "adnxsdomain",
            "aoldomain",
            "adrolltpc",
            "26015787",
            "reduceright",
            "tracking file",
            "number",
            "string",
            "aw827450946",
            "uint8array",
            "fnumber",
            "dustmap",
            "void",
            "class",
            "attr",
            "pseudo",
            "child",
            "typeof module",
            "trackevent",
            "trackpageview",
            "register",
            "path",
            "download",
            "verify",
            "xsnull",
            "script",
            "closure library",
            "xdfunction",
            "typeof window",
            "syntaxerror",
            "xmlhttprequest",
            "samesitelax",
            "innull",
            "ennull",
            "typeof symbol",
            "boolean",
            "circular",
            "customevent",
            "cuxref",
            "new r",
            "infinity",
            "image",
            "pnull",
            "html",
            "style",
            "ctnull",
            "post",
            "uint32array",
            "fanull",
            "ynull",
            "config",
            "meta",
            "accept"
          ],
          "references": [
            "https://k.clarity.ms/s/0.6.34/clarity.js",
            "https://www.clarity.ms/tag/uet/26015787",
            "https://dc.cux.io/analyzer.js",
            "https://sc.lfeeder.com/lftracker_v1_kn9Eq4R1l2K7RlvP.js",
            "https://www.google-analytics.com/gtm/js?id=GTM-PF7H94Q&t=gartner&cid=559436367.1653353775",
            "https://www.googletagmanager.com/gtm.js?id=GTM-PMC6JX",
            "https://www.indusface.com/js/fontawesome.js.pagespeed.jm.X4kSHwBNxI.js",
            "https://www.indusface.com/js/jquery.3.5.1.min.js.pagespeed.jm.A8biqtTJrt.js",
            "https://www.googletagmanager.com/gtag/js?id=AW-827450946",
            "https://tracking.g2crowd.com/attribution_tracking/conversions/2226.js?p=https://www.indusface.com/&e=",
            "https://bat.bing.com/p/action/26015787.js",
            "https://s.adroll.com/j/pre/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR/index.js",
            "https://d.adroll.com/consent/check/Q7CW4G7ZJJGWDLUB76P5IV?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&_s=1316674c131c34cc157a9ad9119512a2&_b=2",
            "https://d.adroll.com/pixel/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&pv=54603716107.79724&cookie=BIJ6M3OZKNCW7OIMIJSZED%3A2%7CWH2M5MREOVC4HNKNZPPJZR%3A2%7CQ7CW4G7ZJJGWDLUB76P5IV%3A2&adroll_s_ref=&keyw=&adroll_external_data=",
            "https://s.adroll.com/j/sendrolling.js",
            "https://web.mxradon.com/t/WebTracker.aspx?p1=18917&p2=Web%20Application%20Security%2C%20WAF%2C%20SSL%20Certificates&p3=-1&p4=&p5=1&p6=8415a029-248f-4eeb-bc18-338560430ff7&p7=&p8=&p9=0",
            "https://trackcmp.net/visit?actid=223422163&e=&r=&u=https%3A%2F%2Fwww.indusface.com%2F",
            "https://www.gartner.com/reviews/public/Widget/js/widget.js",
            "https://www.indusface.com/js/cookieconsent.min.js.pagespeed.jm.FCA-2RWV9s.js",
            "https://www.indusface.com/js/popper.min.js+bootstrap.min.js+modernizr-custom.js+menu.js.pagespeed.jc.WlixBHq4Fv.js",
            "https://www.indusface.com/js/swiper.min.js.pagespeed.jm.47RtcloJQ-.js",
            "https://clientcdn.pushengage.com/core/80780b73b5a3f4655fee62041e51f1be.js",
            "https://web.mxradon.com/t/Tracker.js",
            "https://www.indusface.com/css/A.font-styles1.css+bootstrap.css+skin.css+responsive.css+menu.css+swiper.min.css,Mcc.nAV12exFII.css.pagespeed.cf.a_yWJedOjY.css",
            "https://kit-free.fontawesome.com/releases/latest/css/free-v4-font-face.min.css",
            "https://www.indusface.com/css/A.cookieconsent.min.css.pagespeed.cf.t1fRd9Ouvj.css"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1144,
            "hostname": 333,
            "FileHash-SHA256": 307,
            "domain": 192,
            "FileHash-MD5": 1
          },
          "indicator_count": 1977,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1427 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62634f4db80546374654f4c4",
          "name": "frantech.ca - malware",
          "description": "T,t.F, t.f, is written in the same place as the following:t, d. F, has been added to the end of the document, as well as its own propertyDescriptor.",
          "modified": "2022-05-22T00:01:01.264000",
          "created": "2022-04-23T00:58:53.444000",
          "tags": [
            "overview",
            "typeof symbol",
            "error",
            "typeerror",
            "object",
            "typeof t",
            "string",
            "typeof e",
            "function",
            "array",
            "promise",
            "date",
            "target",
            "class",
            "path",
            "back",
            "bounce",
            "this",
            "iframe",
            "null",
            "0x105684",
            "0xb66229",
            "0xb9b329",
            "0x3eed40",
            "0x2923e0",
            "cookie",
            "0x1d2d25",
            "0x2d6b",
            "0x538ea5",
            "0x240c1a",
            "push",
            "shift",
            "open"
          ],
          "references": [
            "xfe-URL-https___my.frantech.ca_-stix2-2.1-export.json",
            "xfe-URL-frantech.ca-stix2-2.1-export.json",
            "https://my.frantech.ca/templates/lagom/assets/js/lagom-app.min.js?v=1.4.3",
            "https://my.frantech.ca/templates/lagom/assets/js/whmcs-custom.min.js?v=1.4.3"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 757,
            "hostname": 498,
            "domain": 311,
            "FileHash-SHA256": 21
          },
          "indicator_count": 1587,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1429 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6261f2763fabd1214a79f0e5",
          "name": "Masterhost.ru - malware hosting",
          "description": "Here is the code-decode for the punycode-overflow test, which is based on the results of the following test-run by the UK's Office of National Statistics (ONS).",
          "modified": "2022-05-21T00:03:44.725000",
          "created": "2022-04-22T00:10:30.250000",
          "tags": [
            "fffe37",
            "b76810",
            "helvetica",
            "arial",
            "pf din",
            "text comp",
            "circe",
            "span",
            "button",
            "90deg",
            "object",
            "typeof t",
            "date",
            "promise",
            "function",
            "array",
            "regexp",
            "error",
            "typeof symbol",
            "typeof n",
            "null",
            "backspace",
            "void",
            "window",
            "vd",
            "gc",
            "typeof e",
            "sufeffxa0",
            "class",
            "attr",
            "pseudo",
            "child",
            "typeof module",
            "string",
            "weakmap",
            "proxy",
            "number",
            "boolean",
            "trnf",
            "keepalive",
            "transitiongroup",
            "hello",
            "comment",
            "infinity",
            "this",
            "copyright",
            "closure library",
            "xdfunction",
            "cdfunction",
            "ddfunction",
            "bded",
            "kefunction",
            "65535",
            "counter",
            "typeof c",
            "segoe ui",
            "typeerror",
            "lucida",
            "vwtabguid",
            "form",
            "impact",
            "light",
            "cureit",
            "bu durumda",
            "ip address",
            "devam",
            "yandex",
            "help section",
            "captcha code",
            "support service",
            "search",
            "edge",
            "swhealthlog",
            "logsdatabasev2",
            "trident",
            "android",
            "rangeerror",
            "webpackexports",
            "illegal input",
            "webpackrequire"
          ],
          "references": [
            "https://admin.verbox.ru/support/support.js?h=afe80d31a1cabd6ae5c00580688f27d2",
            "https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js",
            "https://site.yandex.net/v2.0/js/all.js",
            "https://mc.yandex.ru/metrika/tag.js",
            "https://www.googletagmanager.com/gtag/js?id=UA-36935570-1",
            "https://masterhost.ru/s/masterhost_v2/build/js/app.js?v=WivgGVzt/Ynv",
            "https://masterhost.ru/s/masterhost_v2/build/js/compiled.min.js?v=Q/hhNATxy3sx",
            "https://static.me-talk.ru/cabinet/build/chat/modern.support.js",
            "https://masterhost.ru/s/masterhost_v2/build/css/global.css?v=MUmvaY06hvKf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Gc",
              "display_name": "Gc",
              "target": null
            },
            {
              "id": "Vd",
              "display_name": "Vd",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1991,
            "hostname": 678,
            "FileHash-SHA256": 247,
            "domain": 404,
            "email": 1,
            "FileHash-MD5": 51
          },
          "indicator_count": 3372,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "1430 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62609c764fab13bbe96613f8",
          "name": "Pegasus - pegtech.com",
          "description": "New RegExp:function(a,b), a new type, has its own built-up property, as well as an ability to store information in place when it is not already available.",
          "modified": "2022-05-20T00:01:19.453000",
          "created": "2022-04-20T23:51:18.734000",
          "tags": [
            "fontface",
            "woff",
            "sans",
            "woff2",
            "u1c801c88",
            "u20b4",
            "u2de02dff",
            "ua640a69f",
            "ufe2efe2f",
            "u04b004b1",
            "u2116",
            "datasecret",
            "chrome",
            "opredge",
            "isoperaedge",
            "opera",
            "browsername",
            "gecko",
            "iphone",
            "body",
            "srchttp",
            "strhashchange",
            "software",
            "sectionindex",
            "srchttps",
            "etslidertimer",
            "copyright",
            "typeof define",
            "etslidesnumber",
            "columns",
            "date",
            "error",
            "cowboy",
            "function",
            "placeheld",
            "customevent",
            "click",
            "minimum",
            "tooshort",
            "wpcf7wfreetext",
            "alert",
            "invert",
            "null",
            "form",
            "fast",
            "false",
            "path",
            "next",
            "video lightbox",
            "plugin",
            "expand",
            "previous",
            "setposition",
            "isset",
            "srcyoutube",
            "srcvimeo",
            "image",
            "lightbox clone",
            "stephane caron",
            "typeof therel",
            "regexp",
            "play",
            "close",
            "pseudo",
            "child",
            "typeof b",
            "array",
            "sufeffxa0",
            "class",
            "attr",
            "void",
            "udc66udc67",
            "ud83d",
            "ufe0f",
            "ud83e",
            "udc68udc69",
            "udfcbudfcc",
            "u2640u2642",
            "uddb0uddb3",
            "udd74udd75"
          ],
          "references": [
            "xfe-URL-pegtech.com-stix2-2.1-export.json",
            "https://pegtech.com/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20",
            "https://pegtech.com/wp-includes/js/jquery/jquery.js?ver=1.12.4",
            "https://pegtech.com/wp-content/plugins/wp-video-lightbox/js/jquery.prettyPhoto.min.js?ver=3.1.6",
            "https://pegtech.com/wp-content/plugins/wp-video-lightbox/js/video-lightbox.js?ver=3.1.6",
            "https://pegtech.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.2",
            "https://pegtech.com/wp-content/themes/Divi/js/custom.min.js?ver=3.0.100",
            "https://pegtech.com/wp-content/themes/Divi/core/admin/js/common.js?ver=3.0.100",
            "https://pegtech.com/wp-includes/js/wp-embed.min.js?ver=4.9.20",
            "https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext",
            "https://pegtech.com/wp-includes/css/dashicons.min.css?ver=4.9.20"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 856,
            "domain": 190,
            "hostname": 364,
            "FileHash-SHA256": 216
          },
          "indicator_count": 1626,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1431 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6253871aa38954c4426d475e",
          "name": "http://prima-abnehmen-shop.com/uk/order-now.html?affiliate=24&source=418&subid2=ddukc&subid3=35908921",
          "description": "In e, a new RegExp, has been added to the list of properties that can be used to store information in a single place, as well as a \"sizzle\" on the side of the page.",
          "modified": "2022-05-10T00:02:48.350000",
          "created": "2022-04-11T01:40:42.011000",
          "tags": [
            "strong",
            "imprint",
            "price",
            "address",
            "prima abnehmen",
            "usage return",
            "contact",
            "packs",
            "card",
            "digit code",
            "date",
            "back",
            "later",
            "function",
            "regexp",
            "edge",
            "elem",
            "webpackrequire",
            "return",
            "null",
            "handle",
            "expando",
            "match",
            "android",
            "target",
            "error",
            "false",
            "class",
            "mark",
            "harmony",
            "copy",
            "capture",
            "seed",
            "pass",
            "enough",
            "code",
            "never",
            "core",
            "local",
            "verify",
            "fall",
            "accept",
            "done",
            "find",
            "internal",
            "inject",
            "possible",
            "prop",
            "trigger",
            "typeof t",
            "typeof symbol",
            "typeerror",
            "object",
            "typeof e",
            "pseudo",
            "child",
            "this",
            "void",
            "array",
            "typeof n",
            "boolean",
            "messagechannel",
            "string",
            "symbol",
            "seventracker",
            "post",
            "nonce",
            "script",
            "please do",
            "not copy",
            "and paste",
            "this code",
            "cgrecaptchacfg",
            "ngrecaptcha",
            "recaptchaapi",
            "render",
            "typedarraytag",
            "blink",
            "gecko",
            "webkit",
            "trident",
            "the author",
            "this software",
            "copyright",
            "software is",
            "provided",
            "as is",
            "disclaims all",
            "warranties with",
            "regard to",
            "including all",
            "direct",
            "generator",
            "backspace",
            "select",
            "uint8array",
            "math",
            "number",
            "iframe",
            "span",
            "form",
            "click",
            "enterprise",
            "infinity",
            "template",
            "next",
            "body",
            "typeof r",
            "64e3",
            "urlsearchparams",
            "ofunction",
            "pfunction",
            "bfunction",
            "ffunction",
            "ifunction",
            "load",
            "sans",
            "woff2",
            "semibold",
            "bold",
            "italic",
            "semibold italic",
            "bold italic",
            "u20b4",
            "u2de02dff",
            "ua640a69f",
            "sufeffxa0",
            "attr"
          ],
          "references": [
            "xfe-URL-dk9ctyhidjrvgn.xyz-stix2-2.1-export.json",
            "http://dk9ctyhidjrvgn.xyz/index_files/jquery.js",
            "http://dk9ctyhidjrvgn.xyz/index_files/sss.css",
            "https://tracking.premiumhealtheurope.com/code.js",
            "https://static.cloudflareinsights.com/beacon.min.js",
            "https://www.gstatic.com/recaptcha/releases/Y-cOIEkAqcfDdup_qnnmkxIC/recaptcha__en.js",
            "https://cdn.getaddress.io/scripts/getaddress-autocomplete-1.1.2.min.js",
            "https://js.mollie.com/v1/mollie.js",
            "https://www.google.com/recaptcha/api.js?render=6LerjKkcAAAAAHIvlsndboXTiYDGt_xACa77alyA",
            "https://tracking.premiumhealth.eu/code.js",
            "https://eu-library.klarnaservices.com/lib.js",
            "https://prima-abnehmen-shop.com/_Resources/Static/Packages/Seven.Prima/Scripts/Main.js?bust=2a0b1c62",
            "https://prima-abnehmen-shop.com/_Resources/Static/Packages/Seven.Offerpage.Checkout/Scripts/main.min.js?bust=ef22ff16",
            "https://prima-abnehmen-shop.com/uk/order-now.html?affiliate=24&source=418&subid2=ddukc&subid3=35908921"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 640,
            "URL": 1862,
            "FileHash-SHA256": 149,
            "domain": 341
          },
          "indicator_count": 2992,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1441 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624fc692f1d830cd6e86956b",
          "name": "ReduceRight",
          "description": "If you want to know what to do with your intercoms, spare a thought for e.intercom and add a new listener to your browser.. and use it to control the system.",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T05:22:26.672000",
          "tags": [
            "typerange",
            "40deg",
            "segoe ui",
            "roboto",
            "arial",
            "consolas",
            "liberation mono",
            "menlo",
            "45deg",
            "webkitkeyframes",
            "object",
            "error",
            "please",
            "post",
            "urlsearchparams",
            "paused",
            "sfunction",
            "scene",
            "event",
            "after",
            "problem",
            "date",
            "next",
            "close",
            "typeof define",
            "typeof module",
            "html tags",
            "ox20trnf",
            "dom element",
            "regexp",
            "typeof e",
            "typeof t",
            "class",
            "attr",
            "pseudo",
            "child",
            "function",
            "symbol",
            "corejs",
            "denis pushkarev",
            "array",
            "typeof window",
            "typeof self",
            "string",
            "ieproto",
            "activexobject",
            "formdata",
            "customevent",
            "typeof o",
            "typeof s",
            "json response",
            "refill",
            "wpcf7",
            "wpcf7locale",
            "typeerror",
            "generator",
            "iab2",
            "code",
            "n color",
            "number",
            "cookie",
            "n strictly",
            "hostn host",
            "button",
            "null",
            "65535",
            "typeof symbol",
            "promise",
            "msie",
            "trident",
            "banner",
            "genven",
            "expecting iab",
            "iab tcf",
            "oldcctid",
            "newdomainid",
            "unknown",
            "acceptall",
            "rejectall",
            "checkbox",
            "reduceright",
            "custom",
            "trackevent",
            "purchase",
            "viewcontent",
            "facebook pixel",
            "uetpush",
            "copyright",
            "path",
            "contact",
            "void",
            "image",
            "price",
            "pnull",
            "html",
            "style",
            "ctnull",
            "uint32array",
            "fanull",
            "license",
            "ynull",
            "config",
            "meta",
            "body",
            "iframe",
            "accept",
            "syntaxerror",
            "xmlhttprequest",
            "samesitelax",
            "innull",
            "snnull",
            "addtocart",
            "signup",
            "addtowishlist",
            "lead",
            "typeof require",
            "sha256",
            "search",
            "typeof",
            "pixel code",
            "iterator",
            "constantvalue",
            "globalvariable",
            "facebook",
            "service",
            "phonenumber",
            "boolean",
            "functional",
            "member",
            "bnew regexp",
            "qfunction",
            "adview",
            "addbillinginfo",
            "addtolist",
            "download",
            "install",
            "09af",
            "ver0",
            "tag0",
            "extdata0",
            "ua ch",
            "invalid",
            "edge",
            "dataname",
            "intercom",
            "apple",
            "webkiti",
            "criosi"
          ],
          "references": [
            "https://widget.intercom.io/widget/wsyrfbge",
            "xfe-IP-193.176.186.154-stix2-2.0-export.json",
            "https://bat.bing.com/bat.js",
            "https://snap.licdn.com/li.lms-analytics/insight.min.js",
            "https://connect.facebook.net/signals/config/459577157542621?v=2.9.57&r=stable",
            "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.57",
            "https://connect.facebook.net/en_US/fbevents.js",
            "https://www.redditstatic.com/ads/pixel.js",
            "https://sc.lfeeder.com/lftracker_v1_lYNOR8xM56G7WQJZ.js",
            "https://h.clarity.ms/s/0.6.34/clarity.js",
            "https://www.clarity.ms/tag/7oq672bycl",
            "https://www.googletagmanager.com/gtm.js?id=GTM-5GRKNZJ",
            "https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js",
            "https://www.clickcease.com/monitor/stat.js",
            "https://cdn-ukwest.onetrust.com/scripttemplates/6.17.0/otBannerSdk.js",
            "https://www.heficed.com/wp/wp-includes/js/dist/vendor/regenerator-runtime.min.js",
            "https://www.heficed.com/wp/wp-includes/js/dist/vendor/wp-polyfill.min.js",
            "https://www.heficed.com/app/cache/min/1/app/plugins/contact-form-7/includes/js/index.js?ver=1647518891",
            "https://www.heficed.com/wp/wp-includes/js/jquery/jquery.min.js",
            "https://www.heficed.com/wp/wp-includes/js/jquery/jquery-migrate.min.js",
            "https://www.heficed.com/app/cache/min/1/app/themes/heficed-theme/dist/scripts/main_66bf268e.js?ver=1647518891",
            "https://www.heficed.com/app/cache/min/1/05ffa85815681d905ca82cbee25d8762.css"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 242,
            "URL": 401,
            "FileHash-SHA256": 69,
            "domain": 47,
            "FileHash-MD5": 1,
            "email": 1
          },
          "indicator_count": 761,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1443 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624dbf641e6a04169629e662",
          "name": "Malware-USA",
          "description": "Shopseg Sistemas, a company specialising in software and equipamentos for supermercados, wedi dweud eu s\u00f4n i'n \u00f4l.",
          "modified": "2022-05-06T16:01:29.122000",
          "created": "2022-04-06T16:27:16.093000",
          "tags": [
            "dataaos",
            "100px00",
            "dataaosfade",
            "100px0",
            "dataaoszoom",
            "dataaosflip",
            "woff2",
            "fontface",
            "sans",
            "u0259",
            "u1e001eff",
            "u2020",
            "u20a020ab",
            "u20ad20cf",
            "u2113",
            "u2c602c7f",
            "reduceright",
            "number",
            "string",
            "gtl5jtn10ss",
            "regexp",
            "error",
            "r300",
            "copyright",
            "dafunction",
            "gafunction",
            "uint8array",
            "date",
            "path",
            "void",
            "const",
            "click",
            "select",
            "scroll",
            "mobile",
            "template",
            "template url",
            "license",
            "easy selector",
            "easy event",
            "easy",
            "back",
            "typeof e",
            "typeof t",
            "this",
            "main",
            "swiper",
            "button",
            "most",
            "mit license",
            "android",
            "win32",
            "null",
            "dblock",
            "email form",
            "validation",
            "action",
            "formdata",
            "api url",
            "typeof define",
            "typeof module",
            "gplv3",
            "metafizzy",
            "math",
            "plyr",
            "typeof symbol",
            "typeerror",
            "tnull",
            "cnull",
            "typeof",
            "inject",
            "playbook",
            "name",
            "getconfig",
            "default",
            "area",
            "event",
            "shadowroot",
            "boolean",
            "window",
            "trident",
            "body",
            "ofunction",
            "symbol",
            "mfunction",
            "sfunction",
            "quando",
            "quem",
            "fundada em",
            "informtica",
            "sistemas",
            "segurana",
            "softwares",
            "supermercados",
            "lojas",
            "restaurantes",
            "padarias"
          ],
          "references": [
            "http://www.shopsegsistemas.com.br/",
            "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/bootstrap/js/bootstrap.bundle.min.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/glightbox/js/glightbox.min.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/isotope-layout/isotope.pkgd.min.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/php-email-form/validate.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/swiper/swiper-bundle.min.js",
            "http://www.shopsegsistemas.com.br/assets/js/main.js",
            "https://www.googletagmanager.com/gtag/js?id=G-TL5JTN10SS",
            "https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i%7CRaleway:300,300i,400,400i,500,500i,600,600i,700,700i%7CPoppins:300,300i,400,400i,500,500i,600,600i,700,700i",
            "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.css",
            "https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3730.503584706544!2d-41.67284568552043!3d-20.770905270369408!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0xbb93dcc0beb01f%3A0x97397d38847b3692!2sShopSeg%20Sistemas!5e0!3m2!1spt-BR!2sbr!4v1636561779046!5m2!1spt-BR!2sbr",
            "xfe-IP-50.116.87.164-stix2-2.0-export.json"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            },
            {
              "id": "Quando",
              "display_name": "Quando",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 254,
            "URL": 815,
            "FileHash-SHA256": 168,
            "domain": 174
          },
          "indicator_count": 1411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1444 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624dbf64e7682b3bf049129c",
          "name": "Malware-USA",
          "description": "Shopseg Sistemas, a company specialising in software and equipamentos for supermercados, wedi dweud eu s\u00f4n i'n \u00f4l.",
          "modified": "2022-05-06T16:01:29.122000",
          "created": "2022-04-06T16:27:16.842000",
          "tags": [
            "dataaos",
            "100px00",
            "dataaosfade",
            "100px0",
            "dataaoszoom",
            "dataaosflip",
            "woff2",
            "fontface",
            "sans",
            "u0259",
            "u1e001eff",
            "u2020",
            "u20a020ab",
            "u20ad20cf",
            "u2113",
            "u2c602c7f",
            "reduceright",
            "number",
            "string",
            "gtl5jtn10ss",
            "regexp",
            "error",
            "r300",
            "copyright",
            "dafunction",
            "gafunction",
            "uint8array",
            "date",
            "path",
            "void",
            "const",
            "click",
            "select",
            "scroll",
            "mobile",
            "template",
            "template url",
            "license",
            "easy selector",
            "easy event",
            "easy",
            "back",
            "typeof e",
            "typeof t",
            "this",
            "main",
            "swiper",
            "button",
            "most",
            "mit license",
            "android",
            "win32",
            "null",
            "dblock",
            "email form",
            "validation",
            "action",
            "formdata",
            "api url",
            "typeof define",
            "typeof module",
            "gplv3",
            "metafizzy",
            "math",
            "plyr",
            "typeof symbol",
            "typeerror",
            "tnull",
            "cnull",
            "typeof",
            "inject",
            "playbook",
            "name",
            "getconfig",
            "default",
            "area",
            "event",
            "shadowroot",
            "boolean",
            "window",
            "trident",
            "body",
            "ofunction",
            "symbol",
            "mfunction",
            "sfunction",
            "quando",
            "quem",
            "fundada em",
            "informtica",
            "sistemas",
            "segurana",
            "softwares",
            "supermercados",
            "lojas",
            "restaurantes",
            "padarias"
          ],
          "references": [
            "http://www.shopsegsistemas.com.br/",
            "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/bootstrap/js/bootstrap.bundle.min.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/glightbox/js/glightbox.min.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/isotope-layout/isotope.pkgd.min.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/php-email-form/validate.js",
            "http://www.shopsegsistemas.com.br/assets/vendor/swiper/swiper-bundle.min.js",
            "http://www.shopsegsistemas.com.br/assets/js/main.js",
            "https://www.googletagmanager.com/gtag/js?id=G-TL5JTN10SS",
            "https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i%7CRaleway:300,300i,400,400i,500,500i,600,600i,700,700i%7CPoppins:300,300i,400,400i,500,500i,600,600i,700,700i",
            "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.css",
            "https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3730.503584706544!2d-41.67284568552043!3d-20.770905270369408!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0xbb93dcc0beb01f%3A0x97397d38847b3692!2sShopSeg%20Sistemas!5e0!3m2!1spt-BR!2sbr!4v1636561779046!5m2!1spt-BR!2sbr",
            "xfe-IP-50.116.87.164-stix2-2.0-export.json"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            },
            {
              "id": "Quando",
              "display_name": "Quando",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 254,
            "URL": 815,
            "FileHash-SHA256": 168,
            "domain": 174
          },
          "indicator_count": 1411,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "1444 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "625eecb6fbc4353a109fe71c",
          "name": "hostkey - Industroyer&ReduceRight",
          "description": "Fbevents-PostalCodeType:f.exports, f.1, is a new addition to the list of \"signals\" that can be added to phone numbers.",
          "modified": "2022-04-19T17:09:10.196000",
          "created": "2022-04-19T17:09:10.196000",
          "tags": [
            "livechat",
            "sign up",
            "free",
            "grow",
            "policy",
            "sign",
            "strong",
            "sorry",
            "identify",
            "increase",
            "lzutf8",
            "typeerror",
            "uint8array",
            "array",
            "error",
            "typeof r",
            "class",
            "invalid",
            "post",
            "uint32array",
            "date",
            "null",
            "papvisitorid",
            "string",
            "regexp",
            "value",
            "property",
            "valuenumber",
            "activexobject",
            "postaffparams",
            "object",
            "number",
            "boolean",
            "typeof e",
            "math",
            "first",
            "raid",
            "window",
            "service",
            "ukraine",
            "epsilon",
            "arrow",
            "target",
            "keepalive",
            "void",
            "shell",
            "econnaborted",
            "hkwfunction",
            "typeof symbol",
            "function",
            "promise",
            "request",
            "network error",
            "livechatwidget",
            "ticket form",
            "prechat survey",
            "postchat survey",
            "typeof n",
            "chat",
            "blank",
            "win32",
            "iframe",
            "reduceright",
            "copyright",
            "closure library",
            "xdfunction",
            "adfunction",
            "cdfunction",
            "ddfunction",
            "bded",
            "x3e div",
            "trackevent",
            "landingpagegpu",
            "x3e table",
            "gpudraw",
            "path",
            "code",
            "functional",
            "member",
            "hnew regexp",
            "qfunction",
            "adview",
            "addbillinginfo",
            "addtocart",
            "addtolist",
            "contact",
            "download",
            "install",
            "symbol",
            "iterator",
            "extractor",
            "pixel",
            "facebook",
            "meta",
            "65535",
            "counter",
            "segoe ui",
            "lucida",
            "ecommerce",
            "ext link",
            "comic",
            "form",
            "impact",
            "light"
          ],
          "references": [
            "https://mc.yandex.ru/metrika/watch.js",
            "https://connect.facebook.net/signals/config/785878845108827",
            "https://snap.licdn.com/li.lms-analytics/insight.min.js",
            "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H",
            "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1",
            "https://cdn.livechatinc.com/tracking.js",
            "https://rec.smartlook.com/main-20220331074633.js",
            "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js",
            "https://hostkey.com/hk/widgets/ext/src/hostkey.js",
            "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8",
            "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=",
            "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light",
            "https://secure.livechatinc.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Tunisia"
          ],
          "malware_families": [
            {
              "id": "ReduceRight",
              "display_name": "ReduceRight",
              "target": null
            },
            {
              "id": "Industroyer - S0604",
              "display_name": "Industroyer - S0604",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1778,
            "hostname": 563,
            "FileHash-SHA256": 304,
            "domain": 407,
            "FileHash-SHA1": 2
          },
          "indicator_count": 3054,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1461 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "625028edfe0ff22af87b9d66",
          "name": "Virustotal.com",
          "description": "If you want to know how to delete an object from your browser, try these three-second-long, four-point-result-results-free-to-get-it-out-the-objectIterator.",
          "modified": "2022-04-08T12:22:05.307000",
          "created": "2022-04-08T12:22:05.307000",
          "tags": [
            "symbol",
            "object",
            "string",
            "denis pushkarev",
            "json",
            "corejs",
            "source",
            "etrt",
            "atfunction",
            "stfunction",
            "error",
            "typeerror",
            "asynciterator",
            "generator",
            "typeof l",
            "nonce",
            "script",
            "please do",
            "not copy",
            "and paste",
            "this code",
            "cgrecaptchacfg",
            "ngrecaptcha",
            "recaptchaapi",
            "render",
            "waaa",
            "bufferwriter",
            "bufferreader",
            "qace",
            "search",
            "cafebabe",
            "c2c url",
            "jgfunilwcpc",
            "gmbh",
            "return",
            "freemium gmbh",
            "open xml",
            "virustotal",
            "keep learning",
            "select",
            "uint8array",
            "array",
            "null",
            "function",
            "math",
            "edge",
            "number",
            "date",
            "this",
            "verify",
            "android",
            "iframe",
            "void",
            "trident",
            "span",
            "form",
            "click",
            "enterprise",
            "infinity",
            "template",
            "next",
            "body"
          ],
          "references": [
            "https://www.gstatic.com/recaptcha/releases/Y-cOIEkAqcfDdup_qnnmkxIC/recaptcha__en.js",
            "https://www.virustotal.com/gui/main.6d41e0dc139508f21963.js",
            "https://www.recaptcha.net/recaptcha/api.js?render=explicit",
            "https://www.virustotal.com/gui/polyfills/regenerator-runtime.95dc763885f05111a2f88232a2d0cf2d.js",
            "https://www.virustotal.com/gui/polyfills/core-js.c92df5c57caa3e436cd3ef38e4b4f503.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "WAAA",
              "display_name": "WAAA",
              "target": null
            },
            {
              "id": "QACE",
              "display_name": "QACE",
              "target": null
            },
            {
              "id": "BufferReader",
              "display_name": "BufferReader",
              "target": null
            },
            {
              "id": "BufferWriter",
              "display_name": "BufferWriter",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 392,
            "URL": 1356,
            "domain": 330,
            "FileHash-SHA256": 177
          },
          "indicator_count": 2255,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1472 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6221c71f88d90939c45bbddb",
          "name": "Votebuilder.com",
          "description": "",
          "modified": "2022-04-08T00:05:40.239000",
          "created": "2022-03-04T08:00:31.017000",
          "tags": [],
          "references": [
            "votebuilder3df.pdf",
            "votebuilder2df.pdf",
            "votebuilder5df.pdf",
            "votebuilder7df.pdf",
            "votebuilder.com apidf.pdf",
            "Votebuilder.com.pdf",
            "votebuilder4df.pdf",
            "votebuilder6df.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 869,
            "hostname": 1559,
            "URL": 4755,
            "CIDR": 2,
            "FileHash-MD5": 10,
            "domain": 834
          },
          "indicator_count": 8029,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1473 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62276abfaa65cd33f64331f8",
          "name": "TarrantCounty.com ~ 03.01.2022",
          "description": "",
          "modified": "2022-04-07T00:04:02.553000",
          "created": "2022-03-08T14:39:59.235000",
          "tags": [
            "march",
            "lookup go",
            "rescan add",
            "verdict report",
            "de summary",
            "http",
            "redirects links",
            "behaviour",
            "similar dom",
            "content api",
            "value",
            "search url",
            "search domain",
            "scan url",
            "url search",
            "domain scan",
            "url url",
            "motor vehicle",
            "aqb1",
            "eventsevent10",
            "meta",
            "show",
            "download go",
            "full url",
            "reverse dns",
            "resource",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "main",
            "milan",
            "apache",
            "paris",
            "accept"
          ],
          "references": [
            "TarrantCounty3df.pdf",
            "TarantCounty2df.pdf",
            "TarrantCounty4df.pdf",
            "TarrantCounty5df.pdf",
            "tarrant23df.pdf",
            "TarrantCounty1df.pdf",
            "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf",
            "TarrantCounty6df.pdf",
            "TarrantCounty7df.pdf",
            "TarrantCounty10df.pdf",
            "TarrantCounty9df.pdf",
            "TarrantCounty17df.pdf",
            "TarrantCounty15df.pdf",
            "TarrantCounty12df.pdf",
            "TarrantCounty14df.pdf",
            "tarrantcounty8df.pdf",
            "TarrantCounty18df.pdf",
            "TarrantCounty19df.pdf",
            "TarrantCounty21df.pdf",
            "tarrantcounty22df.pdf",
            "TarrantCounty20df.pdf",
            "tarrantcountydf.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4134,
            "hostname": 1607,
            "domain": 838,
            "FileHash-SHA256": 1078,
            "FileHash-SHA1": 2,
            "email": 3,
            "CIDR": 4,
            "FileHash-MD5": 15
          },
          "indicator_count": 7681,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1474 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624ade33b2dd93cdc7ef4b58",
          "name": "Botnet c&c",
          "description": "ParallelAxisIndex:0,label:1,lineStyle:2,inactiveOpacity: 1.05,m.g,graphicKey: m.style,t.",
          "modified": "2022-04-04T12:01:54.999000",
          "created": "2022-04-04T12:01:54.999000",
          "tags": [
            "datav6a0cc948",
            "pingfang sc",
            "microsoft yahei",
            "helvetica neue",
            "helvetica",
            "hiragino sans",
            "arial",
            "datav11c9d7e6",
            "datava3f4887a",
            "datav12834d8c",
            "span",
            "open",
            "date",
            "function",
            "typeof t",
            "regexp",
            "number",
            "typeof e",
            "null",
            "width",
            "typeof s",
            "error",
            "this",
            "class",
            "accept",
            "d mmmm",
            "yyyy",
            "yyyy hh",
            "llll",
            "pjh5",
            "dddd",
            "ds5p",
            "void",
            "android",
            "backspace",
            "typeof define",
            "load",
            "mika tuupola",
            "boolean"
          ],
          "references": [
            "https://cdf5cxngkkxd.com/#/home",
            "https://cdf5cxngkkxd.com/static/js/lazyload.min.js",
            "https://cdf5cxngkkxd.com/static/js/manifest.e4d52d2f9dae6cd41eb4.js",
            "https://cdf5cxngkkxd.com/static/js/vendor.084bf9e0e16f0b2b6faa.js",
            "https://cdf5cxngkkxd.com/static/js/app.e16f8acb87917d3eab20.js",
            "https://cdf5cxngkkxd.com/static/css/app.7b16cc13d7ec8824766fa8255c64a800.css"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 334,
            "URL": 1182,
            "domain": 214,
            "FileHash-SHA256": 33
          },
          "indicator_count": 1763,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1476 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624a5795ec3cb505e626ba10",
          "name": "ylnedriuopegrle33689.org is the WAF",
          "description": "function m(b,c,e) is a new type of Float32Array, which can be used as a \"flip-flap\" to create new units for each of its three functions.",
          "modified": "2022-04-04T02:27:33.664000",
          "created": "2022-04-04T02:27:33.664000",
          "tags": [
            "typeof o",
            "datavde206a4a",
            "span",
            "helvetica neue",
            "135deg",
            "2022 2022",
            "webkitkeyframes",
            "90deg",
            "font awesome",
            "license",
            "font",
            "object",
            "boolean",
            "string",
            "number",
            "refresh",
            "viewbox",
            "dxeu",
            "nrt3",
            "uszq",
            "dmi4",
            "error",
            "imel",
            "date",
            "regexp",
            "left",
            "typeof h",
            "array",
            "color x",
            "y blur",
            "shapiro",
            "shim",
            "hooks",
            "alpha",
            "green",
            "d9d9d9",
            "n color",
            "datav71159637",
            "datav9306cb64",
            "info",
            "android",
            "canvas"
          ],
          "references": [
            "http://ylnedriuopegrle33689.org/mobile/static/lib/velocity.min.js",
            "http://ylnedriuopegrle33689.org/mobile/static/js/0.fc97dceb0dbb60948b0f.js",
            "http://ylnedriuopegrle33689.org/mobile/static/css/app.726f146ac9040074723077dbffe13bf7.css",
            "http://ylnedriuopegrle33689.org/mobile/static/js/app.9074e5240bf3d0f7b264.js",
            "http://ylnedriuopegrle33689.org/mobile/static/js/manifest.2cf63ac462750c8b3a2f.js",
            "http://ylnedriuopegrle33689.org/mobile/static/js/151.f5cad57280238b18aa58.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 99,
            "URL": 495,
            "hostname": 153,
            "FileHash-SHA256": 79
          },
          "indicator_count": 826,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1477 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "62223e385f1cfc8916db66fb",
          "name": "Dominionvoting.com 03.03.22",
          "description": "",
          "modified": "2022-04-03T00:00:55.161000",
          "created": "2022-03-04T16:28:40.422000",
          "tags": [],
          "references": [
            "dominion voting1f",
            "dominion2",
            "dominion3",
            "dominion4",
            "dominion5"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 413,
            "URL": 2183,
            "FileHash-SHA256": 663,
            "hostname": 588,
            "FileHash-MD5": 7
          },
          "indicator_count": 3854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1478 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "621fff12d2c54f70fea90576",
          "name": "Bexar.org",
          "description": "",
          "modified": "2022-04-01T00:01:54.852000",
          "created": "2022-03-02T23:34:42.531000",
          "tags": [],
          "references": [
            "www.bexar.org - urlscan.io.pdf",
            "bexar api 4.pdf",
            "bexar api 8.pdf",
            "bexar 6.pdf",
            "bexar api 2.pdf",
            "bexar api 7.pdf",
            "bexar api 3.pdf",
            "bexar api 9.pdf",
            "bexar api 12.pdf",
            "bexar api 17.pdf",
            "bexar api 15.pdf",
            "bexar api 18.pdf",
            "bexar api 10.pdf",
            "bexar api 19.pdf",
            "bexar api 20.pdf",
            "bexar api 13.pdf",
            "bexar api 21.pdf",
            "bexar api 14.pdf",
            "bexar api 22.pdf",
            "bexar1.pdf",
            "bexar api5.pdf",
            "bexar2.pdf",
            "bexar3.pdf",
            "bexar.org 3.2.22.pdf",
            "bexar6.pdf",
            "bexar5.pdf",
            "bexar api_1.pdf",
            "bexar10.pdf",
            "bexar api.pdf",
            "bexar_v1df.pdf",
            "bexarv4df.pdf",
            "bexarv2df.pdf",
            "bexarv6df.pdf",
            "bexasv3df.pdf",
            "bexarv7df.pdf",
            "bear_v apidf.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1833,
            "URL": 4669,
            "domain": 1025,
            "FileHash-SHA256": 1735,
            "email": 4,
            "FileHash-MD5": 133,
            "FileHash-SHA1": 6,
            "CIDR": 5
          },
          "indicator_count": 9410,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 407,
          "modified_text": "1480 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "620573ce25238e2a235cf97a",
          "name": "Google - with www.google",
          "description": "",
          "modified": "2022-02-10T20:21:34.448000",
          "created": "2022-02-10T20:21:34.448000",
          "tags": [
            "store gmail",
            "images sign",
            "remove report",
            "how search",
            "carbon",
            "settings search",
            "advanced",
            "search search",
            "search help",
            "send feedback",
            "error",
            "f255",
            "function",
            "r255",
            "string",
            "u255",
            "ffunction",
            "cfunction",
            "array",
            "nofunction",
            "embed",
            "iframe",
            "keygen",
            "meta",
            "date",
            "void"
          ],
          "references": [
            "https://www.google.com/js/th/iOVC6GOxQKqh4waW2LK1BmKZq9da56ZC6o66mP614w4.js",
            "https://www.google.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 20,
            "URL": 247,
            "hostname": 66,
            "domain": 40
          },
          "indicator_count": 373,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1529 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://tracking.premiumhealtheurope.com/code.js",
        "https://cdf5cxngkkxd.com/static/js/app.e16f8acb87917d3eab20.js",
        "TarrantCounty14df.pdf",
        "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
        "http://ylnedriuopegrle33689.org/mobile/static/lib/velocity.min.js",
        "http://www.shopsegsistemas.com.br/",
        "https://securepubads.g.doubleclick.net/gpt/pubads_impl_page_level_ads_2022050201.js",
        "http://dk9ctyhidjrvgn.xyz/index_files/jquery.js",
        "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery.min.js",
        "https://www.google.com/",
        "https://cdf5cxngkkxd.com/#/home",
        "https://widget.trustpilot.com/trustboxes/5406e65db0d04a09e042d5fc/index.html?templateId=5406e65db0d04a09e042d5fc&businessunitId=4bdc496b000064000505a89d#locale=en-US&styleHeight=28px&styleWidth=100%25&theme=light",
        "https://widget.intercom.io/widget/j3kafOpd",
        "https://admin.verbox.ru/support/support.js?h=afe80d31a1cabd6ae5c00580688f27d2",
        "https://www.gstatic.com/recaptcha/releases/Y-cOIEkAqcfDdup_qnnmkxIC/recaptcha__en.js",
        "https://pegtech.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.0.2",
        "https://www.indusface.com/css/A.cookieconsent.min.css.pagespeed.cf.t1fRd9Ouvj.css",
        "https://www.googletagmanager.com/gtag/js?id=G-TL5JTN10SS",
        "https://www.indusface.com/js/fontawesome.js.pagespeed.jm.X4kSHwBNxI.js",
        "Votebuilder.com.pdf",
        "bexar api 15.pdf",
        "https://site.yandex.net/v2.0/js/all.js",
        "https://www.googletagmanager.com/gtag/js?id=UA-36935570-1",
        "bexar api 14.pdf",
        "webcomponent-polyfill.js",
        "https://himado.com/cdn-cgi/challenge-platform/h/g/scripts/invisible.js?ts=1651842000",
        "TarrantCounty3df.pdf",
        "https://www.google.com/recaptcha/api.js?render=6LerjKkcAAAAAHIvlsndboXTiYDGt_xACa77alyA",
        "https://pegtech.com/wp-includes/js/wp-emoji-release.min.js?ver=4.9.20",
        "https://connect.facebook.net/signals/config/785878845108827",
        "https://stats.wp.com/e-202217.js",
        "bexar_v1df.pdf",
        "https://pegtech.com/wp-content/plugins/wp-video-lightbox/js/jquery.prettyPhoto.min.js?ver=3.1.6",
        "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.js",
        "votebuilder3df.pdf",
        "https://my.frantech.ca/templates/lagom/assets/js/lagom-app.min.js?v=1.4.3",
        "https://www.virustotal.com/gui/polyfills/regenerator-runtime.95dc763885f05111a2f88232a2d0cf2d.js",
        "https://hostkey.postaffiliatepro.com/scripts/Oy173rux8?accountld=default1&url=S_hostkey.com%2F&referrer=&isInlframe=false&getParams=&anchor=",
        "https://tracking.premiumhealth.eu/code.js",
        "votebuilder6df.pdf",
        "0.main.bundle.a9d68f5204cd3ac257b6.js",
        "https://cdf5cxngkkxd.com/static/js/lazyload.min.js",
        "bexar3.pdf",
        "https://masterhost.ru/s/masterhost_v2/build/css/global.css?v=MUmvaY06hvKf",
        "https://pegtech.com/wp-includes/js/jquery/jquery.js?ver=1.12.4",
        "TarrantCounty21df.pdf",
        "https://d.adroll.com/consent/check/Q7CW4G7ZJJGWDLUB76P5IV?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&_s=1316674c131c34cc157a9ad9119512a2&_b=2",
        "https://trackcmp.net/visit?actid=223422163&e=&r=&u=https%3A%2F%2Fwww.indusface.com%2F",
        "https://www.indusface.com/js/popper.min.js+bootstrap.min.js+modernizr-custom.js+menu.js.pagespeed.jc.WlixBHq4Fv.js",
        "xfe-IP-50.116.87.164-stix2-2.0-export.json",
        "https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LdNytsaAAAAANS6DW8pofQamH4toQAAgfF7Q8qW&co=aHR0cHM6Ly93d3cuYXBlaXJvbi5nbG9iYWw6NDQz&hl=en&v=2W_gRz39xX8G13fM-OdyQPlc&size=invisible&cb=ghnkw160kgfd",
        "https://hostkey.com/hk/widgets/ext/src/hostkey.js",
        "https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022050201.js",
        "bexar 6.pdf",
        "dominion4",
        "https://rec.smartlook.com/main-20220331074633.js",
        "bexar10.pdf",
        "bexar api.pdf",
        "c.insertbefore.call - fail",
        "http://www.shopsegsistemas.com.br/assets/vendor/isotope-layout/isotope.pkgd.min.js",
        "https://bat.bing.com/p/action/26015787.js",
        "https://secure.livechatinc.com/",
        "https://www.googletagmanager.com/gtag/js?id=AW-827450946",
        "TarrantCounty1df.pdf",
        "https://www.heficed.com/app/cache/min/1/app/plugins/contact-form-7/includes/js/index.js?ver=1647518891",
        "TarrantCounty15df.pdf",
        "votebuilder2df.pdf",
        "bexar api5.pdf",
        "https://apis.google.com/_/scs/abc-static/_/js/k=gapi.lb.en.iTmf4rxOyWc.O/m=auth2/rt=j/sv=1/d=1/ed=1/rs=AHpOoo-LTnDn-AS2QlMWYZdnaV1OuFR7Iw/cb=gapi.loaded_0?le=scs",
        "https://www.hushmail.com/javascriptinclude/eNrLKC3OyE3MzIkvT00qzixJtSpITE_V98lPz8xzyy_K1csqtjI0MzK2MDcwsbS0ysCq2qkov7w4tSi4JLGkGFUDAF_tIM0,.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js",
        "xfe-URL-frantech.ca-stix2-2.1-export.json",
        "https://www.googletagmanager.com/gtag/js?id=UA-122335014-2",
        "TarantCounty2df.pdf",
        "https://widget.wickedreports.com/v2/3469/wr-dafa9fae816c2f65d24d1eb593b58626.js",
        "bexarv4df.pdf",
        "https://cdf5cxngkkxd.com/static/js/vendor.084bf9e0e16f0b2b6faa.js",
        "https://www.indusface.com/js/jquery.3.5.1.min.js.pagespeed.jm.A8biqtTJrt.js",
        "https://d.adroll.com/pixel/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR?adroll_fpc=7c06a492879ac231294c1fe2e6e394f3-1653353535991&arrfrr=https%3A%2F%2Fwww.indusface.com%2F&pv=54603716107.79724&cookie=BIJ6M3OZKNCW7OIMIJSZED%3A2%7CWH2M5MREOVC4HNKNZPPJZR%3A2%7CQ7CW4G7ZJJGWDLUB76P5IV%3A2&adroll_s_ref=&keyw=&adroll_external_data=",
        "https://pegtech.com/wp-content/themes/Divi/core/admin/js/common.js?ver=3.0.100",
        "tarrantcounty8df.pdf",
        "bexar api 17.pdf",
        "https://cdn.ampproject.org/rtv/012204221712000/amp4ads-host-v0.js",
        "https://www.clickcease.com/monitor/stat.js",
        "https://cdn.iubenda.com/cs/iubenda_Cs.js",
        "https://www.clarity.ms/tag/7oq672bycl",
        "https://bat.bing.com/bat.js",
        "tarrantcounty22df.pdf",
        "bexar api 19.pdf",
        "https://snap.licdn.com/li.lms-analytics/insight.min.js",
        "https://widget.trustpilot.com/trustboxes/5613c9cde69ddc09340c6beb/index.html?templateld=5613c9cde69ddc09340c6beb&businessunitld=55e46b640000ff000582c91e#locale=en-GB&styleHeight=100%25&styleWidth=100%25&theme=light",
        "https://hybrid-analysis.com/sample/f2c3f35a3349d92a4ce9a246fda9dc456df516c8f3d6006b219d21690575b75b/63f299f3c79eb479f661e947",
        "https://sc.lfeeder.com/lftracker_v1_lYNOR8xM56G7WQJZ.js",
        "bexar api 21.pdf",
        "https://www.heficed.com/app/cache/min/1/05ffa85815681d905ca82cbee25d8762.css",
        "bexar api_1.pdf",
        "https://prima-abnehmen-shop.com/_Resources/Static/Packages/Seven.Offerpage.Checkout/Scripts/main.min.js?bust=ef22ff16",
        "https://c.cnzz.com/core.php?web_id=1280305902&t=z",
        "https://www.googletagmanager.com/gtm.js?id=GTM-MF25KRH",
        "https://kit-free.fontawesome.com/releases/latest/css/free-v4-font-face.min.css",
        "bexar6.pdf",
        "bexar api 4.pdf",
        "https://cdf5cxngkkxd.com/static/css/app.7b16cc13d7ec8824766fa8255c64a800.css",
        "http://dk9ctyhidjrvgn.xyz/index_files/sss.css",
        "https://hostkey.postaffiliatepro.com/scripts/Oy173jux8",
        "https://www.googletagmanager.com/gtag/js?id=AW-1070742489&l=dataLayer&cx=c",
        "https://www.googletagmanager.com/gtm.js?id=GTM-5GRKNZJ",
        "https://www.youtube.com/s/player/534c466c/www-widgetapi.vflset/www-widgetapi.js",
        "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.57",
        "votebuilder5df.pdf",
        "votebuilder7df.pdf",
        "http://www.shopsegsistemas.com.br/assets/vendor/bootstrap/js/bootstrap.bundle.min.js",
        "https://www.googletagmanager.com/gtag/js?id=G-C3W7T6H5QW&l=dataLayer&cx=c",
        "https://pegtech.com/wp-includes/js/wp-embed.min.js?ver=4.9.20",
        "https://www.iubenda.com/cookie-solution/confs/js/33942990.js",
        "https://static.cloudflareinsights.com/beacon.min.js",
        "http://ylnedriuopegrle33689.org/mobile/static/js/app.9074e5240bf3d0f7b264.js",
        "https://himado.com/heihei/layui/layui.all.js",
        "https://fonts.googleapis.com/css?family=Open+Sans:300italic,400italic,600italic,700italic,800italic,400,300,600,700,800&subset=latin,latin-ext",
        "14.main.bundle.91f9f7ff635e0b797de3.js",
        "votebuilder.com apidf.pdf",
        "https://www.virustotal.com/gui/polyfills/core-js.c92df5c57caa3e436cd3ef38e4b4f503.js",
        "https://c0.wp.com/c/5.9.3/wp-includes/js/dist/vendor/regenerator-runtime.min.js",
        "https://www.googletagmanager.com/gtag/js?id=UA-73589630-1",
        "https://cdn.livechatinc.com/tracking.js",
        "https://www.heficed.com/wp/wp-includes/js/dist/vendor/wp-polyfill.min.js",
        "https://youtu.be/ZKxvzrxDzt0",
        "https://www.googletagmanager.com/gtm.js?id=GTM-MDCVHGD",
        "bexarv7df.pdf",
        "xfe-URL-https___c0.wp.com_-stix2-2.1-export.json",
        "bexar2.pdf",
        "https://mc.yandex.ru/metrika/tag.js",
        "http://ylnedriuopegrle33689.org/mobile/static/js/0.fc97dceb0dbb60948b0f.js",
        "xfe-URL-Cnzz.com-stix2-2.1-export.json",
        "https://web.mxradon.com/t/Tracker.js",
        "https://www.heficed.com/app/cache/min/1/app/themes/heficed-theme/dist/scripts/main_66bf268e.js?ver=1647518891",
        "TarrantCounty4df.pdf",
        "https://cdn.callrail.com/companies/431115301/7c8f964bc12313c75ad2/12/swap.js",
        "TarrantCounty9df.pdf",
        "bexar api 10.pdf",
        "bexarv2df.pdf",
        "https://js.mollie.com/v1/mollie.js",
        "bexar api 12.pdf",
        "http://ylnedriuopegrle33689.org/mobile/static/css/app.726f146ac9040074723077dbffe13bf7.css",
        "xfe-URL-Psychz.net-stix2-2.1-export.json",
        "https://www.gartner.com/reviews/public/Widget/js/widget.js",
        "bexar5.pdf",
        "analytics.js",
        "https://pegtech.com/wp-content/themes/Divi/js/custom.min.js?ver=3.0.100",
        "http://www.shopsegsistemas.com.br/assets/vendor/php-email-form/validate.js",
        "https://www.googletagmanager.com/gtm.js?id=GTM-M9D76H",
        "https://s.adroll.com/j/pre/Q7CW4G7ZJJGWDLUB76P5IV/WH2M5MREOVC4HNKNZPPJZR/index.js",
        "tarrantcounty.com:en:elections:Voter-Information:Voter- Registration.html%22,.pdf",
        "https://www.google.com/js/th/iOVC6GOxQKqh4waW2LK1BmKZq9da56ZC6o66mP614w4.js",
        "xfe-IP-103.136.42.186-stix2-2.1-export.json",
        "bexar api 2.pdf",
        "dominion3",
        "https://tracking.g2crowd.com/attribution_tracking/conversions/2226.js?p=https://www.indusface.com/&e=",
        "https://dc.cux.io/analyzer.js",
        "https://www.heficed.com/wp/wp-includes/js/jquery/jquery.min.js",
        "https://www.googletagmanager.com/gtag/js?id=AW-1070742489",
        "http://ylnedriuopegrle33689.org/mobile/static/js/151.f5cad57280238b18aa58.js",
        "https://unpkg.com/@lottiefiles/lottie-player@1.5.7/dist/lottie-player.js",
        "https://cdn.onesignal.com/sdks/OneSignalSDK.js",
        "https://clientcdn.pushengage.com/core/80780b73b5a3f4655fee62041e51f1be.js",
        "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861793229&ids%5B%5D=431115301",
        "https://c0.wp.com/p/jetpack/10.7/_inc/build/photon/photon.min.js",
        "https://www.indusface.com/js/cookieconsent.min.js.pagespeed.jm.FCA-2RWV9s.js",
        "https://www.google.com/maps/embed?pb=!1m18!1m12!1m3!1d3730.503584706544!2d-41.67284568552043!3d-20.770905270369408!2m3!1f0!2f0!3f0!3m2!1i1024!2i768!4f13.1!3m3!1m2!1s0xbb93dcc0beb01f%3A0x97397d38847b3692!2sShopSeg%20Sistemas!5e0!3m2!1spt-BR!2sbr!4v1636561779046!5m2!1spt-BR!2sbr",
        "bexar api 3.pdf",
        "https://hostkey.com/hk/widgets/ext/build/stock.bundle.js",
        "votebuilder4df.pdf",
        "tarrant23df.pdf",
        "TarrantCounty17df.pdf",
        "https://281cecd8ae73dff542e13679e60d5fb9.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html",
        "https://www.gstatic.com/recaptcha/releases/2W_gRz39xX8G13fM-OdyQPlc/recaptcha__en.js",
        "dominion2",
        "https://www.googletagmanager.com/gtm.js?id=GTM-PMC6JX",
        "https://www.recaptcha.net/recaptcha/api.js?render=explicit",
        "https://www.hushmail.com/status/",
        "TarrantCounty19df.pdf",
        "https://cdn-ukwest.onetrust.com/scripttemplates/otSDKStub.js",
        "https://mc.yandex.ru/metrika/watch.js",
        "https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i%7CRaleway:300,300i,400,400i,500,500i,600,600i,700,700i%7CPoppins:300,300i,400,400i,500,500i,600,600i,700,700i",
        "bexar api 8.pdf",
        "bexarv6df.pdf",
        "http://www.shopsegsistemas.com.br/assets/vendor/aos/aos.css",
        "https://www.googletagmanager.com/gtag/js?id=UA-1837381-13",
        "https://pegtech.com/wp-includes/css/dashicons.min.css?ver=4.9.20",
        "https://www.hushmail.com/shared/javascript/jquery-3.5.1.min.js",
        "xfe-IP-193.176.186.154-stix2-2.0-export.json",
        "xfe-URL-Aliyun.com-stix2-2.1-export.json",
        "https://c0.wp.com/c/5.9.3/wp-includes/js/jquery/jquery-migrate.min.js",
        "https://eu-library.klarnaservices.com/lib.js",
        "https://cdn.getaddress.io/scripts/getaddress-autocomplete-1.1.2.min.js",
        "https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js",
        "https://www.gstatic.com/recaptcha/releases/1_E1Jb45wiBZrQd45oGZ-2cU/recaptcha__en.js",
        "https://sellix.io/cdn-cgi/bm/cv/669835187/api.js",
        "https://www.redditstatic.com/ads/pixel.js",
        "https://www.clarity.ms/tag/uet/26015787",
        "bexar api 9.pdf",
        "bexar api 20.pdf",
        "bear_v apidf.pdf",
        "https://www.heficed.com/wp/wp-includes/js/dist/vendor/regenerator-runtime.min.js",
        "12.main.bundle.50be73a11d1d3745a5ee.js",
        "https://www.google-analytics.com/gtm/js?id=GTM-PF7H94Q&t=gartner&cid=559436367.1653353775",
        "https://sc.lfeeder.com/lftracker_v1_kn9Eq4R1l2K7RlvP.js",
        "xfe-IP-146.148.236.187-stix2-2.1-export.json",
        "bexar api 7.pdf",
        "bexasv3df.pdf",
        "xfe-URL-Hush.com-stix2-2.1-export.json",
        "https://www.indusface.com/css/A.font-styles1.css+bootstrap.css+skin.css+responsive.css+menu.css+swiper.min.css,Mcc.nAV12exFII.css.pagespeed.cf.a_yWJedOjY.css",
        "https://s.adroll.com/j/sendrolling.js",
        "https://www.heficed.com/wp/wp-includes/js/jquery/jquery-migrate.min.js",
        "http://ylnedriuopegrle33689.org/mobile/static/js/manifest.2cf63ac462750c8b3a2f.js",
        "https://script.tapfiliate.com/tapfiliate.js",
        "http://www.shopsegsistemas.com.br/assets/js/main.js",
        "bexar.org 3.2.22.pdf",
        "bexar api 22.pdf",
        "https://www.gstatic.com/firebasejs/8.1.2/firebase-app.js",
        "TarrantCounty12df.pdf",
        "5.main.bundle.e92e5e24e074f9c2a52b.js",
        "dominion voting1f",
        "https://securepubads.g.doubleclick.net/tag/js/gpt.js",
        "https://himado.com/heihei/node_modules/mdui/dist/js/mdui.min.js",
        "https://js.callrail.com/group/0/7c8f964bc12313c75ad2/06ababf0-8852-4eef-95e1-285ae467a93a/poll.js?t=1651861725881&ids%5B%5D=431115301",
        "https://static.addtoany.com/menu/page.js",
        "https://static.addtoany.com/menu/sm.23.html#type=core&event=load&url=https%3A%2F%2Fwww.apeiron.global%2F&referrer=",
        "https://www.virustotal.com/en/file/undefined/analysis/",
        "https://my.frantech.ca/templates/lagom/assets/js/whmcs-custom.min.js?v=1.4.3",
        "xfe-URL-dk9ctyhidjrvgn.xyz-stix2-2.1-export.json",
        "https://connect.facebook.net/en_US/fbevents.js",
        "tarrantcountydf.pdf",
        "https://widget.intercom.io/widget/wsyrfbge",
        "https://k.clarity.ms/s/0.6.34/clarity.js",
        "https://s4.cnzz.com/z_stat.php?id=1280305902&web_id=1280305902",
        "https://www.googletagmanager.com/gtag/js?id=UA-184179078-",
        "https://himado.com/heihei/js/swiper.min.js",
        "https://prima-abnehmen-shop.com/uk/order-now.html?affiliate=24&source=418&subid2=ddukc&subid3=35908921",
        "https://h.clarity.ms/s/0.6.34/clarity.js",
        "TarrantCounty7df.pdf",
        "https://cdn-ukwest.onetrust.com/scripttemplates/6.17.0/otBannerSdk.js",
        "https://masterhost.ru/s/masterhost_v2/build/js/compiled.min.js?v=Q/hhNATxy3sx",
        "xfe-URL-pegtech.com-stix2-2.1-export.json",
        "https://pegtech.com/wp-content/plugins/wp-video-lightbox/js/video-lightbox.js?ver=3.1.6",
        "TarrantCounty10df.pdf",
        "bexar api 18.pdf",
        "https://masterhost.ru/s/masterhost_v2/build/js/app.js?v=WivgGVzt/Ynv",
        "bexar1.pdf",
        "https://prima-abnehmen-shop.com/_Resources/Static/Packages/Seven.Prima/Scripts/Main.js?bust=2a0b1c62",
        "https://connect.facebook.net/signals/config/459577157542621?v=2.9.57&r=stable",
        "http://www.shopsegsistemas.com.br/assets/vendor/swiper/swiper-bundle.min.js",
        "https://static.me-talk.ru/cabinet/build/chat/modern.support.js",
        "http://www.shopsegsistemas.com.br/assets/vendor/glightbox/js/glightbox.min.js",
        "TarrantCounty18df.pdf",
        "https://www.hushmail.com/javascriptinclude/eNpNzEEOQDAQQNEbtVoM7Sks7GXopB0pkQ5xfWJl-5P3JWGh4AvukSRzoKKtqlWlf0Wt4k3rnG2g641Pl6QNOU83zcIn-QMj6ZHpHQ2FF97jiHOmj0ED4FxfwQOf9yPU.en_US.68448bd8190f2f2bae9633f547bbbbbe.0.js",
        "https://www.indusface.com/js/swiper.min.js.pagespeed.jm.47RtcloJQ-.js",
        "bexar api 13.pdf",
        "TarrantCounty5df.pdf",
        "https://cdf5cxngkkxd.com/static/js/manifest.e4d52d2f9dae6cd41eb4.js",
        "xfe-URL-himado.com-stix2-2.1-export.json",
        "https://web.mxradon.com/t/WebTracker.aspx?p1=18917&p2=Web%20Application%20Security%2C%20WAF%2C%20SSL%20Certificates&p3=-1&p4=&p5=1&p6=8415a029-248f-4eeb-bc18-338560430ff7&p7=&p8=&p9=0",
        "dominion5",
        "TarrantCounty20df.pdf",
        "xfe-URL-https___my.frantech.ca_-stix2-2.1-export.json",
        "TarrantCounty6df.pdf",
        "www.bexar.org - urlscan.io.pdf",
        "https://widget.wickedreports.com/widget.js",
        "https://www.virustotal.com/gui/main.6d41e0dc139508f21963.js",
        "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Reduceright",
            "Xu",
            "Okcancel",
            "Quando",
            "Gc",
            "Vd",
            "Qace",
            "Lh",
            "Waaa",
            "Bufferwriter",
            "Bufferreader",
            "Industroyer - s0604"
          ],
          "industries": [
            "Government"
          ],
          "unique_indicators": 106982
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/filter.call",
    "whois": "http://whois.domaintools.com/filter.call",
    "domain": "filter.call",
    "hostname": "o.filter.call"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 34,
  "pulses": [
    {
      "id": "6608aaf7ca0e965e593ed1d4",
      "name": "MUI programu Microsoft Office Access (w j\u0119zyku angielskim) zosta\u0142o u\u017cyte do wys\u0142ania z\u0142o\u015bliwego oprogramowania na serwer w Czechach jest to pierwszy tego typu atak na komputer.                     e",
      "description": "A look back at some of the key words and phrases used to describe the situation in Italy, as \"probacja\" (or \"democrata), as they were translated into English.",
      "modified": "2025-10-17T11:03:07.034000",
      "created": "2024-03-31T00:14:47.183000",
      "tags": [
        "sha256",
        "ssdeep",
        "reputacja",
        "tworzy pliki",
        "informacje",
        "bardzo duga",
        "tworzy",
        "adresy url",
        "tworzy katalog",
        "win64",
        "ameryki",
        "typ pliku",
        "serwer nazw",
        "san jose",
        "adres",
        "digital",
        "data wyganicia",
        "csc corporate",
        "domains",
        "ca data",
        "data utworzenia",
        "dnssec"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6432,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2140,
        "hostname": 5874,
        "FileHash-SHA256": 12539,
        "FileHash-MD5": 3686,
        "FileHash-SHA1": 2751,
        "IPv4": 503,
        "URL": 10770,
        "email": 26,
        "CVE": 88,
        "YARA": 6,
        "JA3": 2,
        "IPv6": 28,
        "SSLCertFingerprint": 5,
        "BitcoinAddress": 3,
        "CIDR": 1
      },
      "indicator_count": 38422,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "184 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "663d2869e0f3a42bbddc42ff",
      "name": "UPX executable packer.",
      "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
      "modified": "2024-10-14T00:01:17.069000",
      "created": "2024-05-09T19:47:53.786000",
      "tags": [
        "cioch adrian",
        "centrum usug",
        "sieciowych",
        "elf binary",
        "upx compression",
        "roth",
        "nextron",
        "info",
        "javascript",
        "html",
        "office open",
        "xml document",
        "network capture",
        "win32 exe",
        "xml pakietu",
        "pdf zestawy",
        "przechwytywanie",
        "office",
        "filehashsha1",
        "url https",
        "cve cve20201070",
        "cve cve20203153",
        "cve cve20201048",
        "cve cve20211732",
        "cve20201048 apr",
        "filehashmd5",
        "cve cve20010901",
        "cve cve20021841",
        "cve20153202 apr",
        "cve cve20160728",
        "cve cve20161807",
        "cve cve20175123",
        "cve20185407 apr",
        "cve cve20054605",
        "cve cve20060745",
        "cve cve20070452",
        "cve cve20070453",
        "cve cve20070454",
        "cve cve20071355",
        "cve cve20071358",
        "cve cve20071871",
        "cve20149614 apr",
        "cve cve20151503",
        "cve cve20152080",
        "cve cve20157377",
        "cve cve20170131",
        "cve20200796 may",
        "cve cve20113403"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6861,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 5771,
        "domain": 3139,
        "URL": 14525,
        "FileHash-SHA1": 2610,
        "IPv4": 108,
        "CIDR": 40,
        "FileHash-SHA256": 10705,
        "FileHash-MD5": 3373,
        "YARA": 2,
        "CVE": 148,
        "Mutex": 7,
        "FilePath": 3,
        "SSLCertFingerprint": 3,
        "email": 23,
        "JA3": 1,
        "IPv6": 2
      },
      "indicator_count": 40460,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "553 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708eb824dc4c51811f6de9",
      "name": "Indusface  - in YOUR face ;)",
      "description": "",
      "modified": "2023-12-06T15:09:44.273000",
      "created": "2023-12-06T15:09:44.273000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 307,
        "hostname": 333,
        "domain": 192,
        "URL": 1143,
        "FileHash-MD5": 1
      },
      "indicator_count": 1976,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708d657f0895a860febf8f",
      "name": "SafeFrame Container",
      "description": "",
      "modified": "2023-12-06T15:04:05.932000",
      "created": "2023-12-06T15:04:05.932000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1416,
        "domain": 2979,
        "URL": 8250,
        "hostname": 2262
      },
      "indicator_count": 14907,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708cca842536f1582636be",
      "name": "apeiron.global",
      "description": "",
      "modified": "2023-12-06T15:01:30.558000",
      "created": "2023-12-06T15:01:30.558000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 498,
        "hostname": 388,
        "domain": 242,
        "CVE": 1,
        "URL": 1203,
        "FileHash-MD5": 1
      },
      "indicator_count": 2333,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708beba2ba8bcfb1d10237",
      "name": "hostkey - Industroyer&ReduceRight",
      "description": "",
      "modified": "2023-12-06T14:57:47.430000",
      "created": "2023-12-06T14:57:47.430000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 304,
        "hostname": 563,
        "domain": 407,
        "URL": 1776,
        "FileHash-SHA1": 2
      },
      "indicator_count": 3052,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65708aa1dca4e6c505e4fc9e",
      "name": "Botnet c&c",
      "description": "",
      "modified": "2023-12-06T14:52:16.286000",
      "created": "2023-12-06T14:52:16.286000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 214,
        "hostname": 334,
        "URL": 1182,
        "FileHash-SHA256": 33
      },
      "indicator_count": 1763,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657080d20f7e10c1e37fcf89",
      "name": "TarrantCounty.com ~ 03.01.2022",
      "description": "",
      "modified": "2023-12-06T14:10:26.301000",
      "created": "2023-12-06T14:10:26.301000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1078,
        "domain": 838,
        "hostname": 1607,
        "URL": 4134,
        "email": 3,
        "FileHash-SHA1": 2,
        "CIDR": 4,
        "FileHash-MD5": 15
      },
      "indicator_count": 7681,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "657080735501c11ddbb7a988",
      "name": "Dominionvoting.com 03.03.22",
      "description": "",
      "modified": "2023-12-06T14:08:51.329000",
      "created": "2023-12-06T14:08:51.329000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 663,
        "hostname": 588,
        "domain": 413,
        "URL": 2183,
        "FileHash-MD5": 7
      },
      "indicator_count": 3854,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570805953274b32ec1f981b",
      "name": "Votebuilder.com",
      "description": "",
      "modified": "2023-12-06T14:08:25.588000",
      "created": "2023-12-06T14:08:25.588000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 869,
        "domain": 834,
        "URL": 4755,
        "hostname": 1559,
        "CIDR": 2,
        "FileHash-MD5": 10
      },
      "indicator_count": 8029,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://o.filter.call",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://o.filter.call",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776670913.1064112
}