{
  "type": "URL",
  "indicator": "https://oak.ct.letsencrypt.org/2025h1",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://oak.ct.letsencrypt.org/2025h1",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #233",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain letsencrypt.org",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain letsencrypt.org",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 3856550597,
      "indicator": "https://oak.ct.letsencrypt.org/2025h1",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "688fa1290b459ca0e307fcbd",
          "name": "http://www.jeffreyrusertjeffersoncounty.net/",
          "description": "Does this mean a someone who SA\u2019d and critically injured someone was given legal access to also spy on his victim? \nFurther investigation needed. Now ther is a little phone symbol blinking on my device. Weirdness.",
          "modified": "2025-09-02T10:03:26.815000",
          "created": "2025-08-03T17:49:29.657000",
          "tags": [
            "status",
            "creation date",
            "date",
            "domain add",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "location united",
            "asn as396982",
            "whois registrar",
            "pulses",
            "related tags",
            "indicator facts",
            "historical otx",
            "pulse",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "mitre att",
            "ck techniques",
            "spawns",
            "falcon sandbox",
            "hybrid",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "ascii text",
            "size",
            "null",
            "refresh",
            "body",
            "span",
            "august",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "linux x8664",
            "khtml",
            "gecko",
            "veryhigh",
            "redirect",
            "httpsupgrades",
            "config",
            "runner",
            "us seen",
            "general info",
            "geo kansas",
            "city",
            "missouri",
            "united",
            "as396982",
            "us note",
            "route",
            "ptr record",
            "live",
            "november",
            "value emails",
            "dnssec",
            "domain name",
            "llc status",
            "whois server",
            "showing",
            "entries",
            "olet",
            "encrypt",
            "cnr3",
            "cnr10",
            "cnr11",
            "ilike search",
            "id logged",
            "common name",
            "issuer name",
            "encrypt https",
            "expired",
            "key usage",
            "tls web",
            "identifier",
            "search criteria",
            "timestamp entry",
            "log operator",
            "log url",
            "google https",
            "poison",
            "info",
            "certificate",
            "linter",
            "precertificate",
            "tls server",
            "subject dn",
            "ascii",
            "sha256 hash",
            "graph",
            "sectigo https",
            "ca mechanism",
            "provider status",
            "revocation date",
            "log id",
            "criteria id",
            "16566017041",
            "summary leaf",
            "15317728412",
            "15385730680",
            "sequence",
            "octet string",
            "pkcs",
            "integer",
            "null bit",
            "string",
            "boolean",
            "pkix key",
            "pkix",
            "observed"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 69,
            "URL": 226,
            "hostname": 64,
            "email": 1,
            "FileHash-SHA256": 143,
            "FileHash-MD5": 28,
            "FileHash-SHA1": 35,
            "CIDR": 1,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 571,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "271 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6812d673d694d0d064b4158b",
          "name": "clientTransferProhibited",
          "description": "https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=bad774e4c9e4b8731eef3f28426b53a620dec136",
          "modified": "2025-05-04T16:48:17.227000",
          "created": "2025-05-01T02:03:31.221000",
          "tags": [
            "nadajcy si",
            "google https",
            "sektygo https",
            "szyfrujmy https",
            "zaufaj azji",
            "tylko",
            "chmura https"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 154,
            "hostname": 55,
            "domain": 3,
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 1
          },
          "indicator_count": 215,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "392 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67ac6812ad5418d2e6ad884d",
          "name": "lencr.org - Szyfrujmy",
          "description": "Wystawca Let's Encrypt wedi cyhoeddi i'wch wrthod na fywodraeth \u00c2\u00a31.5m (\u20ac2.4m)",
          "modified": "2025-03-14T00:03:58.923000",
          "created": "2025-02-12T09:21:22.592000",
          "tags": [
            "fe95 wano",
            "gmt typ",
            "tekst ascii",
            "rozmiar",
            "haszysz",
            "nagwki http",
            "windows nt",
            "win64",
            "accept",
            "date",
            "znaleziono",
            "przeniesiony",
            "b99d0e64 wano",
            "element skryptu",
            "osadzone w",
            "html fasz",
            "ostatnio",
            "widziano"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 51,
            "hostname": 4,
            "FileHash-SHA256": 25,
            "FileHash-MD5": 4,
            "FileHash-SHA1": 4,
            "SSLCertFingerprint": 2,
            "domain": 37
          },
          "indicator_count": 127,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "443 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 918
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/letsencrypt.org",
    "whois": "http://whois.domaintools.com/letsencrypt.org",
    "domain": "letsencrypt.org",
    "hostname": "oak.ct.letsencrypt.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "688fa1290b459ca0e307fcbd",
      "name": "http://www.jeffreyrusertjeffersoncounty.net/",
      "description": "Does this mean a someone who SA\u2019d and critically injured someone was given legal access to also spy on his victim? \nFurther investigation needed. Now ther is a little phone symbol blinking on my device. Weirdness.",
      "modified": "2025-09-02T10:03:26.815000",
      "created": "2025-08-03T17:49:29.657000",
      "tags": [
        "status",
        "creation date",
        "date",
        "domain add",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "location united",
        "asn as396982",
        "whois registrar",
        "pulses",
        "related tags",
        "indicator facts",
        "historical otx",
        "pulse",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "mitre att",
        "ck techniques",
        "spawns",
        "falcon sandbox",
        "hybrid",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "ascii text",
        "size",
        "null",
        "refresh",
        "body",
        "span",
        "august",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "linux x8664",
        "khtml",
        "gecko",
        "veryhigh",
        "redirect",
        "httpsupgrades",
        "config",
        "runner",
        "us seen",
        "general info",
        "geo kansas",
        "city",
        "missouri",
        "united",
        "as396982",
        "us note",
        "route",
        "ptr record",
        "live",
        "november",
        "value emails",
        "dnssec",
        "domain name",
        "llc status",
        "whois server",
        "showing",
        "entries",
        "olet",
        "encrypt",
        "cnr3",
        "cnr10",
        "cnr11",
        "ilike search",
        "id logged",
        "common name",
        "issuer name",
        "encrypt https",
        "expired",
        "key usage",
        "tls web",
        "identifier",
        "search criteria",
        "timestamp entry",
        "log operator",
        "log url",
        "google https",
        "poison",
        "info",
        "certificate",
        "linter",
        "precertificate",
        "tls server",
        "subject dn",
        "ascii",
        "sha256 hash",
        "graph",
        "sectigo https",
        "ca mechanism",
        "provider status",
        "revocation date",
        "log id",
        "criteria id",
        "16566017041",
        "summary leaf",
        "15317728412",
        "15385730680",
        "sequence",
        "octet string",
        "pkcs",
        "integer",
        "null bit",
        "string",
        "boolean",
        "pkix key",
        "pkix",
        "observed"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 69,
        "URL": 226,
        "hostname": 64,
        "email": 1,
        "FileHash-SHA256": 143,
        "FileHash-MD5": 28,
        "FileHash-SHA1": 35,
        "CIDR": 1,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 571,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "271 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6812d673d694d0d064b4158b",
      "name": "clientTransferProhibited",
      "description": "https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=bad774e4c9e4b8731eef3f28426b53a620dec136",
      "modified": "2025-05-04T16:48:17.227000",
      "created": "2025-05-01T02:03:31.221000",
      "tags": [
        "nadajcy si",
        "google https",
        "sektygo https",
        "szyfrujmy https",
        "zaufaj azji",
        "tylko",
        "chmura https"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 154,
        "hostname": 55,
        "domain": 3,
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 1
      },
      "indicator_count": 215,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "392 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67ac6812ad5418d2e6ad884d",
      "name": "lencr.org - Szyfrujmy",
      "description": "Wystawca Let's Encrypt wedi cyhoeddi i'wch wrthod na fywodraeth \u00c2\u00a31.5m (\u20ac2.4m)",
      "modified": "2025-03-14T00:03:58.923000",
      "created": "2025-02-12T09:21:22.592000",
      "tags": [
        "fe95 wano",
        "gmt typ",
        "tekst ascii",
        "rozmiar",
        "haszysz",
        "nagwki http",
        "windows nt",
        "win64",
        "accept",
        "date",
        "znaleziono",
        "przeniesiony",
        "b99d0e64 wano",
        "element skryptu",
        "osadzone w",
        "html fasz",
        "ostatnio",
        "widziano"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 51,
        "hostname": 4,
        "FileHash-SHA256": 25,
        "FileHash-MD5": 4,
        "FileHash-SHA1": 4,
        "SSLCertFingerprint": 2,
        "domain": 37
      },
      "indicator_count": 127,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "443 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://oak.ct.letsencrypt.org/2025h1",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://oak.ct.letsencrypt.org/2025h1",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780264080.026157
}