{
  "type": "URL",
  "indicator": "https://orcusworld.help",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://orcusworld.help",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4291964600,
      "indicator": "https://orcusworld.help",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69cefd4604a91bf7ca712de4",
          "name": "VirusTotal report\n                    for ul Business Intelligence. Moving Beyond the Obvious 2007.pdf",
          "description": "Researchers have identified the source of a malware that has infected more than 100,000 computers in the past month and is believed to have been linked to a network known as the \"Pulses\".",
          "modified": "2026-04-03T00:09:14.952000",
          "created": "2026-04-02T23:35:34.946000",
          "tags": [
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious ids",
            "query",
            "united",
            "as4249",
            "location united",
            "america flag",
            "america asn",
            "dns resolutions",
            "domain",
            "pulses",
            "related tags",
            "indicator facts",
            "creation date",
            "name servers",
            "ddos mitigation",
            "expiration date",
            "ip address",
            "asn as4249",
            "whois registrar",
            "rethem hosting",
            "date",
            "name",
            "billing city",
            "billing country",
            "billing email",
            "billing state",
            "create date",
            "expiry date",
            "query time",
            "available from",
            "code",
            "registry tech",
            "server",
            "registrar abuse",
            "email",
            "admin country",
            "registry domain",
            "registrar iana",
            "thumbprint",
            "ipv4",
            "active related",
            "pulses ipv4",
            "unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 19,
            "FileHash-SHA1": 25,
            "FileHash-SHA256": 769,
            "IPv4": 25,
            "domain": 116,
            "hostname": 248,
            "URL": 351,
            "email": 4,
            "CVE": 1
          },
          "indicator_count": 1558,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "16 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69cefd455bb5b78f3a3644bd",
          "name": "VirusTotal report\n                    for ul Business Intelligence. Moving Beyond the Obvious 2007.pdf",
          "description": "Researchers have identified the source of a malware that has infected more than 100,000 computers in the past month and is believed to have been linked to a network known as the \"Pulses\".",
          "modified": "2026-04-03T00:08:47.559000",
          "created": "2026-04-02T23:35:33.326000",
          "tags": [
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious ids",
            "query",
            "united",
            "as4249",
            "location united",
            "america flag",
            "america asn",
            "dns resolutions",
            "domain",
            "pulses",
            "related tags",
            "indicator facts",
            "creation date",
            "name servers",
            "ddos mitigation",
            "expiration date",
            "ip address",
            "asn as4249",
            "whois registrar",
            "rethem hosting",
            "date",
            "name",
            "billing city",
            "billing country",
            "billing email",
            "billing state",
            "create date",
            "expiry date",
            "query time",
            "available from",
            "code",
            "registry tech",
            "server",
            "registrar abuse",
            "email",
            "admin country",
            "registry domain",
            "registrar iana",
            "thumbprint",
            "ipv4",
            "active related",
            "pulses ipv4",
            "unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 19,
            "FileHash-SHA1": 25,
            "FileHash-SHA256": 769,
            "IPv4": 25,
            "domain": 116,
            "hostname": 248,
            "URL": 351,
            "email": 4,
            "CVE": 1
          },
          "indicator_count": 1558,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 48,
          "modified_text": "16 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 1560
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/orcusworld.help",
    "whois": "http://whois.domaintools.com/orcusworld.help",
    "domain": "orcusworld.help",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69cefd4604a91bf7ca712de4",
      "name": "VirusTotal report\n                    for ul Business Intelligence. Moving Beyond the Obvious 2007.pdf",
      "description": "Researchers have identified the source of a malware that has infected more than 100,000 computers in the past month and is believed to have been linked to a network known as the \"Pulses\".",
      "modified": "2026-04-03T00:09:14.952000",
      "created": "2026-04-02T23:35:34.946000",
      "tags": [
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious ids",
        "query",
        "united",
        "as4249",
        "location united",
        "america flag",
        "america asn",
        "dns resolutions",
        "domain",
        "pulses",
        "related tags",
        "indicator facts",
        "creation date",
        "name servers",
        "ddos mitigation",
        "expiration date",
        "ip address",
        "asn as4249",
        "whois registrar",
        "rethem hosting",
        "date",
        "name",
        "billing city",
        "billing country",
        "billing email",
        "billing state",
        "create date",
        "expiry date",
        "query time",
        "available from",
        "code",
        "registry tech",
        "server",
        "registrar abuse",
        "email",
        "admin country",
        "registry domain",
        "registrar iana",
        "thumbprint",
        "ipv4",
        "active related",
        "pulses ipv4",
        "unknown"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 19,
        "FileHash-SHA1": 25,
        "FileHash-SHA256": 769,
        "IPv4": 25,
        "domain": 116,
        "hostname": 248,
        "URL": 351,
        "email": 4,
        "CVE": 1
      },
      "indicator_count": 1558,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "16 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69cefd455bb5b78f3a3644bd",
      "name": "VirusTotal report\n                    for ul Business Intelligence. Moving Beyond the Obvious 2007.pdf",
      "description": "Researchers have identified the source of a malware that has infected more than 100,000 computers in the past month and is believed to have been linked to a network known as the \"Pulses\".",
      "modified": "2026-04-03T00:08:47.559000",
      "created": "2026-04-02T23:35:33.326000",
      "tags": [
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious ids",
        "query",
        "united",
        "as4249",
        "location united",
        "america flag",
        "america asn",
        "dns resolutions",
        "domain",
        "pulses",
        "related tags",
        "indicator facts",
        "creation date",
        "name servers",
        "ddos mitigation",
        "expiration date",
        "ip address",
        "asn as4249",
        "whois registrar",
        "rethem hosting",
        "date",
        "name",
        "billing city",
        "billing country",
        "billing email",
        "billing state",
        "create date",
        "expiry date",
        "query time",
        "available from",
        "code",
        "registry tech",
        "server",
        "registrar abuse",
        "email",
        "admin country",
        "registry domain",
        "registrar iana",
        "thumbprint",
        "ipv4",
        "active related",
        "pulses ipv4",
        "unknown"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 19,
        "FileHash-SHA1": 25,
        "FileHash-SHA256": 769,
        "IPv4": 25,
        "domain": 116,
        "hostname": 248,
        "URL": 351,
        "email": 4,
        "CVE": 1
      },
      "indicator_count": 1558,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 48,
      "modified_text": "16 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://orcusworld.help",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://orcusworld.help",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629322.4602637
}