{ "type": "URL", "indicator": "https://p.teknik.io/3lTTf", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://p.teknik.io/3lTTf", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3635619618, "indicator": "https://p.teknik.io/3lTTf", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "68245681009c35da8f04b45b", "name": "2606:4700:3036::ac43:a8cb (2606:4700:3000::/42)", "description": "Here is a full set of words and phrases used by the BBC to describe the various types of ransomware that can be used to target victims of the Windows operating system, as well as the UK.", "modified": "2025-06-13T07:02:14.919000", "created": "2025-05-14T08:38:25.425000", "tags": [ "assignment", "cloudflare", "admin", "cloudflarenet", "allocation", "cloud14", "townsend stnsan", "warp abuse", "service", "arin rdapwhois", "rdapwhois", "reporting", "copyright", "registry", "wallet", "azaz09", "firefox", "windows nt", "windows", "data", "value", "sandbox", "edge", "msie", "example", "terminal", "phantom", "anubis", "bitcoin", "crypto", "exodus", "android", "keeper", "steam", "webdav", "explorer", "finger", "malware", "schmidti", "dllimport", "emotet", "mozilla", "win64", "insta", "solo", "union", "discord", "liberty", "saturn", "terra", "temple", "harmony", "core", "easy", "ultimate", "cash", "therat", "python image", "load", "python core", "python script", "py2exe", "john", "open threat", "research", "files", "comment", "python dll", "sideloading id", "dll sideloading", "poudel date", "filespython3", "studio", "python dlls", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [ "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "indicator_suspicious.yar", "Python Image Load By Non-Python Process.yml", "Potential Python DLL SideLoading.yml", "indicator_packed.yar" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TheRat", "display_name": "TheRat", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 870, "email": 4, "hostname": 148, "FileHash-SHA256": 471, "domain": 47, "FileHash-MD5": 2, "FileHash-SHA1": 2, "YARA": 163, "CVE": 1 }, "indicator_count": 1710, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570974f872f3ad80a8b32c7", "name": "TarD5B7.tmp - and all using its ioc's", "description": "", "modified": "2023-12-06T15:46:23.604000", "created": "2023-12-06T15:46:23.604000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 6924, "CVE": 4, "FileHash-SHA256": 24687, "URL": 23965, "domain": 6830, "FileHash-MD5": 943, "FileHash-SHA1": 395, "email": 67 }, "indicator_count": 63815, "is_author": false, "is_subscribing": null, "subscriber_count": 113, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63f4e8f331fad5e54c0bed1e", "name": "TarD5B7.tmp - and all using its ioc's", "description": "TarD5B7.tmp\nc0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd", "modified": "2023-03-23T00:00:46.897000", "created": "2023-02-21T15:53:23.273000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "TarD5B7.tmp" ], "references": [ "TarD587.tmp - c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd", "https://hybrid-analysis.com/sample/c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 23965, "hostname": 6924, "FileHash-SHA256": 24687, "domain": 6830, "CVE": 4, "email": 67, "FileHash-MD5": 943, "FileHash-SHA1": 395 }, "indicator_count": 63815, "is_author": false, "is_subscribing": null, "subscriber_count": 94, "modified_text": "1123 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "indicator_packed.yar", "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "Potential Python DLL SideLoading.yml", "TarD587.tmp - c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "Python Image Load By Non-Python Process.yml", "https://hybrid-analysis.com/sample/c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "indicator_suspicious.yar", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Therat" ], "industries": [], "unique_indicators": 65696 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/teknik.io", "whois": "http://whois.domaintools.com/teknik.io", "domain": "teknik.io", "hostname": "p.teknik.io" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "68245681009c35da8f04b45b", "name": "2606:4700:3036::ac43:a8cb (2606:4700:3000::/42)", "description": "Here is a full set of words and phrases used by the BBC to describe the various types of ransomware that can be used to target victims of the Windows operating system, as well as the UK.", "modified": "2025-06-13T07:02:14.919000", "created": "2025-05-14T08:38:25.425000", "tags": [ "assignment", "cloudflare", "admin", "cloudflarenet", "allocation", "cloud14", "townsend stnsan", "warp abuse", "service", "arin rdapwhois", "rdapwhois", "reporting", "copyright", "registry", "wallet", "azaz09", "firefox", "windows nt", "windows", "data", "value", "sandbox", "edge", "msie", "example", "terminal", "phantom", "anubis", "bitcoin", "crypto", "exodus", "android", "keeper", "steam", "webdav", "explorer", "finger", "malware", "schmidti", "dllimport", "emotet", "mozilla", "win64", "insta", "solo", "union", "discord", "liberty", "saturn", "terra", "temple", "harmony", "core", "easy", "ultimate", "cash", "therat", "python image", "load", "python core", "python script", "py2exe", "john", "open threat", "research", "files", "comment", "python dll", "sideloading id", "dll sideloading", "poudel date", "filespython3", "studio", "python dlls", "confuserex mod", "aspirecrypt", "detects", "reactor", "beds protector", "ps2exe", "bsjb", "boxedapp", "cyaxsharp", "cyaxpng", "smartassembly", "koivm", "confuserex", "obfuscator", "aspack", "titan", "enigma", "vmprotect", "strings", "rlpack", "antiem", "antisb", "themida", "loader", "sality", "dnguard" ], "references": [ "https://rdap.arin.net/registry/entity/CLOUD14", "https://rdap.arin.net/registry/entity/CLOUD146-ARIN", "https://rdap.arin.net/registry/entity/ABUSE2916-ARIN", "https://rdap.arin.net/registry/entity/ADMIN2521-ARIN", "https://rdap.arin.net/registry/entity/NOC11962-ARIN", "indicator_suspicious.yar", "Python Image Load By Non-Python Process.yml", "Potential Python DLL SideLoading.yml", "indicator_packed.yar" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "TheRat", "display_name": "TheRat", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 41, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Arek-BTC", "id": "212764", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 2, "URL": 870, "email": 4, "hostname": 148, "FileHash-SHA256": 471, "domain": 47, "FileHash-MD5": 2, "FileHash-SHA1": 2, "YARA": 163, "CVE": 1 }, "indicator_count": 1710, "is_author": false, "is_subscribing": null, "subscriber_count": 124, "modified_text": "310 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570974f872f3ad80a8b32c7", "name": "TarD5B7.tmp - and all using its ioc's", "description": "", "modified": "2023-12-06T15:46:23.604000", "created": "2023-12-06T15:46:23.604000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 6924, "CVE": 4, "FileHash-SHA256": 24687, "URL": 23965, "domain": 6830, "FileHash-MD5": 943, "FileHash-SHA1": 395, "email": 67 }, "indicator_count": 63815, "is_author": false, "is_subscribing": null, "subscriber_count": 113, "modified_text": "864 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "63f4e8f331fad5e54c0bed1e", "name": "TarD5B7.tmp - and all using its ioc's", "description": "TarD5B7.tmp\nc0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd", "modified": "2023-03-23T00:00:46.897000", "created": "2023-02-21T15:53:23.273000", "tags": [ "sandbox", "malware", "analysis", "online", "submit", "vxstream", "sample", "download", "trojan", "apt", "hybrid analysis", "api key", "vetting process", "please note", "please", "TarD5B7.tmp" ], "references": [ "TarD587.tmp - c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd", "https://hybrid-analysis.com/sample/c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "callmeDoris", "id": "205385", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 23965, "hostname": 6924, "FileHash-SHA256": 24687, "domain": 6830, "CVE": 4, "email": 67, "FileHash-MD5": 943, "FileHash-SHA1": 395 }, "indicator_count": 63815, "is_author": false, "is_subscribing": null, "subscriber_count": 94, "modified_text": "1123 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://p.teknik.io/3lTTf", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://p.teknik.io/3lTTf", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776612973.4563901 }