{
  "type": "URL",
  "indicator": "https://pega.eu.alterdomus.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://pega.eu.alterdomus.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4069861475,
      "indicator": "https://pega.eu.alterdomus.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69feb6b2fa376059b4216e8f",
          "name": "Habo Analysis System  - Unsigned- Critical Rest&Discover Certificate Chain Update",
          "description": "ba5e45e22cce048299a18027bc808faa4e907cfd0346f39f3bea2586c1e2954a- file is not signed- 2011-09-26 17:36:15 UTC- rest using link querys + d1c00920f5f34b770f530d28d087510191202d562c26802f4774ec14f88807e2 file is not signed 2011-09-26 17:34:29 UTC Rest Discover Spreadsheet Contents",
          "modified": "2026-05-09T10:45:57.198000",
          "created": "2026-05-09T04:23:14.660000",
          "tags": [
            "server",
            "date",
            "domain status",
            "registrar abuse",
            "registrar",
            "dnssec",
            "domain name",
            "registrant city",
            "us registrant",
            "email",
            "code",
            "contact",
            "pe32",
            "intel",
            "ms windows",
            "generic cil",
            "executable",
            "mono",
            "win32 dynamic",
            "link library",
            "delphi generic",
            "pe32 library",
            "icons library",
            "blob",
            "strings",
            "admin country",
            "expiration date",
            "registry domain",
            "registrar iana",
            "creation date",
            "admin city"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1033",
              "name": "System Owner/User Discovery",
              "display_name": "T1033 - System Owner/User Discovery"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1074",
              "name": "Data Staged",
              "display_name": "T1074 - Data Staged"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1542",
              "name": "Pre-OS Boot",
              "display_name": "T1542 - Pre-OS Boot"
            },
            {
              "id": "T1543",
              "name": "Create or Modify System Process",
              "display_name": "T1543 - Create or Modify System Process"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1091",
              "name": "Replication Through Removable Media",
              "display_name": "T1091 - Replication Through Removable Media"
            },
            {
              "id": "T1120",
              "name": "Peripheral Device Discovery",
              "display_name": "T1120 - Peripheral Device Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1375,
            "hostname": 1101,
            "URL": 1336,
            "domain": 507,
            "email": 89,
            "FileHash-MD5": 1306,
            "FileHash-SHA1": 406,
            "IPv4": 268,
            "IPv6": 6,
            "CIDR": 35
          },
          "indicator_count": 6429,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "23 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "682874fe0c1ffb595c485d39",
          "name": "http_vgt.pl_admin.gname.net_content.html    77b20b5cd41bc6bb475cca3f91ae6e3c",
          "description": "VGT.pl Franas.A Z\u0142odziej jakich ma\u0142o, s\u0105 4K plik\u00f3w allegro ( oszustwa , machlojki itd)\nhttps://www.virustotal.com/gui/file/5511a9b9f9144ed7bde4ccb074733b7c564d918d2a8https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=d7293ed6e3c6856f7d5bc23f60f0fa2f2c16fb99b10d391afc6be5b3b1509/relations",
          "modified": "2025-06-20T10:03:27.328000",
          "created": "2025-05-17T11:37:34.134000",
          "tags": [
            "sha1",
            "sha512",
            "sha256"
          ],
          "references": [
            "MD5 77b20b5cd41bc6bb475cca3f91ae6e3c",
            "SHA1 9e98ace72bd2ab931341427a856ef4cea6faf806",
            "\u201ec:\\program files\\internet explorer\\iexplore.exe\u201d SCODEF:2820 CREDAT:79873",
            "VGT INTERNET - pozycjonowanie, serwery, domena, strony www, poligrafia",
            "c:\\u\u017cytkownicy\\administrator\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 877,
            "FileHash-MD5": 1455,
            "FileHash-SHA256": 3502,
            "CVE": 5,
            "domain": 351,
            "hostname": 1459,
            "URL": 2343,
            "IPv4": 1,
            "CIDR": 1
          },
          "indicator_count": 9994,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 124,
          "modified_text": "346 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "MD5 77b20b5cd41bc6bb475cca3f91ae6e3c",
        "c:\\u\u017cytkownicy\\administrator\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157",
        "SHA1 9e98ace72bd2ab931341427a856ef4cea6faf806",
        "VGT INTERNET - pozycjonowanie, serwery, domena, strony www, poligrafia",
        "\u201ec:\\program files\\internet explorer\\iexplore.exe\u201d SCODEF:2820 CREDAT:79873"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 12861
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/alterdomus.com",
    "whois": "http://whois.domaintools.com/alterdomus.com",
    "domain": "alterdomus.com",
    "hostname": "pega.eu.alterdomus.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69feb6b2fa376059b4216e8f",
      "name": "Habo Analysis System  - Unsigned- Critical Rest&Discover Certificate Chain Update",
      "description": "ba5e45e22cce048299a18027bc808faa4e907cfd0346f39f3bea2586c1e2954a- file is not signed- 2011-09-26 17:36:15 UTC- rest using link querys + d1c00920f5f34b770f530d28d087510191202d562c26802f4774ec14f88807e2 file is not signed 2011-09-26 17:34:29 UTC Rest Discover Spreadsheet Contents",
      "modified": "2026-05-09T10:45:57.198000",
      "created": "2026-05-09T04:23:14.660000",
      "tags": [
        "server",
        "date",
        "domain status",
        "registrar abuse",
        "registrar",
        "dnssec",
        "domain name",
        "registrant city",
        "us registrant",
        "email",
        "code",
        "contact",
        "pe32",
        "intel",
        "ms windows",
        "generic cil",
        "executable",
        "mono",
        "win32 dynamic",
        "link library",
        "delphi generic",
        "pe32 library",
        "icons library",
        "blob",
        "strings",
        "admin country",
        "expiration date",
        "registry domain",
        "registrar iana",
        "creation date",
        "admin city"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1033",
          "name": "System Owner/User Discovery",
          "display_name": "T1033 - System Owner/User Discovery"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1074",
          "name": "Data Staged",
          "display_name": "T1074 - Data Staged"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1542",
          "name": "Pre-OS Boot",
          "display_name": "T1542 - Pre-OS Boot"
        },
        {
          "id": "T1543",
          "name": "Create or Modify System Process",
          "display_name": "T1543 - Create or Modify System Process"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1091",
          "name": "Replication Through Removable Media",
          "display_name": "T1091 - Replication Through Removable Media"
        },
        {
          "id": "T1120",
          "name": "Peripheral Device Discovery",
          "display_name": "T1120 - Peripheral Device Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1375,
        "hostname": 1101,
        "URL": 1336,
        "domain": 507,
        "email": 89,
        "FileHash-MD5": 1306,
        "FileHash-SHA1": 406,
        "IPv4": 268,
        "IPv6": 6,
        "CIDR": 35
      },
      "indicator_count": 6429,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "23 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "682874fe0c1ffb595c485d39",
      "name": "http_vgt.pl_admin.gname.net_content.html    77b20b5cd41bc6bb475cca3f91ae6e3c",
      "description": "VGT.pl Franas.A Z\u0142odziej jakich ma\u0142o, s\u0105 4K plik\u00f3w allegro ( oszustwa , machlojki itd)\nhttps://www.virustotal.com/gui/file/5511a9b9f9144ed7bde4ccb074733b7c564d918d2a8https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=d7293ed6e3c6856f7d5bc23f60f0fa2f2c16fb99b10d391afc6be5b3b1509/relations",
      "modified": "2025-06-20T10:03:27.328000",
      "created": "2025-05-17T11:37:34.134000",
      "tags": [
        "sha1",
        "sha512",
        "sha256"
      ],
      "references": [
        "MD5 77b20b5cd41bc6bb475cca3f91ae6e3c",
        "SHA1 9e98ace72bd2ab931341427a856ef4cea6faf806",
        "\u201ec:\\program files\\internet explorer\\iexplore.exe\u201d SCODEF:2820 CREDAT:79873",
        "VGT INTERNET - pozycjonowanie, serwery, domena, strony www, poligrafia",
        "c:\\u\u017cytkownicy\\administrator\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 877,
        "FileHash-MD5": 1455,
        "FileHash-SHA256": 3502,
        "CVE": 5,
        "domain": 351,
        "hostname": 1459,
        "URL": 2343,
        "IPv4": 1,
        "CIDR": 1
      },
      "indicator_count": 9994,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 124,
      "modified_text": "346 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://pega.eu.alterdomus.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://pega.eu.alterdomus.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780326300.0393696
}