{
  "type": "URL",
  "indicator": "https://plussimo.keyvance-it.de",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://plussimo.keyvance-it.de",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3770993196,
      "indicator": "https://plussimo.keyvance-it.de",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "65a20ff8db3854e863dca324",
          "name": "Shared Modules | Hijacker | Masquerading",
          "description": "",
          "modified": "2024-02-12T04:01:56.040000",
          "created": "2024-01-13T04:22:16.961000",
          "tags": [
            "filehashmd5",
            "no expiration",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "hostname",
            "expiration",
            "domain",
            "url https",
            "url http",
            "source",
            "stix",
            "email",
            "email abuse",
            "goreasonlimited",
            "cc no",
            "tompc",
            "sum35",
            "domain xn",
            "searchbox0",
            "domainname0",
            "view",
            "apple",
            "apple id",
            "hijacking",
            "masquerading",
            "exploit",
            "cams",
            "monitoring",
            "loki bot",
            "dns",
            "open ports",
            "malvertizing",
            "malware hosting",
            "apple script",
            "js user",
            "dga",
            "dga domains",
            "malware",
            "multiple_versions",
            "wagersta",
            "decode",
            "system information discovery",
            "decrypt",
            "evasion",
            "defense evasion",
            "emotet",
            "android",
            "ios",
            "wannacry",
            "trojan",
            "worm",
            "cyber threat",
            "benjamin",
            "whois record",
            "ssl certificate",
            "contacted",
            "historical ssl",
            "referrer",
            "contacted urls",
            "execution",
            "whois whois",
            "whois sslcert",
            "and china",
            "drop",
            "uchealth",
            "university of cincinnati health"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2701,
            "FileHash-SHA1": 2296,
            "FileHash-SHA256": 3362,
            "URL": 6191,
            "domain": 2033,
            "hostname": 3097,
            "email": 37,
            "CVE": 2
          },
          "indicator_count": 19719,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "798 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8d167202b93ee502ff8",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "",
          "modified": "2023-12-06T17:01:05.291000",
          "created": "2023-12-06T17:01:05.291000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 12,
            "URL": 3839,
            "hostname": 1331,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65298a6839a49a9aa732bcac",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "IC3 attached to links, apple , messaging, Skype.\nIC3 CN?\nChina? Unclear. Possibly intercepting  IC3 complaints or linking to FBI to frame targets. Links show attack is Attorney orchestrated. \nSame group of Apple iTune links affected by Java.Trojan.GenericGB, Apple NetWorm Trojan.Buzus, Dropper.Mudrop, GenPack:Trojan.Generic, Worm.Mytob ,Phishing site, Anonymizer , netsky ,worm and other vulnerabilities over time. \u200eSign of the Times \u2013 Album par Dembiak Music \u2013 Apple Music Autonomous Systems: AS714 Apple Inc AS14061 Digital Ocean Inc AS8560 1 1 Internet SE Anonymizer: Proxy - FireHol malicious url, evasive, pua, worm, network, attack, bad actor, targeting",
          "modified": "2023-11-12T17:01:15.222000",
          "created": "2023-10-13T18:20:24.042000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "communicating",
            "unlocker",
            "legal entities",
            "using ip",
            "amazon aws",
            "apple ios",
            "passcode",
            "attack",
            "verified",
            "cyber criminal",
            "name verdict",
            "falcon sandbox",
            "united",
            "flag",
            "date",
            "name server",
            "markmonitor",
            "contains",
            "external",
            "new relic",
            "logo",
            "av detection",
            "hybrid",
            "general",
            "click",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "proxy",
            "firehol",
            "malware",
            "heur",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "malicious site",
            "malware site",
            "adware",
            "artemis",
            "iframe",
            "cleaner",
            "unsafe",
            "riskware",
            "opencandy",
            "downldr",
            "nircmd",
            "swrort",
            "presenoker",
            "wacatac",
            "phishing",
            "xtrat",
            "crack",
            "tiggre",
            "exploit",
            "agent",
            "filetour",
            "conduit",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "softcnapp",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "xrat",
            "gamehack",
            "webtoolbar",
            "trojanspy",
            "maltiverse",
            "urls",
            "detection list",
            "blacklist https",
            "path",
            "maxage31536000",
            "expiressat",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "pragma",
            "html info",
            "title kedence",
            "official apk",
            "meta tags",
            "apk download",
            "android",
            "google tag",
            "utc google",
            "utc na",
            "phishing site",
            "anonymizer",
            "malicious host",
            "driverpack",
            "ransomware",
            "installcore",
            "suppobox",
            "patcher",
            "generic",
            "dropper",
            "fakealert",
            "quasar rat",
            "applicunwnt",
            "mimikatz",
            "team",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Cyber Criminal",
              "display_name": "Cyber Criminal",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "hostname": 1331,
            "URL": 3839,
            "CVE": 12
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f19f703614354a606c382",
          "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
          "description": "",
          "modified": "2023-11-12T17:01:15.222000",
          "created": "2023-10-30T02:50:31.950000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "communicating",
            "unlocker",
            "legal entities",
            "using ip",
            "amazon aws",
            "apple ios",
            "passcode",
            "attack",
            "verified",
            "cyber criminal",
            "name verdict",
            "falcon sandbox",
            "united",
            "flag",
            "date",
            "name server",
            "markmonitor",
            "contains",
            "external",
            "new relic",
            "logo",
            "av detection",
            "hybrid",
            "general",
            "click",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "proxy",
            "firehol",
            "malware",
            "heur",
            "cisco umbrella",
            "site",
            "safe site",
            "million",
            "alexa top",
            "malicious site",
            "malware site",
            "adware",
            "artemis",
            "iframe",
            "cleaner",
            "unsafe",
            "riskware",
            "opencandy",
            "downldr",
            "nircmd",
            "swrort",
            "presenoker",
            "wacatac",
            "phishing",
            "xtrat",
            "crack",
            "tiggre",
            "exploit",
            "agent",
            "filetour",
            "conduit",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "softcnapp",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "xrat",
            "gamehack",
            "webtoolbar",
            "trojanspy",
            "maltiverse",
            "urls",
            "detection list",
            "blacklist https",
            "path",
            "maxage31536000",
            "expiressat",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "pragma",
            "html info",
            "title kedence",
            "official apk",
            "meta tags",
            "apk download",
            "android",
            "google tag",
            "utc google",
            "utc na",
            "phishing site",
            "anonymizer",
            "malicious host",
            "driverpack",
            "ransomware",
            "installcore",
            "suppobox",
            "patcher",
            "generic",
            "dropper",
            "fakealert",
            "quasar rat",
            "applicunwnt",
            "mimikatz",
            "team",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Verified",
              "display_name": "Verified",
              "target": null
            },
            {
              "id": "Cyber Criminal",
              "display_name": "Cyber Criminal",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65298a6839a49a9aa732bcac",
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 250,
            "FileHash-SHA1": 80,
            "FileHash-SHA256": 2976,
            "domain": 757,
            "hostname": 1331,
            "URL": 3839,
            "CVE": 12
          },
          "indicator_count": 9245,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "889 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Webtoolbar",
            "Maltiverse",
            "Cyber criminal",
            "Trojanspy",
            "Verified",
            "Gamehack"
          ],
          "industries": [],
          "unique_indicators": 29262
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/keyvance-it.de",
    "whois": "http://whois.domaintools.com/keyvance-it.de",
    "domain": "keyvance-it.de",
    "hostname": "plussimo.keyvance-it.de"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "65a20ff8db3854e863dca324",
      "name": "Shared Modules | Hijacker | Masquerading",
      "description": "",
      "modified": "2024-02-12T04:01:56.040000",
      "created": "2024-01-13T04:22:16.961000",
      "tags": [
        "filehashmd5",
        "no expiration",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "hostname",
        "expiration",
        "domain",
        "url https",
        "url http",
        "source",
        "stix",
        "email",
        "email abuse",
        "goreasonlimited",
        "cc no",
        "tompc",
        "sum35",
        "domain xn",
        "searchbox0",
        "domainname0",
        "view",
        "apple",
        "apple id",
        "hijacking",
        "masquerading",
        "exploit",
        "cams",
        "monitoring",
        "loki bot",
        "dns",
        "open ports",
        "malvertizing",
        "malware hosting",
        "apple script",
        "js user",
        "dga",
        "dga domains",
        "malware",
        "multiple_versions",
        "wagersta",
        "decode",
        "system information discovery",
        "decrypt",
        "evasion",
        "defense evasion",
        "emotet",
        "android",
        "ios",
        "wannacry",
        "trojan",
        "worm",
        "cyber threat",
        "benjamin",
        "whois record",
        "ssl certificate",
        "contacted",
        "historical ssl",
        "referrer",
        "contacted urls",
        "execution",
        "whois whois",
        "whois sslcert",
        "and china",
        "drop",
        "uchealth",
        "university of cincinnati health"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2701,
        "FileHash-SHA1": 2296,
        "FileHash-SHA256": 3362,
        "URL": 6191,
        "domain": 2033,
        "hostname": 3097,
        "email": 37,
        "CVE": 2
      },
      "indicator_count": 19719,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "798 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8d167202b93ee502ff8",
      "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
      "description": "",
      "modified": "2023-12-06T17:01:05.291000",
      "created": "2023-12-06T17:01:05.291000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 12,
        "URL": 3839,
        "hostname": 1331,
        "FileHash-SHA256": 2976,
        "domain": 757,
        "FileHash-MD5": 250,
        "FileHash-SHA1": 80
      },
      "indicator_count": 9245,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65298a6839a49a9aa732bcac",
      "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
      "description": "IC3 attached to links, apple , messaging, Skype.\nIC3 CN?\nChina? Unclear. Possibly intercepting  IC3 complaints or linking to FBI to frame targets. Links show attack is Attorney orchestrated. \nSame group of Apple iTune links affected by Java.Trojan.GenericGB, Apple NetWorm Trojan.Buzus, Dropper.Mudrop, GenPack:Trojan.Generic, Worm.Mytob ,Phishing site, Anonymizer , netsky ,worm and other vulnerabilities over time. \u200eSign of the Times \u2013 Album par Dembiak Music \u2013 Apple Music Autonomous Systems: AS714 Apple Inc AS14061 Digital Ocean Inc AS8560 1 1 Internet SE Anonymizer: Proxy - FireHol malicious url, evasive, pua, worm, network, attack, bad actor, targeting",
      "modified": "2023-11-12T17:01:15.222000",
      "created": "2023-10-13T18:20:24.042000",
      "tags": [
        "ssl certificate",
        "historical ssl",
        "referrer",
        "communicating",
        "unlocker",
        "legal entities",
        "using ip",
        "amazon aws",
        "apple ios",
        "passcode",
        "attack",
        "verified",
        "cyber criminal",
        "name verdict",
        "falcon sandbox",
        "united",
        "flag",
        "date",
        "name server",
        "markmonitor",
        "contains",
        "external",
        "new relic",
        "logo",
        "av detection",
        "hybrid",
        "general",
        "click",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "proxy",
        "firehol",
        "malware",
        "heur",
        "cisco umbrella",
        "site",
        "safe site",
        "million",
        "alexa top",
        "malicious site",
        "malware site",
        "adware",
        "artemis",
        "iframe",
        "cleaner",
        "unsafe",
        "riskware",
        "opencandy",
        "downldr",
        "nircmd",
        "swrort",
        "presenoker",
        "wacatac",
        "phishing",
        "xtrat",
        "crack",
        "tiggre",
        "exploit",
        "agent",
        "filetour",
        "conduit",
        "acint",
        "systweak",
        "behav",
        "genkryptik",
        "softcnapp",
        "fusioncore",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "xrat",
        "gamehack",
        "webtoolbar",
        "trojanspy",
        "maltiverse",
        "urls",
        "detection list",
        "blacklist https",
        "path",
        "maxage31536000",
        "expiressat",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "pragma",
        "html info",
        "title kedence",
        "official apk",
        "meta tags",
        "apk download",
        "android",
        "google tag",
        "utc google",
        "utc na",
        "phishing site",
        "anonymizer",
        "malicious host",
        "driverpack",
        "ransomware",
        "installcore",
        "suppobox",
        "patcher",
        "generic",
        "dropper",
        "fakealert",
        "quasar rat",
        "applicunwnt",
        "mimikatz",
        "team",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Verified",
          "display_name": "Verified",
          "target": null
        },
        {
          "id": "Cyber Criminal",
          "display_name": "Cyber Criminal",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 250,
        "FileHash-SHA1": 80,
        "FileHash-SHA256": 2976,
        "domain": 757,
        "hostname": 1331,
        "URL": 3839,
        "CVE": 12
      },
      "indicator_count": 9245,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "889 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f19f703614354a606c382",
      "name": "Apple iTunes| Malicious site | Anonyization | Siphoning | Trojan Downloader",
      "description": "",
      "modified": "2023-11-12T17:01:15.222000",
      "created": "2023-10-30T02:50:31.950000",
      "tags": [
        "ssl certificate",
        "historical ssl",
        "referrer",
        "communicating",
        "unlocker",
        "legal entities",
        "using ip",
        "amazon aws",
        "apple ios",
        "passcode",
        "attack",
        "verified",
        "cyber criminal",
        "name verdict",
        "falcon sandbox",
        "united",
        "flag",
        "date",
        "name server",
        "markmonitor",
        "contains",
        "external",
        "new relic",
        "logo",
        "av detection",
        "hybrid",
        "general",
        "click",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "proxy",
        "firehol",
        "malware",
        "heur",
        "cisco umbrella",
        "site",
        "safe site",
        "million",
        "alexa top",
        "malicious site",
        "malware site",
        "adware",
        "artemis",
        "iframe",
        "cleaner",
        "unsafe",
        "riskware",
        "opencandy",
        "downldr",
        "nircmd",
        "swrort",
        "presenoker",
        "wacatac",
        "phishing",
        "xtrat",
        "crack",
        "tiggre",
        "exploit",
        "agent",
        "filetour",
        "conduit",
        "acint",
        "systweak",
        "behav",
        "genkryptik",
        "softcnapp",
        "fusioncore",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "xrat",
        "gamehack",
        "webtoolbar",
        "trojanspy",
        "maltiverse",
        "urls",
        "detection list",
        "blacklist https",
        "path",
        "maxage31536000",
        "expiressat",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "pragma",
        "html info",
        "title kedence",
        "official apk",
        "meta tags",
        "apk download",
        "android",
        "google tag",
        "utc google",
        "utc na",
        "phishing site",
        "anonymizer",
        "malicious host",
        "driverpack",
        "ransomware",
        "installcore",
        "suppobox",
        "patcher",
        "generic",
        "dropper",
        "fakealert",
        "quasar rat",
        "applicunwnt",
        "mimikatz",
        "team",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Verified",
          "display_name": "Verified",
          "target": null
        },
        {
          "id": "Cyber Criminal",
          "display_name": "Cyber Criminal",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65298a6839a49a9aa732bcac",
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 250,
        "FileHash-SHA1": 80,
        "FileHash-SHA256": 2976,
        "domain": 757,
        "hostname": 1331,
        "URL": 3839,
        "CVE": 12
      },
      "indicator_count": 9245,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "889 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://plussimo.keyvance-it.de",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://plussimo.keyvance-it.de",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776664948.5821362
}