{
  "type": "URL",
  "indicator": "https://qa.mobilogy.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://qa.mobilogy.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4084202771,
      "indicator": "https://qa.mobilogy.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "686ab98ff0cb9baa4e2b2000",
          "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied  OctoseekPulse)  Attacks SA victims?",
          "description": "",
          "modified": "2025-08-05T21:02:46.419000",
          "created": "2025-07-06T17:59:43.440000",
          "tags": [
            "runtime process",
            "localappdata",
            "size",
            "sha256",
            "sha1",
            "temp",
            "prefetch8",
            "prefetch1",
            "unicode text",
            "type data",
            "hybrid",
            "general",
            "click",
            "strings",
            "contact",
            "mitre",
            "writes a pe file header to disc",
            "show process",
            "date",
            "document file",
            "v2 document",
            "ascii text",
            "malicious",
            "local",
            "path",
            "found",
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "october",
            "resolutions",
            "apple ios",
            "referrer",
            "communicating",
            "execution",
            "june",
            "august",
            "emotet",
            "qakbot",
            "agent tesla",
            "azorult",
            "core",
            "maze",
            "metro",
            "dark",
            "team",
            "critical",
            "copy",
            "awful",
            "ursnif",
            "hacktool",
            "info",
            "qbot",
            "april",
            "njrat",
            "nokoyawa",
            "djvu",
            "flubot",
            "ransomware",
            "bandit stealer",
            "hallrender",
            "spyware",
            "safebae",
            "tsara brashears",
            "westlaw",
            "river.rocks",
            "brian sabey",
            "targeting",
            "dnspionage",
            "united",
            "unknown",
            "search",
            "aaaa",
            "showing",
            "domain",
            "creation date",
            "record value",
            "dnssec",
            "body",
            "passive dns",
            "encrypt",
            "as14061",
            "germany unknown",
            "as397240",
            "gmt server",
            "443 ma2592000",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "urls",
            "files",
            "main",
            "installing",
            "as16276",
            "france unknown",
            "name servers",
            "as8075",
            "servers",
            "next",
            "as63949 linode",
            "as206834 team",
            "canada unknown",
            "status",
            "as61969 team",
            "msie",
            "chrome",
            "ransom",
            "gone",
            "title",
            "head body",
            "malware"
          ],
          "references": [
            "\u2193\u2192Found in: https://house.mo.gov/\u2193",
            "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
            "demo.auth.civicalg.com.sni.cloudflaressl.com",
            "happyrabbit.kr [Apple iOS threat]",
            "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
            "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
            "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
            "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
            "http://nudeteenporn.site"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Nokoyawa Ransomware",
              "display_name": "Nokoyawa Ransomware",
              "target": null
            },
            {
              "id": "Bandit Stealer",
              "display_name": "Bandit Stealer",
              "target": null
            },
            {
              "id": "FluBot",
              "display_name": "FluBot",
              "target": null
            },
            {
              "id": "Agent Tesla",
              "display_name": "Agent Tesla",
              "target": null
            },
            {
              "id": "QBot",
              "display_name": "QBot",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Ursnif",
              "display_name": "Ursnif",
              "target": null
            },
            {
              "id": "AZORult",
              "display_name": "AZORult",
              "target": null
            },
            {
              "id": "Djvu",
              "display_name": "Djvu",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Maze",
              "display_name": "Maze",
              "target": null
            },
            {
              "id": "Dark",
              "display_name": "Dark",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "HallRender",
              "display_name": "HallRender",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1065",
              "name": "Uncommonly Used Port",
              "display_name": "T1065 - Uncommonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65c96df8fe0657d56a206a49",
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 251,
            "FileHash-SHA1": 211,
            "FileHash-SHA256": 3226,
            "domain": 1867,
            "URL": 10030,
            "hostname": 2919,
            "CVE": 7,
            "email": 6
          },
          "indicator_count": 18517,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "256 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "happyrabbit.kr [Apple iOS threat]",
        "demo.auth.civicalg.com.sni.cloudflaressl.com",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://nudeteenporn.site",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "\u2193\u2192Found in: https://house.mo.gov/\u2193"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Flubot",
            "Qakbot",
            "Bandit stealer",
            "Njrat",
            "Ursnif",
            "Azorult",
            "Emotet",
            "Djvu",
            "Qbot",
            "Agent tesla",
            "Maze",
            "Hallrender",
            "Tulach",
            "Dark",
            "Hacktool",
            "Nokoyawa ransomware"
          ],
          "industries": [],
          "unique_indicators": 14227
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/mobilogy.com",
    "whois": "http://whois.domaintools.com/mobilogy.com",
    "domain": "mobilogy.com",
    "hostname": "qa.mobilogy.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "686ab98ff0cb9baa4e2b2000",
      "name": "https://house.mo.gov/ Palantir Technologies HARMFUL (copied  OctoseekPulse)  Attacks SA victims?",
      "description": "",
      "modified": "2025-08-05T21:02:46.419000",
      "created": "2025-07-06T17:59:43.440000",
      "tags": [
        "runtime process",
        "localappdata",
        "size",
        "sha256",
        "sha1",
        "temp",
        "prefetch8",
        "prefetch1",
        "unicode text",
        "type data",
        "hybrid",
        "general",
        "click",
        "strings",
        "contact",
        "mitre",
        "writes a pe file header to disc",
        "show process",
        "date",
        "document file",
        "v2 document",
        "ascii text",
        "malicious",
        "local",
        "path",
        "found",
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "october",
        "resolutions",
        "apple ios",
        "referrer",
        "communicating",
        "execution",
        "june",
        "august",
        "emotet",
        "qakbot",
        "agent tesla",
        "azorult",
        "core",
        "maze",
        "metro",
        "dark",
        "team",
        "critical",
        "copy",
        "awful",
        "ursnif",
        "hacktool",
        "info",
        "qbot",
        "april",
        "njrat",
        "nokoyawa",
        "djvu",
        "flubot",
        "ransomware",
        "bandit stealer",
        "hallrender",
        "spyware",
        "safebae",
        "tsara brashears",
        "westlaw",
        "river.rocks",
        "brian sabey",
        "targeting",
        "dnspionage",
        "united",
        "unknown",
        "search",
        "aaaa",
        "showing",
        "domain",
        "creation date",
        "record value",
        "dnssec",
        "body",
        "passive dns",
        "encrypt",
        "as14061",
        "germany unknown",
        "as397240",
        "gmt server",
        "443 ma2592000",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "urls",
        "files",
        "main",
        "installing",
        "as16276",
        "france unknown",
        "name servers",
        "as8075",
        "servers",
        "next",
        "as63949 linode",
        "as206834 team",
        "canada unknown",
        "status",
        "as61969 team",
        "msie",
        "chrome",
        "ransom",
        "gone",
        "title",
        "head body",
        "malware"
      ],
      "references": [
        "\u2193\u2192Found in: https://house.mo.gov/\u2193",
        "dns.msftncsi.com \u2022 https://dns.msftncsi.com/ \u2022 http://dns.msftncsi.com/",
        "demo.auth.civicalg.com.sni.cloudflaressl.com",
        "happyrabbit.kr [Apple iOS threat]",
        "https://appletoncdn.xyz/l/26422915e0d4f6f88646?sub=5eafeec1af7c0a0001960f44&source=81 \u2022 appletoncdn.xyz",
        "https://tracking.s-unlock.com \u2022 https://ignaciob.com/track/click/v2-318692303 \u2022 adepttracker.com \u2022",
        "https://your-sugar-girls.com/cams/default/adult/5277/index.html?p1=https://bongacams10.com/track?c=621661&subid=1a1d33f51a7179480c6d4aeb40d3a5a1&subid2=16969639",
        "https://click.stecloud.us/campaign/track-email/384458660__3339__6837152__393",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://enter.private.com/track/MTIxODEuNjEuMi41MjEuMTAxMC4wLjAuMC4w/join",
        "http://nudeteenporn.site"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Nokoyawa Ransomware",
          "display_name": "Nokoyawa Ransomware",
          "target": null
        },
        {
          "id": "Bandit Stealer",
          "display_name": "Bandit Stealer",
          "target": null
        },
        {
          "id": "FluBot",
          "display_name": "FluBot",
          "target": null
        },
        {
          "id": "Agent Tesla",
          "display_name": "Agent Tesla",
          "target": null
        },
        {
          "id": "QBot",
          "display_name": "QBot",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Ursnif",
          "display_name": "Ursnif",
          "target": null
        },
        {
          "id": "AZORult",
          "display_name": "AZORult",
          "target": null
        },
        {
          "id": "Djvu",
          "display_name": "Djvu",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Maze",
          "display_name": "Maze",
          "target": null
        },
        {
          "id": "Dark",
          "display_name": "Dark",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "HallRender",
          "display_name": "HallRender",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1065",
          "name": "Uncommonly Used Port",
          "display_name": "T1065 - Uncommonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65c96df8fe0657d56a206a49",
      "export_count": 42,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 251,
        "FileHash-SHA1": 211,
        "FileHash-SHA256": 3226,
        "domain": 1867,
        "URL": 10030,
        "hostname": 2919,
        "CVE": 7,
        "email": 6
      },
      "indicator_count": 18517,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "256 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://qa.mobilogy.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://qa.mobilogy.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631432.425149
}