{
  "type": "URL",
  "indicator": "https://rabbit-staging.bimdata.io",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://rabbit-staging.bimdata.io",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3877086750,
      "indicator": "https://rabbit-staging.bimdata.io",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "688f3a54e7db6a02a7bb25c9",
          "name": "Bank of America - Gafgyt \u2022 TrojanSpy \u2022 South African Service Center (BotNet)",
          "description": "Bank of America South African Service Center BotNet - IoT botnet Gafgyt targets popular routers through RCE vulnerabilities, also known as BASHLITE,  discovered in 2014. It is a Linux-based Mirai related IoT botnet \u2022\n 197.221.2.3 - www.readersareleaders.co.za\twww.readersareleaders.co.za\t[South Africa] AS37153 african network information center\nThis is the call center affecting multiple entities, targeting involved. Affects AllState [Esurance = NGIC? ] BoFa \u2022 T-mobile | MetroBy T\u2022 Mobile \u2022 .\nWhy is Bank of America so sketchy? \n[remote.dekro.co.za]",
          "modified": "2025-09-02T09:02:13.372000",
          "created": "2025-08-03T10:30:43.521000",
          "tags": [
            "dynamicloader",
            "medium",
            "write c",
            "entries",
            "show",
            "search",
            "http traffic",
            "utf8",
            "crlf line",
            "post",
            "trojanspy",
            "copy",
            "powershell",
            "write",
            "delphi",
            "win32",
            "next",
            "graphics",
            "gaz company",
            "turbo exe",
            "company turbo",
            "code",
            "malware",
            "dcom",
            "execution",
            "error",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "development att",
            "defense evasion",
            "south africa",
            "td tr",
            "unknown a",
            "td td",
            "tbody",
            "tr tr",
            "passive dns",
            "ddos",
            "next associated",
            "body",
            "click",
            "unknown soa",
            "unknown cname",
            "location south",
            "africa asn",
            "as37153",
            "pulses none",
            "related tags",
            "none indicator",
            "facts",
            "asn as37153",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "mtb oct",
            "date",
            "united",
            "urls",
            "ov ssl",
            "record value",
            "object",
            "pulse",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "mitre att",
            "show technique",
            "ck matrix",
            "pattern match",
            "null",
            "refresh",
            "span",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 732,
            "domain": 175,
            "hostname": 470,
            "FileHash-SHA256": 346,
            "FileHash-MD5": 141,
            "FileHash-SHA1": 132,
            "email": 1
          },
          "indicator_count": 1997,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "229 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67035385a884405e783f9a7e",
          "name": "Mirai_Botnet_Malware | Healthcare \u00bb savethemalesdenver.com  |",
          "description": "Impacting multiple Colorado medical facilities and educational institutions and patients. || Malware Families\nBackdoor:Linux/Mirai.B\nELF:Mirai-BZ\\ [Trj]\nMirai\nMirai_Botnet_Malware\nTrojan:Win32/Zombie.A\nTrojanClicker:Win32/Frosparf\nTrojanDownloader:Win32/Fosniw\nUnix.Trojan.Mirai-6976991-0\nAd",
          "modified": "2024-11-06T01:02:24.390000",
          "created": "2024-10-07T03:20:37.224000",
          "tags": [
            "canada unknown",
            "redacted for",
            "as25825",
            "all scoreblue",
            "passive dns",
            "ipv4",
            "reverse dns",
            "next",
            "for privacy",
            "cname",
            "united states",
            "nxdomain",
            "ns nxdomain",
            "united",
            "as21928",
            "south korea",
            "as9318 sk",
            "taiwan as3462",
            "as701 verizon",
            "search",
            "maxage apt",
            "minage apt",
            "maxsize apt",
            "malware",
            "as44273 host",
            "creation date",
            "status",
            "showing",
            "record value",
            "certificate",
            "date",
            "urls",
            "overview ip",
            "address",
            "related nids",
            "files location",
            "flag united",
            "domain",
            "files related",
            "intel",
            "ms windows",
            "users",
            "pe32",
            "number",
            "ascii text",
            "crlf line",
            "database",
            "english",
            "tue jun",
            "installer",
            "template",
            "trojan",
            "write",
            "registrar",
            "pulse submit",
            "url analysis",
            "files",
            "msie",
            "chrome",
            "rdds service",
            "record",
            "registrant",
            "admin",
            "tech contact",
            "name servers",
            "email please",
            "moved",
            "trojanproxy",
            "virtool",
            "as1221",
            "aaaa",
            "asnone united",
            "show",
            "filehash",
            "pulse pulses",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "script urls",
            "gmt path",
            "fedora",
            "open ports",
            "nginx http",
            "server",
            "a domains",
            "gmt content",
            "set cookie",
            "gmt etag",
            "accept",
            "expiration date",
            "backdoor",
            "mirai",
            "scan endpoints",
            "all search",
            "otx scoreblue",
            "hostname",
            "verdict",
            "unknown",
            "new pulse",
            "loveland",
            "america asn",
            "Generic36.ABKD",
            "domains",
            "location canada",
            "as32133",
            "files ip",
            "address domain",
            "path max",
            "age86400 set",
            "cookie",
            "type",
            "entries",
            "script domains",
            "downloader",
            "body",
            "servers",
            "emails",
            "gmt max",
            "title",
            "meta",
            "as20940",
            "as16625 akamai",
            "west domains",
            "as4230 claro",
            "copy",
            "sabey",
            "contacted"
          ],
          "references": [
            "savethemalesdenver.com \u00bb https://www.uchealthcares.org | myuchealth.net | 168.200.5.63 | http://ITSupport.uchealth.org",
            "bestofus.org Location: United States of America ASN AS18693 university of colorado hospital",
            "https://floorgoddijn.nl/3798393-dad-dont-my-image-hole-fuck-ass.html",
            "https://hypnosen.fr/4306769-women-xxvideos-matured-village-african-scene-wapdam.html",
            "https://kayleighvandalen.nl/8455490-up-hot-bottoms-xxxonxxx-pics-galleries.html",
            "https://maisonduweb3.fr/6014324-porn-you-ebony-pics-black-xxx.html",
            "https://mtl-plomberie.fr/1210582-sperm-release-can-pictures-that-naija.html",
            "https://mtl-plomberie.fr/2536532-\u1200\u1260\u123b-video-xxx.html",
            "FileHash-SHA256 cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4",
            "Yara Detections: Mirai_Botnet_Malware Alerts: dead_host network_icmp nolookup_communication",
            "Domains Contacted: ntp.ubuntu.com",
            "IP\u2019s Contacted:  1.0.128.143  1.10.54.226  1.107.217.150  1.112.34.224  1.114.165.87  1.116.76.208  1.118.37.88  1.121.139.226  1.122.96.75 1.114.207.168",
            "device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com",
            "Trojan:Win32/Zombie.A FileHash-SHA256  ff43920cf098063475b4c62cd63e550fb783e3be1cf7458688b5c1d2d94c6830",
            "Yara Detections: Nrv2x ,  upx_3 ,  UPX_OEP_place ,  UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser ,",
            "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX",
            "cpe-1-159-170-17.wb05.wa.asp.telstra.net",
            "ELF:Mirai-BZ\\ [Trj] \u00bb device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com | 1.159.170.17 | Perth,  Australia ASN AS1221 telstra corporation",
            "ELF:Mirai-BZ\\ [Trj]  cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4 | Australia ASN AS1221 telstra corporation",
            "Backdoor:Linux/Mirai.B FileHash-SHA1 5df4c3322a68750c6b0c931e8ebebaa60c0a0555",
            "Yara Detections: Mirai_Botnet_Malware ,  MAL_ELF_LNX_Mirai_Oct10_2 ,  SUSP_XORed_Mozilla ,  is__elf",
            "198.49.6.6 \u00bb Loveland,  United States of America ASN AS25825 poudre valley health care inc."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Japan",
            "Taiwan",
            "Philippines",
            "India",
            "Italy",
            "Germany",
            "Netherlands"
          ],
          "malware_families": [
            {
              "id": "ELF:Mirai-BZ\\ [Trj]",
              "display_name": "ELF:Mirai-BZ\\ [Trj]",
              "target": null
            },
            {
              "id": "Mirai_Botnet_Malware",
              "display_name": "Mirai_Botnet_Malware",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zombie.A",
              "display_name": "Trojan:Win32/Zombie.A",
              "target": "/malware/Trojan:Win32/Zombie.A"
            },
            {
              "id": "Unix.Trojan.Mirai-6976991-0",
              "display_name": "Unix.Trojan.Mirai-6976991-0",
              "target": null
            },
            {
              "id": "Mirai",
              "display_name": "Mirai",
              "target": null
            },
            {
              "id": "Backdoor:Linux/Mirai.B",
              "display_name": "Backdoor:Linux/Mirai.B",
              "target": "/malware/Backdoor:Linux/Mirai.B"
            },
            {
              "id": "TrojanDownloader:Win32/Fosniw",
              "display_name": "TrojanDownloader:Win32/Fosniw",
              "target": "/malware/TrojanDownloader:Win32/Fosniw"
            },
            {
              "id": "TrojanClicker:Win32/Frosparf",
              "display_name": "TrojanClicker:Win32/Frosparf",
              "target": "/malware/TrojanClicker:Win32/Frosparf"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            }
          ],
          "industries": [
            "Legal",
            "Healthcare",
            "Education"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1230,
            "email": 16,
            "hostname": 1560,
            "URL": 3400,
            "FileHash-SHA256": 1064,
            "FileHash-MD5": 544,
            "FileHash-SHA1": 496,
            "CVE": 1
          },
          "indicator_count": 8311,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 233,
          "modified_text": "529 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "663d2869e0f3a42bbddc42ff",
          "name": "UPX executable packer.",
          "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
          "modified": "2024-10-14T00:01:17.069000",
          "created": "2024-05-09T19:47:53.786000",
          "tags": [
            "cioch adrian",
            "centrum usug",
            "sieciowych",
            "elf binary",
            "upx compression",
            "roth",
            "nextron",
            "info",
            "javascript",
            "html",
            "office open",
            "xml document",
            "network capture",
            "win32 exe",
            "xml pakietu",
            "pdf zestawy",
            "przechwytywanie",
            "office",
            "filehashsha1",
            "url https",
            "cve cve20201070",
            "cve cve20203153",
            "cve cve20201048",
            "cve cve20211732",
            "cve20201048 apr",
            "filehashmd5",
            "cve cve20010901",
            "cve cve20021841",
            "cve20153202 apr",
            "cve cve20160728",
            "cve cve20161807",
            "cve cve20175123",
            "cve20185407 apr",
            "cve cve20054605",
            "cve cve20060745",
            "cve cve20070452",
            "cve cve20070453",
            "cve cve20070454",
            "cve cve20071355",
            "cve cve20071358",
            "cve cve20071871",
            "cve20149614 apr",
            "cve cve20151503",
            "cve cve20152080",
            "cve cve20157377",
            "cve cve20170131",
            "cve20200796 may",
            "cve cve20113403"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6861,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 5771,
            "domain": 3139,
            "URL": 14525,
            "FileHash-SHA1": 2610,
            "IPv4": 108,
            "CIDR": 40,
            "FileHash-SHA256": 10705,
            "FileHash-MD5": 3373,
            "YARA": 2,
            "CVE": 148,
            "Mutex": 7,
            "FilePath": 3,
            "SSLCertFingerprint": 3,
            "email": 23,
            "JA3": 1,
            "IPv6": 2
          },
          "indicator_count": 40460,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "552 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6681f6f2cd37f508d362c2db",
          "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
          "description": "",
          "modified": "2024-07-01T00:23:14.084000",
          "created": "2024-07-01T00:23:14.084000",
          "tags": [
            "united",
            "passive dns",
            "as14449",
            "moved",
            "urls",
            "authority",
            "body",
            "object",
            "certificate",
            "scan endpoints",
            "unknown",
            "date",
            "as11377",
            "as16552 tiggee",
            "as174 cogent",
            "ireland unknown",
            "cname",
            "as11404 wave",
            "all scoreblue",
            "pulse pulses",
            "entries",
            "ipv4",
            "pulse submit",
            "url analysis",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "medium",
            "windows",
            "cmd c",
            "default",
            "document file",
            "v2 document",
            "write",
            "copy",
            "name verdict",
            "falcon sandbox",
            "sha1",
            "sha256",
            "misc attack",
            "mitre att",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "hybrid",
            "starfield",
            "click",
            "strings",
            "core",
            "contact",
            "as396982 google",
            "historical ssl",
            "referrer",
            "co20230203",
            "malware",
            "discord",
            "credential",
            "lunar client",
            "trendmicro av",
            "neural netw",
            "upscayl",
            "steam game",
            "server",
            "domain status",
            "registrar abuse",
            "google",
            "community",
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "664fceb9e0acfc0baee851c2",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 75,
            "URL": 3584,
            "domain": 836,
            "hostname": 1749,
            "FileHash-SHA256": 726,
            "FileHash-MD5": 88,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 7068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "657 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "664fceb9e0acfc0baee851c2",
          "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
          "description": "Tags, findings of this report is auto generated by Level Blue OTX.AlienVault.\nPer my research: \nMalicious Score: 10/10\nAlerts: Alerts\nransomware_file_modifications, script_created_process, stealth_network, infostealer_cookies, suspicious_command_tools,\ndynamic_function_loading, reads_self,\nstealth_window, cmdline_http_link, uses_windows_utilities, antidebug_setunhandledexceptionfilter, cmdline_terminate, stealth_timeout,\n\nAffected Device: Apples iOS Ipad, Update 17.5.1\npegasystems.voicestorm.com -Cisco Umbrella {permanently moved as of 5.23.2024} found in Apple link - http://apps.apple.com/app/, nsis, downloaders,injection, data local, remotewd devices, tracking,",
          "modified": "2024-06-22T23:05:37.577000",
          "created": "2024-05-23T23:18:17.563000",
          "tags": [
            "united",
            "passive dns",
            "as14449",
            "moved",
            "urls",
            "authority",
            "body",
            "object",
            "certificate",
            "scan endpoints",
            "unknown",
            "date",
            "as11377",
            "as16552 tiggee",
            "as174 cogent",
            "ireland unknown",
            "cname",
            "as11404 wave",
            "all scoreblue",
            "pulse pulses",
            "entries",
            "ipv4",
            "pulse submit",
            "url analysis",
            "dynamicloader",
            "port",
            "destination",
            "high",
            "medium",
            "windows",
            "cmd c",
            "default",
            "document file",
            "v2 document",
            "write",
            "copy",
            "name verdict",
            "falcon sandbox",
            "sha1",
            "sha256",
            "misc attack",
            "mitre att",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "ascii text",
            "hybrid",
            "starfield",
            "click",
            "strings",
            "core",
            "contact",
            "as396982 google",
            "historical ssl",
            "referrer",
            "co20230203",
            "malware",
            "discord",
            "credential",
            "lunar client",
            "trendmicro av",
            "neural netw",
            "upscayl",
            "steam game",
            "server",
            "domain status",
            "registrar abuse",
            "google",
            "community",
            "record type",
            "ttl value",
            "data",
            "v3 serial",
            "number"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 75,
            "URL": 3584,
            "domain": 836,
            "hostname": 1749,
            "FileHash-SHA256": 726,
            "FileHash-MD5": 88,
            "SSLCertFingerprint": 9,
            "email": 1
          },
          "indicator_count": 7068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "665 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "ELF:Mirai-BZ\\ [Trj]  cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4 | Australia ASN AS1221 telstra corporation",
        "https://kayleighvandalen.nl/8455490-up-hot-bottoms-xxxonxxx-pics-galleries.html",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX",
        "198.49.6.6 \u00bb Loveland,  United States of America ASN AS25825 poudre valley health care inc.",
        "Backdoor:Linux/Mirai.B FileHash-SHA1 5df4c3322a68750c6b0c931e8ebebaa60c0a0555",
        "device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com",
        "https://hypnosen.fr/4306769-women-xxvideos-matured-village-african-scene-wapdam.html",
        "bestofus.org Location: United States of America ASN AS18693 university of colorado hospital",
        "https://floorgoddijn.nl/3798393-dad-dont-my-image-hole-fuck-ass.html",
        "ELF:Mirai-BZ\\ [Trj] \u00bb device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com | 1.159.170.17 | Perth,  Australia ASN AS1221 telstra corporation",
        "Yara Detections: Mirai_Botnet_Malware Alerts: dead_host network_icmp nolookup_communication",
        "IP\u2019s Contacted:  1.0.128.143  1.10.54.226  1.107.217.150  1.112.34.224  1.114.165.87  1.116.76.208  1.118.37.88  1.121.139.226  1.122.96.75 1.114.207.168",
        "https://maisonduweb3.fr/6014324-porn-you-ebony-pics-black-xxx.html",
        "Yara Detections: Nrv2x ,  upx_3 ,  UPX_OEP_place ,  UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser ,",
        "Trojan:Win32/Zombie.A FileHash-SHA256  ff43920cf098063475b4c62cd63e550fb783e3be1cf7458688b5c1d2d94c6830",
        "savethemalesdenver.com \u00bb https://www.uchealthcares.org | myuchealth.net | 168.200.5.63 | http://ITSupport.uchealth.org",
        "https://mtl-plomberie.fr/2536532-\u1200\u1260\u123b-video-xxx.html",
        "cpe-1-159-170-17.wb05.wa.asp.telstra.net",
        "Yara Detections: Mirai_Botnet_Malware ,  MAL_ELF_LNX_Mirai_Oct10_2 ,  SUSP_XORed_Mozilla ,  is__elf",
        "FileHash-SHA256 cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4",
        "Domains Contacted: ntp.ubuntu.com",
        "https://mtl-plomberie.fr/1210582-sperm-release-can-pictures-that-naija.html"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Unix.trojan.mirai-6976991-0",
            "Trojandownloader:win32/fosniw",
            "Trojanclicker:win32/frosparf",
            "Trojan:win32/zombie.a",
            "Mirai",
            "Backdoor:linux/mirai.b",
            "Elf:mirai-bz\\ [trj]",
            "Mirai_botnet_malware"
          ],
          "industries": [
            "Healthcare",
            "Legal",
            "Education"
          ],
          "unique_indicators": 47442
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/bimdata.io",
    "whois": "http://whois.domaintools.com/bimdata.io",
    "domain": "bimdata.io",
    "hostname": "rabbit-staging.bimdata.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "688f3a54e7db6a02a7bb25c9",
      "name": "Bank of America - Gafgyt \u2022 TrojanSpy \u2022 South African Service Center (BotNet)",
      "description": "Bank of America South African Service Center BotNet - IoT botnet Gafgyt targets popular routers through RCE vulnerabilities, also known as BASHLITE,  discovered in 2014. It is a Linux-based Mirai related IoT botnet \u2022\n 197.221.2.3 - www.readersareleaders.co.za\twww.readersareleaders.co.za\t[South Africa] AS37153 african network information center\nThis is the call center affecting multiple entities, targeting involved. Affects AllState [Esurance = NGIC? ] BoFa \u2022 T-mobile | MetroBy T\u2022 Mobile \u2022 .\nWhy is Bank of America so sketchy? \n[remote.dekro.co.za]",
      "modified": "2025-09-02T09:02:13.372000",
      "created": "2025-08-03T10:30:43.521000",
      "tags": [
        "dynamicloader",
        "medium",
        "write c",
        "entries",
        "show",
        "search",
        "http traffic",
        "utf8",
        "crlf line",
        "post",
        "trojanspy",
        "copy",
        "powershell",
        "write",
        "delphi",
        "win32",
        "next",
        "graphics",
        "gaz company",
        "turbo exe",
        "company turbo",
        "code",
        "malware",
        "dcom",
        "execution",
        "error",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "development att",
        "defense evasion",
        "south africa",
        "td tr",
        "unknown a",
        "td td",
        "tbody",
        "tr tr",
        "passive dns",
        "ddos",
        "next associated",
        "body",
        "click",
        "unknown soa",
        "unknown cname",
        "location south",
        "africa asn",
        "as37153",
        "pulses none",
        "related tags",
        "none indicator",
        "facts",
        "asn as37153",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "mtb oct",
        "date",
        "united",
        "urls",
        "ov ssl",
        "record value",
        "object",
        "pulse",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "mitre att",
        "show technique",
        "ck matrix",
        "pattern match",
        "null",
        "refresh",
        "span",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "strings",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 732,
        "domain": 175,
        "hostname": 470,
        "FileHash-SHA256": 346,
        "FileHash-MD5": 141,
        "FileHash-SHA1": 132,
        "email": 1
      },
      "indicator_count": 1997,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "229 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67035385a884405e783f9a7e",
      "name": "Mirai_Botnet_Malware | Healthcare \u00bb savethemalesdenver.com  |",
      "description": "Impacting multiple Colorado medical facilities and educational institutions and patients. || Malware Families\nBackdoor:Linux/Mirai.B\nELF:Mirai-BZ\\ [Trj]\nMirai\nMirai_Botnet_Malware\nTrojan:Win32/Zombie.A\nTrojanClicker:Win32/Frosparf\nTrojanDownloader:Win32/Fosniw\nUnix.Trojan.Mirai-6976991-0\nAd",
      "modified": "2024-11-06T01:02:24.390000",
      "created": "2024-10-07T03:20:37.224000",
      "tags": [
        "canada unknown",
        "redacted for",
        "as25825",
        "all scoreblue",
        "passive dns",
        "ipv4",
        "reverse dns",
        "next",
        "for privacy",
        "cname",
        "united states",
        "nxdomain",
        "ns nxdomain",
        "united",
        "as21928",
        "south korea",
        "as9318 sk",
        "taiwan as3462",
        "as701 verizon",
        "search",
        "maxage apt",
        "minage apt",
        "maxsize apt",
        "malware",
        "as44273 host",
        "creation date",
        "status",
        "showing",
        "record value",
        "certificate",
        "date",
        "urls",
        "overview ip",
        "address",
        "related nids",
        "files location",
        "flag united",
        "domain",
        "files related",
        "intel",
        "ms windows",
        "users",
        "pe32",
        "number",
        "ascii text",
        "crlf line",
        "database",
        "english",
        "tue jun",
        "installer",
        "template",
        "trojan",
        "write",
        "registrar",
        "pulse submit",
        "url analysis",
        "files",
        "msie",
        "chrome",
        "rdds service",
        "record",
        "registrant",
        "admin",
        "tech contact",
        "name servers",
        "email please",
        "moved",
        "trojanproxy",
        "virtool",
        "as1221",
        "aaaa",
        "asnone united",
        "show",
        "filehash",
        "pulse pulses",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "script urls",
        "gmt path",
        "fedora",
        "open ports",
        "nginx http",
        "server",
        "a domains",
        "gmt content",
        "set cookie",
        "gmt etag",
        "accept",
        "expiration date",
        "backdoor",
        "mirai",
        "scan endpoints",
        "all search",
        "otx scoreblue",
        "hostname",
        "verdict",
        "unknown",
        "new pulse",
        "loveland",
        "america asn",
        "Generic36.ABKD",
        "domains",
        "location canada",
        "as32133",
        "files ip",
        "address domain",
        "path max",
        "age86400 set",
        "cookie",
        "type",
        "entries",
        "script domains",
        "downloader",
        "body",
        "servers",
        "emails",
        "gmt max",
        "title",
        "meta",
        "as20940",
        "as16625 akamai",
        "west domains",
        "as4230 claro",
        "copy",
        "sabey",
        "contacted"
      ],
      "references": [
        "savethemalesdenver.com \u00bb https://www.uchealthcares.org | myuchealth.net | 168.200.5.63 | http://ITSupport.uchealth.org",
        "bestofus.org Location: United States of America ASN AS18693 university of colorado hospital",
        "https://floorgoddijn.nl/3798393-dad-dont-my-image-hole-fuck-ass.html",
        "https://hypnosen.fr/4306769-women-xxvideos-matured-village-african-scene-wapdam.html",
        "https://kayleighvandalen.nl/8455490-up-hot-bottoms-xxxonxxx-pics-galleries.html",
        "https://maisonduweb3.fr/6014324-porn-you-ebony-pics-black-xxx.html",
        "https://mtl-plomberie.fr/1210582-sperm-release-can-pictures-that-naija.html",
        "https://mtl-plomberie.fr/2536532-\u1200\u1260\u123b-video-xxx.html",
        "FileHash-SHA256 cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4",
        "Yara Detections: Mirai_Botnet_Malware Alerts: dead_host network_icmp nolookup_communication",
        "Domains Contacted: ntp.ubuntu.com",
        "IP\u2019s Contacted:  1.0.128.143  1.10.54.226  1.107.217.150  1.112.34.224  1.114.165.87  1.116.76.208  1.118.37.88  1.121.139.226  1.122.96.75 1.114.207.168",
        "device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com",
        "Trojan:Win32/Zombie.A FileHash-SHA256  ff43920cf098063475b4c62cd63e550fb783e3be1cf7458688b5c1d2d94c6830",
        "Yara Detections: Nrv2x ,  upx_3 ,  UPX_OEP_place ,  UPX290LZMAMarkusOberhumerLaszloMolnarJohnReiser ,",
        "Yara Detections: UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser ,  UPXv20MarkusLaszloReiser ,  UPX",
        "cpe-1-159-170-17.wb05.wa.asp.telstra.net",
        "ELF:Mirai-BZ\\ [Trj] \u00bb device-290db215-637a-441f-b5f4-81bf8bd75ae5.remotewd.com | 1.159.170.17 | Perth,  Australia ASN AS1221 telstra corporation",
        "ELF:Mirai-BZ\\ [Trj]  cc0f195fe54b9981b1ea3815e44b85a0fb3571be732bd5b4034f57690436f4c4 | Australia ASN AS1221 telstra corporation",
        "Backdoor:Linux/Mirai.B FileHash-SHA1 5df4c3322a68750c6b0c931e8ebebaa60c0a0555",
        "Yara Detections: Mirai_Botnet_Malware ,  MAL_ELF_LNX_Mirai_Oct10_2 ,  SUSP_XORed_Mozilla ,  is__elf",
        "198.49.6.6 \u00bb Loveland,  United States of America ASN AS25825 poudre valley health care inc."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Japan",
        "Taiwan",
        "Philippines",
        "India",
        "Italy",
        "Germany",
        "Netherlands"
      ],
      "malware_families": [
        {
          "id": "ELF:Mirai-BZ\\ [Trj]",
          "display_name": "ELF:Mirai-BZ\\ [Trj]",
          "target": null
        },
        {
          "id": "Mirai_Botnet_Malware",
          "display_name": "Mirai_Botnet_Malware",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zombie.A",
          "display_name": "Trojan:Win32/Zombie.A",
          "target": "/malware/Trojan:Win32/Zombie.A"
        },
        {
          "id": "Unix.Trojan.Mirai-6976991-0",
          "display_name": "Unix.Trojan.Mirai-6976991-0",
          "target": null
        },
        {
          "id": "Mirai",
          "display_name": "Mirai",
          "target": null
        },
        {
          "id": "Backdoor:Linux/Mirai.B",
          "display_name": "Backdoor:Linux/Mirai.B",
          "target": "/malware/Backdoor:Linux/Mirai.B"
        },
        {
          "id": "TrojanDownloader:Win32/Fosniw",
          "display_name": "TrojanDownloader:Win32/Fosniw",
          "target": "/malware/TrojanDownloader:Win32/Fosniw"
        },
        {
          "id": "TrojanClicker:Win32/Frosparf",
          "display_name": "TrojanClicker:Win32/Frosparf",
          "target": "/malware/TrojanClicker:Win32/Frosparf"
        }
      ],
      "attack_ids": [
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        }
      ],
      "industries": [
        "Legal",
        "Healthcare",
        "Education"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1230,
        "email": 16,
        "hostname": 1560,
        "URL": 3400,
        "FileHash-SHA256": 1064,
        "FileHash-MD5": 544,
        "FileHash-SHA1": 496,
        "CVE": 1
      },
      "indicator_count": 8311,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 233,
      "modified_text": "529 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "663d2869e0f3a42bbddc42ff",
      "name": "UPX executable packer.",
      "description": "A new rule has been introduced  a \"suspicious\" ELF binary that is packed with the UPX executable packer.\nSuggested ATT&CK IDs: rule SUSP_ELF_LNX_UPX_Compressed_File { meta: description = \"Detects a suspicious ELF binary with UPX compression\" author = \"Florian Roth (Nextron Systems)\" reference = \"Internal Research\" date = \"2018-12-12\" score = 40 hash1 = \"038ff8b2fef16f8ee9d70e6c219c5f380afe1a21761791e8cbda21fa4d09fdb4\" id = \"078937de-59b3-538e-a5c3-57f4e6050212\" strings: $s1 = \"PROT_EXEC|PROT_WRITE failed.\" fullword ascii $s2 = \"$Id: UPX\" fullword ascii $s3 = \"$Info: This file is packed with the UPX executable packer\" ascii $fp1 = \"check your UCL installation !\"",
      "modified": "2024-10-14T00:01:17.069000",
      "created": "2024-05-09T19:47:53.786000",
      "tags": [
        "cioch adrian",
        "centrum usug",
        "sieciowych",
        "elf binary",
        "upx compression",
        "roth",
        "nextron",
        "info",
        "javascript",
        "html",
        "office open",
        "xml document",
        "network capture",
        "win32 exe",
        "xml pakietu",
        "pdf zestawy",
        "przechwytywanie",
        "office",
        "filehashsha1",
        "url https",
        "cve cve20201070",
        "cve cve20203153",
        "cve cve20201048",
        "cve cve20211732",
        "cve20201048 apr",
        "filehashmd5",
        "cve cve20010901",
        "cve cve20021841",
        "cve20153202 apr",
        "cve cve20160728",
        "cve cve20161807",
        "cve cve20175123",
        "cve20185407 apr",
        "cve cve20054605",
        "cve cve20060745",
        "cve cve20070452",
        "cve cve20070453",
        "cve cve20070454",
        "cve cve20071355",
        "cve cve20071358",
        "cve cve20071871",
        "cve20149614 apr",
        "cve cve20151503",
        "cve cve20152080",
        "cve cve20157377",
        "cve cve20170131",
        "cve20200796 may",
        "cve cve20113403"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6861,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 5771,
        "domain": 3139,
        "URL": 14525,
        "FileHash-SHA1": 2610,
        "IPv4": 108,
        "CIDR": 40,
        "FileHash-SHA256": 10705,
        "FileHash-MD5": 3373,
        "YARA": 2,
        "CVE": 148,
        "Mutex": 7,
        "FilePath": 3,
        "SSLCertFingerprint": 3,
        "email": 23,
        "JA3": 1,
        "IPv6": 2
      },
      "indicator_count": 40460,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "552 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6681f6f2cd37f508d362c2db",
      "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
      "description": "",
      "modified": "2024-07-01T00:23:14.084000",
      "created": "2024-07-01T00:23:14.084000",
      "tags": [
        "united",
        "passive dns",
        "as14449",
        "moved",
        "urls",
        "authority",
        "body",
        "object",
        "certificate",
        "scan endpoints",
        "unknown",
        "date",
        "as11377",
        "as16552 tiggee",
        "as174 cogent",
        "ireland unknown",
        "cname",
        "as11404 wave",
        "all scoreblue",
        "pulse pulses",
        "entries",
        "ipv4",
        "pulse submit",
        "url analysis",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "medium",
        "windows",
        "cmd c",
        "default",
        "document file",
        "v2 document",
        "write",
        "copy",
        "name verdict",
        "falcon sandbox",
        "sha1",
        "sha256",
        "misc attack",
        "mitre att",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "ascii text",
        "hybrid",
        "starfield",
        "click",
        "strings",
        "core",
        "contact",
        "as396982 google",
        "historical ssl",
        "referrer",
        "co20230203",
        "malware",
        "discord",
        "credential",
        "lunar client",
        "trendmicro av",
        "neural netw",
        "upscayl",
        "steam game",
        "server",
        "domain status",
        "registrar abuse",
        "google",
        "community",
        "record type",
        "ttl value",
        "data",
        "v3 serial",
        "number"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "664fceb9e0acfc0baee851c2",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 75,
        "URL": 3584,
        "domain": 836,
        "hostname": 1749,
        "FileHash-SHA256": 726,
        "FileHash-MD5": 88,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 7068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "657 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "664fceb9e0acfc0baee851c2",
      "name": "PegaSystems | Apple iOS iPad | Malicious | Tracking",
      "description": "Tags, findings of this report is auto generated by Level Blue OTX.AlienVault.\nPer my research: \nMalicious Score: 10/10\nAlerts: Alerts\nransomware_file_modifications, script_created_process, stealth_network, infostealer_cookies, suspicious_command_tools,\ndynamic_function_loading, reads_self,\nstealth_window, cmdline_http_link, uses_windows_utilities, antidebug_setunhandledexceptionfilter, cmdline_terminate, stealth_timeout,\n\nAffected Device: Apples iOS Ipad, Update 17.5.1\npegasystems.voicestorm.com -Cisco Umbrella {permanently moved as of 5.23.2024} found in Apple link - http://apps.apple.com/app/, nsis, downloaders,injection, data local, remotewd devices, tracking,",
      "modified": "2024-06-22T23:05:37.577000",
      "created": "2024-05-23T23:18:17.563000",
      "tags": [
        "united",
        "passive dns",
        "as14449",
        "moved",
        "urls",
        "authority",
        "body",
        "object",
        "certificate",
        "scan endpoints",
        "unknown",
        "date",
        "as11377",
        "as16552 tiggee",
        "as174 cogent",
        "ireland unknown",
        "cname",
        "as11404 wave",
        "all scoreblue",
        "pulse pulses",
        "entries",
        "ipv4",
        "pulse submit",
        "url analysis",
        "dynamicloader",
        "port",
        "destination",
        "high",
        "medium",
        "windows",
        "cmd c",
        "default",
        "document file",
        "v2 document",
        "write",
        "copy",
        "name verdict",
        "falcon sandbox",
        "sha1",
        "sha256",
        "misc attack",
        "mitre att",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "ascii text",
        "hybrid",
        "starfield",
        "click",
        "strings",
        "core",
        "contact",
        "as396982 google",
        "historical ssl",
        "referrer",
        "co20230203",
        "malware",
        "discord",
        "credential",
        "lunar client",
        "trendmicro av",
        "neural netw",
        "upscayl",
        "steam game",
        "server",
        "domain status",
        "registrar abuse",
        "google",
        "community",
        "record type",
        "ttl value",
        "data",
        "v3 serial",
        "number"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 75,
        "URL": 3584,
        "domain": 836,
        "hostname": 1749,
        "FileHash-SHA256": 726,
        "FileHash-MD5": 88,
        "SSLCertFingerprint": 9,
        "email": 1
      },
      "indicator_count": 7068,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "665 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://rabbit-staging.bimdata.io",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://rabbit-staging.bimdata.io",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776627777.5959036
}