{
  "type": "URL",
  "indicator": "https://rdap.arin.net/registry/ip/3.168.0.0",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://rdap.arin.net/registry/ip/3.168.0.0",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "akamai",
        "message": "Akamai rank: #6937",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain arin.net",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain arin.net",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4074612876,
      "indicator": "https://rdap.arin.net/registry/ip/3.168.0.0",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69f066fc4532f3cdb1c4496c",
          "name": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer",
          "description": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer.\nArin has assigned client who does not hold an aws account a server that is unsigned and expired (potentially) leaving amazon vulnerable. Rec: watch ai \"facts\" \"do you want to know\" and alexa skills for potential  exploitation due to degrading systems which are not a company reflection rather an epic IP server and certificate failure worldwide, mostly United though. Attached are known and public sourcee APK Base IOCs.",
          "modified": "2026-05-29T00:06:38.152000",
          "created": "2026-04-28T07:51:24.539000",
          "tags": [
            "date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "amazon",
            "net3128001",
            "net3168001"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 521,
            "FileHash-SHA1": 400,
            "FileHash-SHA256": 2258,
            "domain": 128,
            "hostname": 221,
            "CIDR": 3,
            "URL": 266
          },
          "indicator_count": 3797,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "2 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69f066fdb68cb229059bbba0",
          "name": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer",
          "description": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer.\nArin has assigned client who does not hold an aws account a server that is unsigned and expired (potentially) leaving amazon vulnerable. Rec: watch ai \"facts\" \"do you want to know\" and alexa skills for potential  exploitation due to degrading systems which are not a company reflection rather an epic IP server and certificate failure worldwide, mostly United though. Attached are known and public sourcee APK Base IOCs.",
          "modified": "2026-05-29T00:06:38.152000",
          "created": "2026-04-28T07:51:25.005000",
          "tags": [
            "date",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "amazon",
            "net3128001",
            "net3168001"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 10,
            "FileHash-SHA1": 10,
            "FileHash-SHA256": 430,
            "domain": 4,
            "hostname": 49,
            "CIDR": 3,
            "URL": 11
          },
          "indicator_count": 517,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 67,
          "modified_text": "2 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687479e7b4cd29304527a9b6",
          "name": "IDK OTX - LevelBlue - Open Threat Exchange",
          "description": "Something\u2019s, someone is successfully hacking all our accounts on OTX. IS this a subsidiary of AT&T ? What is this?",
          "modified": "2025-08-13T03:00:55.577000",
          "created": "2025-07-14T03:30:47.687000",
          "tags": [
            "google tag",
            "utc gtmkvjvztk",
            "connection",
            "gmt date",
            "gmt etag",
            "referrerpolicy",
            "xcache error",
            "cloudfront",
            "utc google",
            "tag manager",
            "gtmkvjvztk",
            "utc gcfezl5ynvb",
            "utc na",
            "utc linkedin",
            "insight tag",
            "learn",
            "open threat",
            "exchange meta",
            "alienvault",
            "levelblue",
            "exchange og",
            "levelblue open",
            "threat exchange",
            "trackers",
            "amazon",
            "net3128001",
            "net3168001",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "extraction",
            "data upload",
            "type",
            "please sub",
            "include",
            "review data",
            "exclude",
            "sugges",
            "enter source",
            "url or",
            "texurag",
            "drop",
            "oiprop",
            "enter sourue",
            "url uk",
            "tenkau",
            "drop or",
            "drowol type",
            "extr please",
            "included iocs",
            "sc tenn",
            "drow type",
            "data",
            "failed",
            "extre data",
            "please",
            "tima",
            "pulse",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "mitre att",
            "ascii text",
            "pattern match",
            "ck id",
            "show technique",
            "hybrid",
            "date",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "se extraction",
            "enter sc",
            "oidrop",
            "extract",
            "review io",
            "excluded ous",
            "u suggested",
            "stop data",
            "extraction fa",
            "enter sou",
            "se source",
            "iocs",
            "manually add",
            "indicator",
            "extra",
            "extra data",
            "review los",
            "exclude data",
            "suggestealous u"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 132,
            "FileHash-SHA256": 751,
            "hostname": 614,
            "URL": 48,
            "CIDR": 3,
            "domain": 36,
            "FileHash-SHA1": 127
          },
          "indicator_count": 1711,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "291 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6845e54bb82667ed18988fe5",
          "name": "Amazon -CF | Malicious autonomous system",
          "description": "Handle: AMAZON-4 Network Name: AMAZON-CF\n#DWactivity |\nWHO IS: \nAutonomous System Numbers\nAMAZON-AS\tAS7224 (AS7224)\nLABSHUB-NETWORKING\tAS10291 (AS10291)\nAMAZON-02\tAS16509 (AS16509)\nAWS-01\tAS19047 (AS19047)\nPRIME-TESTING\tAS63088 (AS63088)\n#malicious #rat #infection #auotonomous #virus #network #dns #intrusion #darkweb\n\n*issue with this great tool or possibly my network. Several IoC\u2019s deleted, I went back to retrieve IoC\u2019s from VT they were deleted and I had to do it all\nOver but conditions had changed.\nStill unable to annotate.",
          "modified": "2025-07-08T19:04:31.649000",
          "created": "2025-06-08T19:32:27.529000",
          "tags": [
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "ascii text",
            "pattern match",
            "mitre att",
            "ck id",
            "show technique",
            "null",
            "refresh",
            "body",
            "span",
            "june",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "net3128001",
            "net3168001",
            "amazon",
            "technology",
            "zenbox",
            "domain",
            "r2dbox",
            "virustotal",
            "technology xn",
            "united",
            "unknown aaaa",
            "search",
            "emails",
            "servers",
            "moved",
            "registrar",
            "creation date",
            "name servers",
            "present may",
            "entries",
            "ip address",
            "present feb",
            "present jan",
            "aaaa",
            "status",
            "passive dns",
            "urls",
            "server",
            "asn16509",
            "amazon02",
            "general full",
            "url http",
            "reverse dns",
            "resource",
            "resource path",
            "size",
            "cloudfront",
            "request id",
            "expiration date",
            "record value",
            "name domain",
            "org microsoft",
            "microsoft way",
            "hostname add",
            "pulse submit",
            "pulse indicator",
            "url analysis",
            "amazon ec2",
            "abuse",
            "aws rpki",
            "management poc",
            "ip routing",
            "report abuse",
            "abuse poc",
            "aea8arin",
            "amazon web",
            "amazon aws",
            "service",
            "net1042531920",
            "net10425319201",
            "net108138001",
            "net108156002",
            "net130176002",
            "net13224002",
            "net13249001",
            "net1332002",
            "net1335001",
            "net143204002",
            "allocation",
            "certificate",
            "assignment",
            "po box",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "found",
            "ck techniques",
            "evasion att",
            "status code",
            "body length",
            "b body",
            "headers server",
            "cloudfront date",
            "contentlength",
            "connection",
            "date sun",
            "defense evasion",
            "ta0005 command",
            "control ta0011",
            "catalog tree",
            "resolved ips",
            "cname",
            "nothing",
            "accept",
            "registry keys",
            "http",
            "port",
            "gmt ifnonematch",
            "info file",
            "network dropped",
            "shutdown",
            "range",
            "name amazoncf",
            "parent at88z",
            "net type",
            "as organization",
            "amazon4",
            "link https",
            "links arin",
            "submit url",
            "handle amazon4",
            "street",
            "ave city",
            "wa postal",
            "code",
            "country us",
            "related",
            "whoiswhoisrws",
            "arin search",
            "whoisrws"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 106,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 636,
            "URL": 786,
            "domain": 462,
            "hostname": 790,
            "CIDR": 82,
            "email": 16
          },
          "indicator_count": 2979,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "326 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 6803
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/arin.net",
    "whois": "http://whois.domaintools.com/arin.net",
    "domain": "arin.net",
    "hostname": "rdap.arin.net"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69f066fc4532f3cdb1c4496c",
      "name": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer",
      "description": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer.\nArin has assigned client who does not hold an aws account a server that is unsigned and expired (potentially) leaving amazon vulnerable. Rec: watch ai \"facts\" \"do you want to know\" and alexa skills for potential  exploitation due to degrading systems which are not a company reflection rather an epic IP server and certificate failure worldwide, mostly United though. Attached are known and public sourcee APK Base IOCs.",
      "modified": "2026-05-29T00:06:38.152000",
      "created": "2026-04-28T07:51:24.539000",
      "tags": [
        "date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "amazon",
        "net3128001",
        "net3168001"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 521,
        "FileHash-SHA1": 400,
        "FileHash-SHA256": 2258,
        "domain": 128,
        "hostname": 221,
        "CIDR": 3,
        "URL": 266
      },
      "indicator_count": 3797,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "2 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69f066fdb68cb229059bbba0",
      "name": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer",
      "description": "2025-07-09- Socket not responding: [Errno 104] Connection reset by peer.\nArin has assigned client who does not hold an aws account a server that is unsigned and expired (potentially) leaving amazon vulnerable. Rec: watch ai \"facts\" \"do you want to know\" and alexa skills for potential  exploitation due to degrading systems which are not a company reflection rather an epic IP server and certificate failure worldwide, mostly United though. Attached are known and public sourcee APK Base IOCs.",
      "modified": "2026-05-29T00:06:38.152000",
      "created": "2026-04-28T07:51:25.005000",
      "tags": [
        "date",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "amazon",
        "net3128001",
        "net3168001"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 10,
        "FileHash-SHA1": 10,
        "FileHash-SHA256": 430,
        "domain": 4,
        "hostname": 49,
        "CIDR": 3,
        "URL": 11
      },
      "indicator_count": 517,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 67,
      "modified_text": "2 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687479e7b4cd29304527a9b6",
      "name": "IDK OTX - LevelBlue - Open Threat Exchange",
      "description": "Something\u2019s, someone is successfully hacking all our accounts on OTX. IS this a subsidiary of AT&T ? What is this?",
      "modified": "2025-08-13T03:00:55.577000",
      "created": "2025-07-14T03:30:47.687000",
      "tags": [
        "google tag",
        "utc gtmkvjvztk",
        "connection",
        "gmt date",
        "gmt etag",
        "referrerpolicy",
        "xcache error",
        "cloudfront",
        "utc google",
        "tag manager",
        "gtmkvjvztk",
        "utc gcfezl5ynvb",
        "utc na",
        "utc linkedin",
        "insight tag",
        "learn",
        "open threat",
        "exchange meta",
        "alienvault",
        "levelblue",
        "exchange og",
        "levelblue open",
        "threat exchange",
        "trackers",
        "amazon",
        "net3128001",
        "net3168001",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "extraction",
        "data upload",
        "type",
        "please sub",
        "include",
        "review data",
        "exclude",
        "sugges",
        "enter source",
        "url or",
        "texurag",
        "drop",
        "oiprop",
        "enter sourue",
        "url uk",
        "tenkau",
        "drop or",
        "drowol type",
        "extr please",
        "included iocs",
        "sc tenn",
        "drow type",
        "data",
        "failed",
        "extre data",
        "please",
        "tima",
        "pulse",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "mitre att",
        "ascii text",
        "pattern match",
        "ck id",
        "show technique",
        "hybrid",
        "date",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "se extraction",
        "enter sc",
        "oidrop",
        "extract",
        "review io",
        "excluded ous",
        "u suggested",
        "stop data",
        "extraction fa",
        "enter sou",
        "se source",
        "iocs",
        "manually add",
        "indicator",
        "extra",
        "extra data",
        "review los",
        "exclude data",
        "suggestealous u"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 132,
        "FileHash-SHA256": 751,
        "hostname": 614,
        "URL": 48,
        "CIDR": 3,
        "domain": 36,
        "FileHash-SHA1": 127
      },
      "indicator_count": 1711,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "291 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6845e54bb82667ed18988fe5",
      "name": "Amazon -CF | Malicious autonomous system",
      "description": "Handle: AMAZON-4 Network Name: AMAZON-CF\n#DWactivity |\nWHO IS: \nAutonomous System Numbers\nAMAZON-AS\tAS7224 (AS7224)\nLABSHUB-NETWORKING\tAS10291 (AS10291)\nAMAZON-02\tAS16509 (AS16509)\nAWS-01\tAS19047 (AS19047)\nPRIME-TESTING\tAS63088 (AS63088)\n#malicious #rat #infection #auotonomous #virus #network #dns #intrusion #darkweb\n\n*issue with this great tool or possibly my network. Several IoC\u2019s deleted, I went back to retrieve IoC\u2019s from VT they were deleted and I had to do it all\nOver but conditions had changed.\nStill unable to annotate.",
      "modified": "2025-07-08T19:04:31.649000",
      "created": "2025-06-08T19:32:27.529000",
      "tags": [
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "ascii text",
        "pattern match",
        "mitre att",
        "ck id",
        "show technique",
        "null",
        "refresh",
        "body",
        "span",
        "june",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "net3128001",
        "net3168001",
        "amazon",
        "technology",
        "zenbox",
        "domain",
        "r2dbox",
        "virustotal",
        "technology xn",
        "united",
        "unknown aaaa",
        "search",
        "emails",
        "servers",
        "moved",
        "registrar",
        "creation date",
        "name servers",
        "present may",
        "entries",
        "ip address",
        "present feb",
        "present jan",
        "aaaa",
        "status",
        "passive dns",
        "urls",
        "server",
        "asn16509",
        "amazon02",
        "general full",
        "url http",
        "reverse dns",
        "resource",
        "resource path",
        "size",
        "cloudfront",
        "request id",
        "expiration date",
        "record value",
        "name domain",
        "org microsoft",
        "microsoft way",
        "hostname add",
        "pulse submit",
        "pulse indicator",
        "url analysis",
        "amazon ec2",
        "abuse",
        "aws rpki",
        "management poc",
        "ip routing",
        "report abuse",
        "abuse poc",
        "aea8arin",
        "amazon web",
        "amazon aws",
        "service",
        "net1042531920",
        "net10425319201",
        "net108138001",
        "net108156002",
        "net130176002",
        "net13224002",
        "net13249001",
        "net1332002",
        "net1335001",
        "net143204002",
        "allocation",
        "certificate",
        "assignment",
        "po box",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "found",
        "ck techniques",
        "evasion att",
        "status code",
        "body length",
        "b body",
        "headers server",
        "cloudfront date",
        "contentlength",
        "connection",
        "date sun",
        "defense evasion",
        "ta0005 command",
        "control ta0011",
        "catalog tree",
        "resolved ips",
        "cname",
        "nothing",
        "accept",
        "registry keys",
        "http",
        "port",
        "gmt ifnonematch",
        "info file",
        "network dropped",
        "shutdown",
        "range",
        "name amazoncf",
        "parent at88z",
        "net type",
        "as organization",
        "amazon4",
        "link https",
        "links arin",
        "submit url",
        "handle amazon4",
        "street",
        "ave city",
        "wa postal",
        "code",
        "country us",
        "related",
        "whoiswhoisrws",
        "arin search",
        "whoisrws"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 106,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 636,
        "URL": 786,
        "domain": 462,
        "hostname": 790,
        "CIDR": 82,
        "email": 16
      },
      "indicator_count": 2979,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "326 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://rdap.arin.net/registry/ip/3.168.0.0",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://rdap.arin.net/registry/ip/3.168.0.0",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780206453.800769
}