{ "type": "URL", "indicator": "https://rp.amniscdn.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://rp.amniscdn.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 2861222572, "indicator": "https://rp.amniscdn.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 12, "pulses": [ { "id": "65708f1d9c1be22930c7a9ca", "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host", "description": "", "modified": "2023-12-06T15:11:25.389000", "created": "2023-12-06T15:11:25.389000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1341, "CVE": 1, "FileHash-SHA256": 3239, "domain": 1303, "URL": 8470, "FileHash-MD5": 893, "FileHash-SHA1": 795 }, "indicator_count": 16042, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e5ea05c09e3364f11cd", "name": "184.173.179.55 asn36351 theplanet.com 16-1-2016", "description": "", "modified": "2023-12-06T15:08:14.591000", "created": "2023-12-06T15:08:14.591000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1058, "domain": 167, "hostname": 866, "URL": 3191, "CVE": 1 }, "indicator_count": 5283, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657089f0a9a109319e652f2e", "name": "Democracy.works_3.23.22", "description": "", "modified": "2023-12-06T14:49:20.276000", "created": "2023-12-06T14:49:20.276000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 3788, "URL": 10812, "hostname": 2537, "domain": 1018, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 18160, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657089d7a9a109319e652f2d", "name": "DEMOCRACY.WORKS", "description": "", "modified": "2023-12-06T14:48:55.889000", "created": "2023-12-06T14:48:55.889000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 3611, "URL": 9861, "hostname": 2031, "domain": 945, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 16452, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f8ee427db014eda79f3", "name": "FAKE MDM's and HASH", "description": "", "modified": "2023-12-06T14:05:02.692000", "created": "2023-12-06T14:05:02.692000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6858, "FileHash-SHA256": 2217, "FileHash-MD5": 488, "FileHash-SHA1": 494, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f66d3fe743b63b06fc5", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "", "modified": "2023-12-06T14:04:22.492000", "created": "2023-12-06T14:04:22.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6912, "FileHash-SHA256": 2217, "domain": 248, "hostname": 1815, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6294d3c37b2f4fd77a5ca483", "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host", "description": "Twitter's link shortner from original tweet\nhttps://t.co/1Snx7jYTvZ posted by itspmagazine How many #ransomware predictions by \n@cylanceinc's have/will come true? maybe this adware camp is utilising older podcasts and audio to exfil data. Its taken two days to do this pulse and its far from complete given the original had over 22k indicators", "modified": "2022-06-29T00:00:46.963000", "created": "2022-05-30T14:25:07.820000", "tags": [ "www.quantic-systems.com", "https://itspmagazine.com/from-the-newsroom/ransomware-prediction", "https://t.co/1Snx7jYTvZ" ], "references": [ "ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac 2.json", "https://www.virustotal.com/graph/ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac", "https://mobile.twitter.com/Quantic_Systems/with_replies", "https://mobile.twitter.com/ITSPmagazine/status/810428296995274752", "https://t.co/1Snx7jYTvZ", "How many #ransomware predictions by @cylanceinc 's", "https://docplayer.net/56678996-The-cyber-defense-review.html", "https://itspmagazine.com/from-the-newsroom/ransomware-predictions-past-present-future-future", "www.quantic-systems.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3239, "hostname": 1341, "URL": 8470, "domain": 1303, "CVE": 1, "FileHash-MD5": 893, "FileHash-SHA1": 795 }, "indicator_count": 16042, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6282e4efa1c1999e0091a9b0", "name": "184.173.179.55 asn36351 theplanet.com 16-1-2016", "description": "", "modified": "2022-06-15T00:01:21.489000", "created": "2022-05-16T23:57:35.661000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3191, "hostname": 866, "FileHash-SHA256": 1058, "domain": 167, "CVE": 1 }, "indicator_count": 5283, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1404 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623b7febb8bc01a01e42ab3d", "name": "Democracy.works_3.23.22", "description": "", "modified": "2022-04-22T00:03:50.614000", "created": "2022-03-23T20:15:39.720000", "tags": [], "references": [ "Democracy.works_3.23.22..pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10812, "hostname": 2537, "domain": 1018, "FileHash-SHA256": 3788, "CVE": 2, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 18160, "is_author": false, "is_subscribing": null, "subscriber_count": 412, "modified_text": "1458 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623920a2146150d2d8525a73", "name": "DEMOCRACY.WORKS", "description": "", "modified": "2022-04-20T00:02:21.571000", "created": "2022-03-22T01:04:34.472000", "tags": [], "references": [ "DEMOCRACY.WORKS.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 9861, "domain": 945, "hostname": 2031, "FileHash-SHA256": 3611, "CVE": 1, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 16452, "is_author": false, "is_subscribing": null, "subscriber_count": 414, "modified_text": "1460 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621cb7979a0e098a59765794", "name": "FAKE MDM's and HASH", "description": "FAKE MDM HOSTS AND HASH FILES TO COMPLIMENT IT.", "modified": "2022-03-30T00:00:10.458000", "created": "2022-02-28T11:52:55.393000", "tags": [ "filehashsha256", "ipv4", "filehashsha1", "indicator", "description", "antiviru", "up blocker", "xoz1" ], "references": [ "621a207acd980846334d7fb4.csv" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "craignbmed", "id": "181999", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_181999/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 488, "FileHash-SHA1": 494, "FileHash-SHA256": 2217, "URL": 6858, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 46, "modified_text": "1481 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621a207acd980846334d7fb4", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "sitting on home network private ip' all managed under the remotewd and w2go domains. They all look clean and shiny on the top layers but are all working together underneath to spread and cause merry hell. Compromised social media creds logging in to multiple other browssers at the same time exploiting others while you go about your business online. This is at least twice the size again of this pulse list", "modified": "2022-03-28T00:01:22.803000", "created": "2022-02-26T12:43:38.731000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1398", "name": "Modify OS Kernel or Boot Partition", "display_name": "T1398 - Modify OS Kernel or Boot Partition" }, { "id": "T1399", "name": "Modify Trusted Execution Environment", "display_name": "T1399 - Modify Trusted Execution Environment" }, { "id": "T1400", "name": "Modify System Partition", "display_name": "T1400 - Modify System Partition" }, { "id": "T1401", "name": "Device Administrator Permissions", "display_name": "T1401 - Device Administrator Permissions" }, { "id": "T1402", "name": "Broadcast Receivers", "display_name": "T1402 - Broadcast Receivers" }, { "id": "T1408", "name": "Disguise Root/Jailbreak Indicators", "display_name": "T1408 - Disguise Root/Jailbreak Indicators" }, { "id": "T1204.001", "name": "Malicious Link", "display_name": "T1204.001 - Malicious Link" }, { "id": "T1204.002", "name": "Malicious File", "display_name": "T1204.002 - Malicious File" }, { "id": "T1204.003", "name": "Malicious Image", "display_name": "T1204.003 - Malicious Image" }, { "id": "T1205", "name": "Traffic Signaling", "display_name": "T1205 - Traffic Signaling" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1503", "name": "Credentials from Web Browsers", "display_name": "T1503 - Credentials from Web Browsers" }, { "id": "T1505.002", "name": "Transport Agent", "display_name": "T1505.002 - Transport Agent" }, { "id": "T1601.002", "name": "Downgrade System Image", "display_name": "T1601.002 - Downgrade System Image" }, { "id": "T1001.002", "name": "Steganography", "display_name": "T1001.002 - Steganography" }, { "id": "T1602.002", "name": "Network Device Configuration Dump", "display_name": "T1602.002 - Network Device Configuration Dump" }, { "id": "T1506", "name": "Web Session Cookie", "display_name": "T1506 - Web Session Cookie" }, { "id": "T1517", "name": "Access Notifications", "display_name": "T1517 - Access Notifications" }, { "id": "T1523", "name": "Evade Analysis Environment", "display_name": "T1523 - Evade Analysis Environment" }, { "id": "T1534", "name": "Internal Spearphishing", "display_name": "T1534 - Internal Spearphishing" }, { "id": "T1539", "name": "Steal Web Session Cookie", "display_name": "T1539 - Steal Web Session Cookie" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1815, "URL": 6912, "domain": 248, "FileHash-SHA256": 2217, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 401, "modified_text": "1483 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://docplayer.net/56678996-The-cyber-defense-review.html", "Democracy.works_3.23.22..pdf", "DEMOCRACY.WORKS.pdf", "https://www.virustotal.com/graph/ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac", "www.quantic-systems.com", "https://itspmagazine.com/from-the-newsroom/ransomware-predictions-past-present-future-future", "https://t.co/1Snx7jYTvZ", "621a207acd980846334d7fb4.csv", "https://mobile.twitter.com/Quantic_Systems/with_replies", "How many #ransomware predictions by @cylanceinc 's", "ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac 2.json", "https://mobile.twitter.com/ITSPmagazine/status/810428296995274752" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 46217 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/amniscdn.com", "whois": "http://whois.domaintools.com/amniscdn.com", "domain": "amniscdn.com", "hostname": "rp.amniscdn.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 12, "pulses": [ { "id": "65708f1d9c1be22930c7a9ca", "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host", "description": "", "modified": "2023-12-06T15:11:25.389000", "created": "2023-12-06T15:11:25.389000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1341, "CVE": 1, "FileHash-SHA256": 3239, "domain": 1303, "URL": 8470, "FileHash-MD5": 893, "FileHash-SHA1": 795 }, "indicator_count": 16042, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e5ea05c09e3364f11cd", "name": "184.173.179.55 asn36351 theplanet.com 16-1-2016", "description": "", "modified": "2023-12-06T15:08:14.591000", "created": "2023-12-06T15:08:14.591000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1058, "domain": 167, "hostname": 866, "URL": 3191, "CVE": 1 }, "indicator_count": 5283, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657089f0a9a109319e652f2e", "name": "Democracy.works_3.23.22", "description": "", "modified": "2023-12-06T14:49:20.276000", "created": "2023-12-06T14:49:20.276000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 3788, "URL": 10812, "hostname": 2537, "domain": 1018, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 18160, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657089d7a9a109319e652f2d", "name": "DEMOCRACY.WORKS", "description": "", "modified": "2023-12-06T14:48:55.889000", "created": "2023-12-06T14:48:55.889000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 3611, "URL": 9861, "hostname": 2031, "domain": 945, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 16452, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f8ee427db014eda79f3", "name": "FAKE MDM's and HASH", "description": "", "modified": "2023-12-06T14:05:02.692000", "created": "2023-12-06T14:05:02.692000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6858, "FileHash-SHA256": 2217, "FileHash-MD5": 488, "FileHash-SHA1": 494, "domain": 266, "hostname": 1729 }, "indicator_count": 12052, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f66d3fe743b63b06fc5", "name": "This is a botnet consisting of millions of user controlled devices masquerading as mdm enterprise", "description": "", "modified": "2023-12-06T14:04:22.492000", "created": "2023-12-06T14:04:22.492000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 6912, "FileHash-SHA256": 2217, "domain": 248, "hostname": 1815, "FileHash-SHA1": 7 }, "indicator_count": 11199, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6294d3c37b2f4fd77a5ca483", "name": "This is a whoopa - vast adware camp using tweets/links/img's but equates to spyware via regular default Services, configs and cloud host", "description": "Twitter's link shortner from original tweet\nhttps://t.co/1Snx7jYTvZ posted by itspmagazine How many #ransomware predictions by \n@cylanceinc's have/will come true? maybe this adware camp is utilising older podcasts and audio to exfil data. Its taken two days to do this pulse and its far from complete given the original had over 22k indicators", "modified": "2022-06-29T00:00:46.963000", "created": "2022-05-30T14:25:07.820000", "tags": [ "www.quantic-systems.com", "https://itspmagazine.com/from-the-newsroom/ransomware-prediction", "https://t.co/1Snx7jYTvZ" ], "references": [ "ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac 2.json", "https://www.virustotal.com/graph/ge34d984fe0e14db9a2b1c48bdaca8e6f5b9e1e66f8ad49a580680dffaf7431ac", "https://mobile.twitter.com/Quantic_Systems/with_replies", "https://mobile.twitter.com/ITSPmagazine/status/810428296995274752", "https://t.co/1Snx7jYTvZ", "How many #ransomware predictions by @cylanceinc 's", "https://docplayer.net/56678996-The-cyber-defense-review.html", "https://itspmagazine.com/from-the-newsroom/ransomware-predictions-past-present-future-future", "www.quantic-systems.com" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3239, "hostname": 1341, "URL": 8470, "domain": 1303, "CVE": 1, "FileHash-MD5": 893, "FileHash-SHA1": 795 }, "indicator_count": 16042, "is_author": false, "is_subscribing": null, "subscriber_count": 394, "modified_text": "1390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6282e4efa1c1999e0091a9b0", "name": "184.173.179.55 asn36351 theplanet.com 16-1-2016", "description": "", "modified": "2022-06-15T00:01:21.489000", "created": "2022-05-16T23:57:35.661000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3191, "hostname": 866, "FileHash-SHA256": 1058, "domain": 167, "CVE": 1 }, "indicator_count": 5283, "is_author": false, "is_subscribing": null, "subscriber_count": 392, "modified_text": "1404 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623b7febb8bc01a01e42ab3d", "name": "Democracy.works_3.23.22", "description": "", "modified": "2022-04-22T00:03:50.614000", "created": "2022-03-23T20:15:39.720000", "tags": [], "references": [ "Democracy.works_3.23.22..pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 10812, "hostname": 2537, "domain": 1018, "FileHash-SHA256": 3788, "CVE": 2, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 18160, "is_author": false, "is_subscribing": null, "subscriber_count": 412, "modified_text": "1458 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "623920a2146150d2d8525a73", "name": "DEMOCRACY.WORKS", "description": "", "modified": "2022-04-20T00:02:21.571000", "created": "2022-03-22T01:04:34.472000", "tags": [], "references": [ "DEMOCRACY.WORKS.pdf" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 9861, "domain": 945, "hostname": 2031, "FileHash-SHA256": 3611, "CVE": 1, "FileHash-MD5": 2, "FileHash-SHA1": 1 }, "indicator_count": 16452, "is_author": false, "is_subscribing": null, "subscriber_count": 414, "modified_text": "1460 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://rp.amniscdn.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://rp.amniscdn.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776629514.2493901 }