{
  "type": "URL",
  "indicator": "https://s.kaskus.id/e3.1/images/default",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://s.kaskus.id/e3.1/images/default",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3154292505,
      "indicator": "https://s.kaskus.id/e3.1/images/default",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "65944a8149f2479b2fbc6cd1",
          "name": "Relic",
          "description": "Malicious redirect to BotNet malvertizing of a business affecting both .command YouTube distribution. YouTube encoded logins. Hacker attack, geo tracking, passwords crack, decryption, C2. Retaliation. Found in referenced Twitter link shared  with me.",
          "modified": "2024-02-01T14:01:46.735000",
          "created": "2024-01-02T17:40:17.890000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers nel",
            "maxage5184000",
            "name verdict",
            "falcon sandbox",
            "whois record",
            "ssl certificate",
            "tsara brashears",
            "whois whois",
            "historical ssl",
            "contacted",
            "highly targeted",
            "hackers",
            "botnet",
            "apple ios",
            "malicious",
            "hacktool",
            "quasar",
            "download",
            "malware",
            "relic",
            "monitoring",
            "installer",
            "tofsee",
            "getprocaddress",
            "indicator",
            "prefetch8",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "united",
            "file",
            "pattern match",
            "path",
            "date",
            "win64",
            "factory",
            "model",
            "comspec",
            "hybrid",
            "general",
            "click",
            "strings",
            "patch",
            "song culture",
            "tulach"
          ],
          "references": [
            "rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker",
            "https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d",
            "https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,",
            "https://twitter.com/sheriffspurlock?lang=en",
            "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8",
            "http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru",
            "nr-data.net [Apple Private Data Collection]",
            "init.ess.apple.com [backdoor, malicious script, access via media]",
            "https://stackabuse.com/assets/images/apple",
            "https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err",
            "location-icloud.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign]",
            "mailtrack.io [tracking VirusTotal graphs, link trace back]",
            "http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=\u00aeion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes",
            "https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=",
            "https://pin.it/ [faux Pinterest for TB]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [",
            "114.114.114.114 [ Tulach Malware IP]",
            "13.107.136.8  [ Tulach Malware IP redirect]",
            "http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe]",
            "http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior]",
            "http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_",
            "http://114.114.114.114/ipw.ps1",
            "194.245.148.189 [CnC]",
            "https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/",
            "http://109.206.241.129/666bins/666.mpsl",
            "http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2",
            "143.244.50.213 |169.150.249.162  [malware_hosting]",
            "http://watchhers.net/index.php [malware spreader]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration\t0\t  Domain twitter.com No Expiration\t0\t  Hostname www.pornhub.com No Expiration\t0\t  URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration\t0\t  URL",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "xred.mooo.com [pornhub trojan]",
            "https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious]",
            "http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\\george",
            "https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Comspec",
              "display_name": "Comspec",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8049,
            "FileHash-MD5": 388,
            "FileHash-SHA1": 212,
            "FileHash-SHA256": 7062,
            "domain": 4401,
            "hostname": 2653,
            "CVE": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 22769,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "850 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "624df7adeb106d4f2736b2d2",
          "name": "http://fpdownload.adobe.com/ -  how-to-get-unlimited-robux_GM431946152.pdf",
          "description": "",
          "modified": "2022-05-06T00:03:41.989000",
          "created": "2022-04-06T20:27:25.144000",
          "tags": [
            "how-to-get-unlimited-robux_GM431946152.pdf"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/a649645f6de177e9670caa6aec7604e34508af48714d207724a0dc3510c70f7a/5d9690f80388387c804fe71e",
            "895e20b81e5636e094f3e024df00c61e129709c2274db53ba3ce4e840207034f",
            "how-to-get-unlimited-robux_GM431946152.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 706,
            "hostname": 344,
            "FileHash-SHA256": 1746,
            "domain": 142,
            "CVE": 1,
            "FileHash-MD5": 69,
            "FileHash-SHA1": 61
          },
          "indicator_count": 3069,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 397,
          "modified_text": "1487 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "194.245.148.189 [CnC]",
        "mailtrack.io [tracking VirusTotal graphs, link trace back]",
        "https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err",
        "114.114.114.114 [ Tulach Malware IP]",
        "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8",
        "nr-data.net [Apple Private Data Collection]",
        "https://hybrid-analysis.com/sample/a649645f6de177e9670caa6aec7604e34508af48714d207724a0dc3510c70f7a/5d9690f80388387c804fe71e",
        "https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking]",
        "http://watchhers.net/index.php [malware spreader]",
        "location-icloud.com",
        "http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=\u00aeion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes",
        "https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious]",
        "rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior]",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign]",
        "895e20b81e5636e094f3e024df00c61e129709c2274db53ba3ce4e840207034f",
        "https://twitter.com/sheriffspurlock?lang=en",
        "xred.mooo.com [pornhub trojan]",
        "http://114.114.114.114/ipw.ps1",
        "how-to-get-unlimited-robux_GM431946152.pdf",
        "https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/",
        "http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_",
        "https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d",
        "13.107.136.8  [ Tulach Malware IP redirect]",
        "https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,",
        "init.ess.apple.com [backdoor, malicious script, access via media]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration\t0\t  Domain twitter.com No Expiration\t0\t  Hostname www.pornhub.com No Expiration\t0\t  URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration\t0\t  URL",
        "http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe]",
        "https://pin.it/ [faux Pinterest for TB]",
        "https://stackabuse.com/assets/images/apple",
        "https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community",
        "http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru",
        "http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [",
        "143.244.50.213 |169.150.249.162  [malware_hosting]",
        "http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\\george",
        "http://109.206.241.129/666bins/666.mpsl"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Tofsee",
            "Tulach",
            "Relic",
            "Hacktool",
            "Comspec",
            "Quasar rat"
          ],
          "industries": [],
          "unique_indicators": 26339
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/kaskus.id",
    "whois": "http://whois.domaintools.com/kaskus.id",
    "domain": "kaskus.id",
    "hostname": "s.kaskus.id"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "65944a8149f2479b2fbc6cd1",
      "name": "Relic",
      "description": "Malicious redirect to BotNet malvertizing of a business affecting both .command YouTube distribution. YouTube encoded logins. Hacker attack, geo tracking, passwords crack, decryption, C2. Retaliation. Found in referenced Twitter link shared  with me.",
      "modified": "2024-02-01T14:01:46.735000",
      "created": "2024-01-02T17:40:17.890000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls https",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers nel",
        "maxage5184000",
        "name verdict",
        "falcon sandbox",
        "whois record",
        "ssl certificate",
        "tsara brashears",
        "whois whois",
        "historical ssl",
        "contacted",
        "highly targeted",
        "hackers",
        "botnet",
        "apple ios",
        "malicious",
        "hacktool",
        "quasar",
        "download",
        "malware",
        "relic",
        "monitoring",
        "installer",
        "tofsee",
        "getprocaddress",
        "indicator",
        "prefetch8",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "united",
        "file",
        "pattern match",
        "path",
        "date",
        "win64",
        "factory",
        "model",
        "comspec",
        "hybrid",
        "general",
        "click",
        "strings",
        "patch",
        "song culture",
        "tulach"
      ],
      "references": [
        "rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker",
        "https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d",
        "https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,",
        "https://twitter.com/sheriffspurlock?lang=en",
        "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8",
        "http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru",
        "nr-data.net [Apple Private Data Collection]",
        "init.ess.apple.com [backdoor, malicious script, access via media]",
        "https://stackabuse.com/assets/images/apple",
        "https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err",
        "location-icloud.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign]",
        "mailtrack.io [tracking VirusTotal graphs, link trace back]",
        "http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=\u00aeion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes",
        "https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=",
        "https://pin.it/ [faux Pinterest for TB]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [",
        "114.114.114.114 [ Tulach Malware IP]",
        "13.107.136.8  [ Tulach Malware IP redirect]",
        "http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe]",
        "http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior]",
        "http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_",
        "http://114.114.114.114/ipw.ps1",
        "194.245.148.189 [CnC]",
        "https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/",
        "http://109.206.241.129/666bins/666.mpsl",
        "http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2",
        "143.244.50.213 |169.150.249.162  [malware_hosting]",
        "http://watchhers.net/index.php [malware spreader]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration\t0\t  Domain twitter.com No Expiration\t0\t  Hostname www.pornhub.com No Expiration\t0\t  URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration\t0\t  URL",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "xred.mooo.com [pornhub trojan]",
        "https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious]",
        "http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\\george",
        "https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Comspec",
          "display_name": "Comspec",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8049,
        "FileHash-MD5": 388,
        "FileHash-SHA1": 212,
        "FileHash-SHA256": 7062,
        "domain": 4401,
        "hostname": 2653,
        "CVE": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 22769,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "850 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "624df7adeb106d4f2736b2d2",
      "name": "http://fpdownload.adobe.com/ -  how-to-get-unlimited-robux_GM431946152.pdf",
      "description": "",
      "modified": "2022-05-06T00:03:41.989000",
      "created": "2022-04-06T20:27:25.144000",
      "tags": [
        "how-to-get-unlimited-robux_GM431946152.pdf"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/a649645f6de177e9670caa6aec7604e34508af48714d207724a0dc3510c70f7a/5d9690f80388387c804fe71e",
        "895e20b81e5636e094f3e024df00c61e129709c2274db53ba3ce4e840207034f",
        "how-to-get-unlimited-robux_GM431946152.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 706,
        "hostname": 344,
        "FileHash-SHA256": 1746,
        "domain": 142,
        "CVE": 1,
        "FileHash-MD5": 69,
        "FileHash-SHA1": 61
      },
      "indicator_count": 3069,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 397,
      "modified_text": "1487 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://s.kaskus.id/e3.1/images/default",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://s.kaskus.id/e3.1/images/default",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780312217.9489212
}