{
  "type": "URL",
  "indicator": "https://schema.org/WPFooter",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://schema.org/WPFooter",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "whitelist",
        "message": "Whitelisted domain schema.org",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain schema.org",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4051903066,
      "indicator": "https://schema.org/WPFooter",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69eb254f17eb4a2a990f07e5",
          "name": "LevelBlue - Open Threat Exchange",
          "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]",
          "modified": "2026-05-28T07:10:11.800000",
          "created": "2026-04-24T08:09:51.488000",
          "tags": [
            "pdfkit",
            "cve202225765",
            "exploit script",
            "github",
            "unicordev",
            "cves",
            "xml external",
            "entity",
            "pdfs",
            "knowledge base",
            "python",
            "mozilla",
            "virustotal",
            "cisa",
            "apple",
            "microsoft",
            "pdfkit ruby",
            "remote code",
            "execution",
            "urls",
            "malware",
            "raid",
            "caddywiper",
            "wipes",
            "cve202543529",
            "webkit",
            "february",
            "cve202620643",
            "bypass",
            "march",
            "webkit bug",
            "command",
            "control",
            "levelblue",
            "open threat"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Wipes",
              "display_name": "Wipes",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1084,
            "FileHash-SHA1": 874,
            "FileHash-SHA256": 3052,
            "CVE": 36,
            "domain": 437,
            "hostname": 1086,
            "URL": 1411,
            "CIDR": 15,
            "email": 13
          },
          "indicator_count": 8008,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "4 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "67e1aa875e6c907d7e1b5fa0",
          "name": "hxxps://tech4service.ca - 03.24.25",
          "description": "YEG tech/hardware vendor",
          "modified": "2025-04-23T18:02:31.021000",
          "created": "2025-03-24T18:55:03.147000",
          "tags": [
            "please",
            "javascript",
            "threat intelligence",
            "feed",
            "ioc",
            "change theme",
            "contact us",
            "intelligence",
            "threats api",
            "analyze api",
            "overview",
            "threats explore",
            "rate limits",
            "stixtaxii",
            "bulk export",
            "community",
            "results",
            "switch",
            "inquest labs",
            "resources api",
            "notes supported",
            "cve list",
            "drop your",
            "file",
            "service",
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "virus",
            "ransomware",
            "static",
            "indicator of compromise",
            "extraction",
            "emulation",
            "platform",
            "prefetch8 ansi",
            "ansi",
            "show process",
            "hash seen",
            "pcap processing",
            "pcap",
            "date",
            "ck id",
            "command decode",
            "mitre att",
            "win64",
            "suspicious",
            "hybrid",
            "comspec",
            "close",
            "click",
            "hosts",
            "general",
            "path",
            "model",
            "encrypt",
            "upgrade",
            "strings",
            "contact"
          ],
          "references": [
            "https://www.virustotal.com/gui/url/d3fcc8b4575e8e04b8c80b171089c26f3d117ac9b11e971dc4fd0345f00b4414",
            "https://pulsedive.com/indicator/?iid=68410521",
            "https://metadefender.com/results/url/aHR0cHM6Ly90ZWNoNHNlcnZpY2UuY2E=",
            "https://hybrid-analysis.com/sample/4ac0486c18ef662f2ba44e75cc13830d7e3d6a8ec20040a78e7818a6484bf807",
            "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/overview",
            "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/geolocation",
            "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/ioc",
            "https://hybrid-analysis.com/sample/4ac0486c18ef662f2ba44e75cc13830d7e3d6a8ec20040a78e7818a6484bf807/67e1a708525a509d1805065a",
            "",
            "https://pulsedive.com/indicator/?iid=68410679"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 189,
            "FileHash-MD5": 21,
            "FileHash-SHA1": 20,
            "FileHash-SHA256": 20,
            "domain": 29,
            "email": 7,
            "hostname": 37,
            "SSLCertFingerprint": 20
          },
          "indicator_count": 343,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "403 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://hybrid-analysis.com/sample/4ac0486c18ef662f2ba44e75cc13830d7e3d6a8ec20040a78e7818a6484bf807/67e1a708525a509d1805065a",
        "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/ioc",
        "https://pulsedive.com/indicator/?iid=68410679",
        "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/geolocation",
        "https://hybrid-analysis.com/sample/4ac0486c18ef662f2ba44e75cc13830d7e3d6a8ec20040a78e7818a6484bf807",
        "https://metadefender.com/results/url/aHR0cHM6Ly90ZWNoNHNlcnZpY2UuY2E=",
        "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/overview",
        "https://pulsedive.com/indicator/?iid=68410521",
        "https://www.virustotal.com/gui/url/d3fcc8b4575e8e04b8c80b171089c26f3d117ac9b11e971dc4fd0345f00b4414",
        "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Wipes"
          ],
          "industries": [
            "Technology"
          ],
          "unique_indicators": 4444
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/schema.org",
    "whois": "http://whois.domaintools.com/schema.org",
    "domain": "schema.org",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69eb254f17eb4a2a990f07e5",
      "name": "LevelBlue - Open Threat Exchange",
      "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]",
      "modified": "2026-05-28T07:10:11.800000",
      "created": "2026-04-24T08:09:51.488000",
      "tags": [
        "pdfkit",
        "cve202225765",
        "exploit script",
        "github",
        "unicordev",
        "cves",
        "xml external",
        "entity",
        "pdfs",
        "knowledge base",
        "python",
        "mozilla",
        "virustotal",
        "cisa",
        "apple",
        "microsoft",
        "pdfkit ruby",
        "remote code",
        "execution",
        "urls",
        "malware",
        "raid",
        "caddywiper",
        "wipes",
        "cve202543529",
        "webkit",
        "february",
        "cve202620643",
        "bypass",
        "march",
        "webkit bug",
        "command",
        "control",
        "levelblue",
        "open threat"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Wipes",
          "display_name": "Wipes",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1084,
        "FileHash-SHA1": 874,
        "FileHash-SHA256": 3052,
        "CVE": 36,
        "domain": 437,
        "hostname": 1086,
        "URL": 1411,
        "CIDR": 15,
        "email": 13
      },
      "indicator_count": 8008,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 70,
      "modified_text": "4 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "67e1aa875e6c907d7e1b5fa0",
      "name": "hxxps://tech4service.ca - 03.24.25",
      "description": "YEG tech/hardware vendor",
      "modified": "2025-04-23T18:02:31.021000",
      "created": "2025-03-24T18:55:03.147000",
      "tags": [
        "please",
        "javascript",
        "threat intelligence",
        "feed",
        "ioc",
        "change theme",
        "contact us",
        "intelligence",
        "threats api",
        "analyze api",
        "overview",
        "threats explore",
        "rate limits",
        "stixtaxii",
        "bulk export",
        "community",
        "results",
        "switch",
        "inquest labs",
        "resources api",
        "notes supported",
        "cve list",
        "drop your",
        "file",
        "service",
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "virus",
        "ransomware",
        "static",
        "indicator of compromise",
        "extraction",
        "emulation",
        "platform",
        "prefetch8 ansi",
        "ansi",
        "show process",
        "hash seen",
        "pcap processing",
        "pcap",
        "date",
        "ck id",
        "command decode",
        "mitre att",
        "win64",
        "suspicious",
        "hybrid",
        "comspec",
        "close",
        "click",
        "hosts",
        "general",
        "path",
        "model",
        "encrypt",
        "upgrade",
        "strings",
        "contact"
      ],
      "references": [
        "https://www.virustotal.com/gui/url/d3fcc8b4575e8e04b8c80b171089c26f3d117ac9b11e971dc4fd0345f00b4414",
        "https://pulsedive.com/indicator/?iid=68410521",
        "https://metadefender.com/results/url/aHR0cHM6Ly90ZWNoNHNlcnZpY2UuY2E=",
        "https://hybrid-analysis.com/sample/4ac0486c18ef662f2ba44e75cc13830d7e3d6a8ec20040a78e7818a6484bf807",
        "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/overview",
        "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/geolocation",
        "https://www.filescan.io/uploads/67e1a7ffc26eb3fd74f584c0/reports/28bf2c8b-9ebd-4f47-8428-135838c23c2f/ioc",
        "https://hybrid-analysis.com/sample/4ac0486c18ef662f2ba44e75cc13830d7e3d6a8ec20040a78e7818a6484bf807/67e1a708525a509d1805065a",
        "",
        "https://pulsedive.com/indicator/?iid=68410679"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 189,
        "FileHash-MD5": 21,
        "FileHash-SHA1": 20,
        "FileHash-SHA256": 20,
        "domain": 29,
        "email": 7,
        "hostname": 37,
        "SSLCertFingerprint": 20
      },
      "indicator_count": 343,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "403 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://schema.org/WPFooter",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://schema.org/WPFooter",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780331379.3087218
}