{
  "type": "URL",
  "indicator": "https://sms.rizk.rs/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://sms.rizk.rs/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4098400812,
      "indicator": "https://sms.rizk.rs/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "695043197c2fbfda85abc1d4",
          "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
          "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
          "modified": "2025-12-27T20:35:37.012000",
          "created": "2025-12-27T20:35:37.012000",
          "tags": [
            "Palantir",
            "Ad- Maven",
            "Prometheus Intelligence Technology"
          ],
          "references": [
            "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
            "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Carts.Guru",
              "display_name": "Carts.Guru",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Education",
            "Civil Society"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 82,
            "hostname": 180,
            "URL": 995,
            "FileHash-SHA256": 110
          },
          "indicator_count": 1367,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "114 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d91b1a8f414040bfba430",
          "name": "Spyware",
          "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
          "modified": "2025-08-20T00:01:59.498000",
          "created": "2025-07-21T01:02:41.049000",
          "tags": [
            "serving ip",
            "address",
            "status",
            "utc na",
            "utc google",
            "utc facebook",
            "custom audience",
            "tag manager",
            "ua748443502",
            "utc gtmwrp73mt",
            "utc gsrdlm5jnx1",
            "utc aw937838002",
            "adsense na",
            "connect",
            "file type",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "powershell",
            "b file",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "c0002 wininet",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cndigicert sha2",
            "secure server",
            "ca odigicert",
            "inc cus",
            "subject",
            "cnwe1 ogoogle",
            "trust",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft",
            "get http",
            "request",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "united",
            "search",
            "creation date",
            "expiration date",
            "name servers",
            "unknown soa",
            "germany unknown",
            "entries",
            "pulse submit",
            "url analysis",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 304,
            "hostname": 796,
            "URL": 2590,
            "FileHash-SHA256": 2735,
            "FileHash-MD5": 253,
            "FileHash-SHA1": 144,
            "email": 1
          },
          "indicator_count": 6823,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Carts.guru"
          ],
          "industries": [
            "Education",
            "Civil society",
            "Government"
          ],
          "unique_indicators": 7330
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/rizk.rs",
    "whois": "http://whois.domaintools.com/rizk.rs",
    "domain": "rizk.rs",
    "hostname": "sms.rizk.rs"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "695043197c2fbfda85abc1d4",
      "name": "Palantir Ad Maven tracking under various names | Espionage  Malware &Botnet associated",
      "description": "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel.com/psonstrentie.info/adnium.com/rsz.sk/aivalabs.com/dep-x.com/dmpxs.com/fraudjs.io/c3metrics.com/consumable.com/graphenedigitalanalytics.in/antifraudjs.friends2follow.com/fanplayr.com/mystighty.info/prometheusintelligencetechnology.com/fuel451.com/quitzon.net/islay.tech/vcmedia.vn/xcvgdf.party/ero-advertising.com/opolen.com.br/carts.guru/libertystmedia.com/provers.pro/bashirian.biz/mobials.com/guoshipartners.com/adabra.com/online-metrix.net/rollick.io/admicro.vn/maxmind.com/boudja.com/ppcprotect.com/just",
      "modified": "2025-12-27T20:35:37.012000",
      "created": "2025-12-27T20:35:37.012000",
      "tags": [
        "Palantir",
        "Ad- Maven",
        "Prometheus Intelligence Technology"
      ],
      "references": [
        "https://ad-maven.com/appcast.io/leadlander.com/affasi.com/clixtell.com/adgainersolutions.com/franecki.net/pixanalytics.com/wrethicap.info/ismatlab.com/y-track.com/ecsanalytics.com/albacross.com/bgclck.me/lptracker.io/ze-fir.com/eyereturn.com/bitmedia.io/azetklik.sk/fuelx.com/pixlee.com/hilltopads.net/reichelcormier.bid/mmapiws.com/betssonpalantir.com/b0e8.com/breaktime.com.tw/clearlink.com/sendpulse.com/pulpix.com/c3tag.com/ligatus.com/clickyab.com/buckridge.link/clickguard.com/bluecava.com/attributionmodel",
        "Everyone I attempt to pulse Palantir Ad-Maven it\u2019s immediately deleted from Pulse"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Carts.Guru",
          "display_name": "Carts.Guru",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Education",
        "Civil Society"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 82,
        "hostname": 180,
        "URL": 995,
        "FileHash-SHA256": 110
      },
      "indicator_count": 1367,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "114 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d91b1a8f414040bfba430",
      "name": "Spyware",
      "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
      "modified": "2025-08-20T00:01:59.498000",
      "created": "2025-07-21T01:02:41.049000",
      "tags": [
        "serving ip",
        "address",
        "status",
        "utc na",
        "utc google",
        "utc facebook",
        "custom audience",
        "tag manager",
        "ua748443502",
        "utc gtmwrp73mt",
        "utc gsrdlm5jnx1",
        "utc aw937838002",
        "adsense na",
        "connect",
        "file type",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "powershell",
        "b file",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "c0002 wininet",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cndigicert sha2",
        "secure server",
        "ca odigicert",
        "inc cus",
        "subject",
        "cnwe1 ogoogle",
        "trust",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft",
        "get http",
        "request",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "response",
        "united",
        "search",
        "creation date",
        "expiration date",
        "name servers",
        "unknown soa",
        "germany unknown",
        "entries",
        "pulse submit",
        "url analysis",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 304,
        "hostname": 796,
        "URL": 2590,
        "FileHash-SHA256": 2735,
        "FileHash-MD5": 253,
        "FileHash-SHA1": 144,
        "email": 1
      },
      "indicator_count": 6823,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://sms.rizk.rs/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://sms.rizk.rs/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776726402.8802667
}