{ "type": "URL", "indicator": "https://t.window.show", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://t.window.show", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3448111939, "indicator": "https://t.window.show", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 4, "pulses": [ { "id": "684b932fcbcc577471a28c8a", "name": "Imaging Center Malware, Virus other manipulations", "description": "IMO Serious! Virus, Trojans, potential cams? PHI , PII access. Super concerning potential manipulation , imaging, reports., records, billing\nis manipulated.\nMore research necessary.\nTrue potential for manipulation \nof x-ray , ct scan dosing.\nExcessive Adult content:\ncdn1-thumbs.pornhost.com | \ncdn28.eporncam.com | \t\ncdn35.thotporn.tv | \ncdnst7.pornburst.xxx | \nmcdns.vrporn.com |\nURL\nhttps://c845a1577e.mjedge.net/contents/videos_screenshots/3979000/3979719/preview.jpg&tbnid=rLNgRtn9SIlcgM&vet=10CAwQ1JoKKARqFwoTCIjlsv7v0Y0DFQAAAAAdAAAAABAH..i&imgrefurl=https:/it.vikiporn.com/videos/3979719/horror-porn-the-dark-side-of-the-woods/&docid=tVU1jbsRquWQLM&w=1920&h=1080&itg=1&q=horror porn&ved=0CAwQ1JoKKARqFwoTCIjlsv7v0Y0DFQAAAAAdAAAAABAH |\nhttps://cdn1-thumbs.pornhost.com/0/2/0235809321/001_150_112.jpg | \n\u2022 Den:Variant.Application.Bundler.Ludus.1\n\u2022 PUABundler:Win32/YandexBundled\n\u2022 Adware.Win32.DownWare.cl\n\u2022 pua:Win32/Catalina\n\u2022W32.AIDetectMalware\n* Why is my OTX account blocked from features", "modified": "2025-07-13T02:05:19.612000", "created": "2025-06-13T02:55:42.562000", "tags": [ "united", "asn16509", "amazon02", "frankfurt", "main", "germany", "asn60068", "cdn77 datacamp", "limited", "browsing", "reverse dns", "protocol h2", "security tls", "general full", "url https", "resource", "hash", "software", "dalles", "june", "de indicators", "domains", "hashes", "verified", "ecdsa", "linux x8664", "khtml", "gecko", "aes256gcm", "veryhigh", "patch", "accept", "encrypt", "cookie", "sticky", "aaaa", "cname", "ttl value", "algorithm", "key identifier", "v3 serial", "number", "cus olet", "encrypt cne5", "validity", "subject public", "key info", "key algorithm", "record type", "thumbprint" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 836, "hostname": 1001, "domain": 193, "URL": 3007, "FileHash-MD5": 83, "FileHash-SHA1": 42, "CIDR": 5 }, "indicator_count": 5167, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "280 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628437db120de2ab2ecb49fe", "name": "The \u201cconti leak page\u201d - likely conti", "description": "Conti leak page https://share.vx-underground.org/Conti/ is likely conti", "modified": "2022-06-16T00:01:26.112000", "created": "2022-05-18T00:03:39.947000", "tags": [ "woff2", "woff", "truetype", "gelionbold", "gelionsemibold", "gelionmedium", "gelionregular", "gelionlight", "gelionthin", "xe", "object", "error", "element", "typeof t", "browser", "ofunction", "typeof e", "typeof r", "tthis", "applepay", "date", "null", "accept", "license", "or conditions", "post", "array", "copyright", "apache license", "version", "this code", "is provided", "on an", "symbol", "typeerror", "iterator", "string", "facebook pixel", "pixel code", "facebook", "service", "phonenumber", "regexp", "function", "shadowsizzle", "domdata", "hexchars", "promise", "typeof n", "agent", "launcher", "this", "android", "class", "fail", "shift", "bind", "trident", "getclass", "body", "widget", "edge", "dataname", "intercom", "typeof symbol", "apple", "webkiti", "criosi", "javascript" ], "references": [ "xfe-URL-share.vx-underground.org_Conti-stix2-2.1-export.json", "https://app.uizard.io/p/c69fa2aa", "https://widget.intercom.io/widget/e1nqrt2k", "https://cdn.eu.pendo.io/agent/static/82b060a2-2cf8-472e-55d4-bd0833416335/pendo.js", "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.60", "xfe-URL-vx-underground.org_Conti_-stix2-2.1-export.json", "xfe-URL-uizard.io-stix2-2.1-export.json", "https://public.profitwell.com/js/profitwell.js?auth=80939adc88898a29e714f6dd3d25e8ba", "https://js.stripe.com/v3", "https://app.uizard.io/fonts.css?cache=2022-04-29-12-55-57", "xfe-URL-Js.stripe.net-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Xe", "display_name": "Xe", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 707, "URL": 3480, "FileHash-SHA256": 438, "domain": 458, "email": 2, "FileHash-MD5": 49 }, "indicator_count": 5134, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6280aa12040a569d19f6285f", "name": "possibly a central bank", "description": "Tobias Ahlin,", "modified": "2022-06-14T00:00:05.659000", "created": "2022-05-15T07:21:54.499000", "tags": [ "regexp", "typeof e", "function", "typeof t", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "reduceright", "number", "string", "l420", "g8m7ft2s1tv", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeerror", "symbol", "generator", "typeof n", "array", "promise", "weakmap", "typeof f", "natb", "409764", "animation", "suspense", "context", "forwardref", "deleted", "10252", "meta", "facebook", "unknown", "scroll", "backspace", "insert", "typeof symbol", "typeof c", "typeof s", "sprintf", "syntaxerror", "vhyj", "diefg", "bcdiefguxx", "constructor", "param", "rockn", "createclass", "source", "super", "infinity", "false", "contact", "internal", "phonenumber", "middle", "path", "redemption", "pass", "click", "cont", "albania", "armenia", "burma", "belarus", "cuba", "panama", "paraguay", "slovakia", "chad", "uruguay", "prop", "invert", "flip", "close", "small", "green", "union", "indonesia", "lucia", "martin", "mexico", "code", "apache", "blin", "slave", "gondi", "icelandic", "ganda", "zulu", "christmas", "burkina", "czech", "ukraine", "android", "format", "updater", "next", "hooks", "harmony", "trim", "python", "push", "shift", "slice", "shadowsizzle", "domdata", "hexchars", "agent", "launcher", "fail", "bind", "trident", "getclass", "body", "widget", "areasmodule", "duip", "hlwq", "fz5i", "dehu", "tbh0", "fwir", "x7am", "pcnd", "valr", "boolean", "portal", "partner", "ascio partner", "ascio", "tlds", "login en", "en de", "join today", "idns", "skip", "ascio domains", "tlds offered", "global whois", "checker", "helvetica neue", "arial", "d67a60", "inter", "baskerville", "15px", "180deg", "135deg", "video", "init", "wrap", "flip direction", "stop animation", "scale", "htmlelement", "hide", "typeof", "property", "fill", "noscroll", "matrix", "skew", "look", "julian garnier", "mit license", "typeof define", "typeof module", "htmlcollection", "255a", "qnull", "float32array", "nfunction", "tobias ahlin", "github", "spotify", "hyper island", "strong", "tobias", "read", "view", "ahlin bjerrome", "minecraft", "view project", "spinkit", "lookback", "ruby", "hello" ], "references": [ "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "https://tobiasahlin.com/js/app.js?v=1", "https://tobiasahlin.com/js/portfolio.js", "https://tobiasahlin.com/css/site.css", "https://ascio.com", "https://portal.ascio.com/login", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://js.hs-scripts.com/20704235.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "hostname": 1221, "domain": 2558, "FileHash-SHA256": 622, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1405 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://app.uizard.io/fonts.css?cache=2022-04-29-12-55-57", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/app.js?v=1", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "xfe-URL-Js.stripe.net-stix2-2.1-export.json", "https://ascio.com", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://tobiasahlin.com/js/portfolio.js", "https://cdn.eu.pendo.io/agent/static/82b060a2-2cf8-472e-55d4-bd0833416335/pendo.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "xfe-URL-lodash.com-stix2-2.1-export.json", "xfe-URL-uizard.io-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.60", "https://portal.ascio.com/login", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://app.uizard.io/p/c69fa2aa", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c", "xfe-URL-vx-underground.org_Conti_-stix2-2.1-export.json", "https://js.hs-scripts.com/20704235.js", "xfe-URL-share.vx-underground.org_Conti-stix2-2.1-export.json", "https://public.profitwell.com/js/profitwell.js?auth=80939adc88898a29e714f6dd3d25e8ba", "https://js.stripe.com/v3", "https://widget.intercom.io/widget/e1nqrt2k", "https://tobiasahlin.com/css/site.css" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Reduceright", "Xe" ], "industries": [], "unique_indicators": 17992 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/window.show", "whois": "http://whois.domaintools.com/window.show", "domain": "window.show", "hostname": "t.window.show" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 4, "pulses": [ { "id": "684b932fcbcc577471a28c8a", "name": "Imaging Center Malware, Virus other manipulations", "description": "IMO Serious! Virus, Trojans, potential cams? PHI , PII access. Super concerning potential manipulation , imaging, reports., records, billing\nis manipulated.\nMore research necessary.\nTrue potential for manipulation \nof x-ray , ct scan dosing.\nExcessive Adult content:\ncdn1-thumbs.pornhost.com | \ncdn28.eporncam.com | \t\ncdn35.thotporn.tv | \ncdnst7.pornburst.xxx | \nmcdns.vrporn.com |\nURL\nhttps://c845a1577e.mjedge.net/contents/videos_screenshots/3979000/3979719/preview.jpg&tbnid=rLNgRtn9SIlcgM&vet=10CAwQ1JoKKARqFwoTCIjlsv7v0Y0DFQAAAAAdAAAAABAH..i&imgrefurl=https:/it.vikiporn.com/videos/3979719/horror-porn-the-dark-side-of-the-woods/&docid=tVU1jbsRquWQLM&w=1920&h=1080&itg=1&q=horror porn&ved=0CAwQ1JoKKARqFwoTCIjlsv7v0Y0DFQAAAAAdAAAAABAH |\nhttps://cdn1-thumbs.pornhost.com/0/2/0235809321/001_150_112.jpg | \n\u2022 Den:Variant.Application.Bundler.Ludus.1\n\u2022 PUABundler:Win32/YandexBundled\n\u2022 Adware.Win32.DownWare.cl\n\u2022 pua:Win32/Catalina\n\u2022W32.AIDetectMalware\n* Why is my OTX account blocked from features", "modified": "2025-07-13T02:05:19.612000", "created": "2025-06-13T02:55:42.562000", "tags": [ "united", "asn16509", "amazon02", "frankfurt", "main", "germany", "asn60068", "cdn77 datacamp", "limited", "browsing", "reverse dns", "protocol h2", "security tls", "general full", "url https", "resource", "hash", "software", "dalles", "june", "de indicators", "domains", "hashes", "verified", "ecdsa", "linux x8664", "khtml", "gecko", "aes256gcm", "veryhigh", "patch", "accept", "encrypt", "cookie", "sticky", "aaaa", "cname", "ttl value", "algorithm", "key identifier", "v3 serial", "number", "cus olet", "encrypt cne5", "validity", "subject public", "key info", "key algorithm", "record type", "thumbprint" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 27, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 836, "hostname": 1001, "domain": 193, "URL": 3007, "FileHash-MD5": 83, "FileHash-SHA1": 42, "CIDR": 5 }, "indicator_count": 5167, "is_author": false, "is_subscribing": null, "subscriber_count": 137, "modified_text": "280 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708e2d7cb4228401888b63", "name": "possibly a central bank", "description": "", "modified": "2023-12-06T15:07:25.990000", "created": "2023-12-06T15:07:25.990000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 622, "domain": 2558, "URL": 4203, "hostname": 1221, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "628437db120de2ab2ecb49fe", "name": "The \u201cconti leak page\u201d - likely conti", "description": "Conti leak page https://share.vx-underground.org/Conti/ is likely conti", "modified": "2022-06-16T00:01:26.112000", "created": "2022-05-18T00:03:39.947000", "tags": [ "woff2", "woff", "truetype", "gelionbold", "gelionsemibold", "gelionmedium", "gelionregular", "gelionlight", "gelionthin", "xe", "object", "error", "element", "typeof t", "browser", "ofunction", "typeof e", "typeof r", "tthis", "applepay", "date", "null", "accept", "license", "or conditions", "post", "array", "copyright", "apache license", "version", "this code", "is provided", "on an", "symbol", "typeerror", "iterator", "string", "facebook pixel", "pixel code", "facebook", "service", "phonenumber", "regexp", "function", "shadowsizzle", "domdata", "hexchars", "promise", "typeof n", "agent", "launcher", "this", "android", "class", "fail", "shift", "bind", "trident", "getclass", "body", "widget", "edge", "dataname", "intercom", "typeof symbol", "apple", "webkiti", "criosi", "javascript" ], "references": [ "xfe-URL-share.vx-underground.org_Conti-stix2-2.1-export.json", "https://app.uizard.io/p/c69fa2aa", "https://widget.intercom.io/widget/e1nqrt2k", "https://cdn.eu.pendo.io/agent/static/82b060a2-2cf8-472e-55d4-bd0833416335/pendo.js", "https://connect.facebook.net/signals/plugins/identity.js?v=2.9.60", "xfe-URL-vx-underground.org_Conti_-stix2-2.1-export.json", "xfe-URL-uizard.io-stix2-2.1-export.json", "https://public.profitwell.com/js/profitwell.js?auth=80939adc88898a29e714f6dd3d25e8ba", "https://js.stripe.com/v3", "https://app.uizard.io/fonts.css?cache=2022-04-29-12-55-57", "xfe-URL-Js.stripe.net-stix2-2.1-export.json" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Xe", "display_name": "Xe", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 707, "URL": 3480, "FileHash-SHA256": 438, "domain": 458, "email": 2, "FileHash-MD5": 49 }, "indicator_count": 5134, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "1403 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6280aa12040a569d19f6285f", "name": "possibly a central bank", "description": "Tobias Ahlin,", "modified": "2022-06-14T00:00:05.659000", "created": "2022-05-15T07:21:54.499000", "tags": [ "regexp", "typeof e", "function", "typeof t", "width", "error", "object", "pseudo", "child", "form", "class", "null", "date", "this", "void", "accept", "reduceright", "number", "string", "l420", "g8m7ft2s1tv", "copyright", "json", "uint8array", "ssnull", "script", "closure library", "xdfunction", "adfunction", "typeerror", "symbol", "generator", "typeof n", "array", "promise", "weakmap", "typeof f", "natb", "409764", "animation", "suspense", "context", "forwardref", "deleted", "10252", "meta", "facebook", "unknown", "scroll", "backspace", "insert", "typeof symbol", "typeof c", "typeof s", "sprintf", "syntaxerror", "vhyj", "diefg", "bcdiefguxx", "constructor", "param", "rockn", "createclass", "source", "super", "infinity", "false", "contact", "internal", "phonenumber", "middle", "path", "redemption", "pass", "click", "cont", "albania", "armenia", "burma", "belarus", "cuba", "panama", "paraguay", "slovakia", "chad", "uruguay", "prop", "invert", "flip", "close", "small", "green", "union", "indonesia", "lucia", "martin", "mexico", "code", "apache", "blin", "slave", "gondi", "icelandic", "ganda", "zulu", "christmas", "burkina", "czech", "ukraine", "android", "format", "updater", "next", "hooks", "harmony", "trim", "python", "push", "shift", "slice", "shadowsizzle", "domdata", "hexchars", "agent", "launcher", "fail", "bind", "trident", "getclass", "body", "widget", "areasmodule", "duip", "hlwq", "fz5i", "dehu", "tbh0", "fwir", "x7am", "pcnd", "valr", "boolean", "portal", "partner", "ascio partner", "ascio", "tlds", "login en", "en de", "join today", "idns", "skip", "ascio domains", "tlds offered", "global whois", "checker", "helvetica neue", "arial", "d67a60", "inter", "baskerville", "15px", "180deg", "135deg", "video", "init", "wrap", "flip direction", "stop animation", "scale", "htmlelement", "hide", "typeof", "property", "fill", "noscroll", "matrix", "skew", "look", "julian garnier", "mit license", "typeof define", "typeof module", "htmlcollection", "255a", "qnull", "float32array", "nfunction", "tobias ahlin", "github", "spotify", "hyper island", "strong", "tobias", "read", "view", "ahlin bjerrome", "minecraft", "view project", "spinkit", "lookback", "ruby", "hello" ], "references": [ "xfe-URL-ascio.com-stix2-2.1-export.json", "https://tobiasahlin.com", "xfe-URL-tobiasahlin.com-stix2-2.1-export.json", "https://tobiasahlin.com/js/anime.min.js", "https://tobiasahlin.com/js/app.js?v=1", "https://tobiasahlin.com/js/portfolio.js", "https://tobiasahlin.com/css/site.css", "https://ascio.com", "https://portal.ascio.com/login", "https://static.zdassets.com/ekr/snippet.js?key=d814ea4a-a8eb-4a9c-aedd-cac0aa0e3551", "https://portal.ascio.com/7.602be6705ce7b901b821.js", "https://cdn.pendo.io/agent/static/783a696b-ddf4-4152-439e-f3761f54f088/pendo.js", "https://portal.ascio.com/runtime.48adad1e07e2679eb1f4.js", "https://js.hs-scripts.com/20704235.js", "https://www.ascio.com/wp-content/themes/Ascio/dist/js/front.js?ver=1648137806", "https://www.ascio.com/wp-includes/js/dist/i18n.min.js?ver=30fcecb428a0e8383d3776bcdd3a7834", "https://www.ascio.com/wp-includes/js/dist/hooks.min.js?ver=1e58c8c5a32b2e97491080c5b10dc71c", "https://www.ascio.com/wp-includes/js/dist/vendor/react-dom.min.js?ver=17.0.1", "https://www.ascio.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19", "xfe-URL-lodash.com-stix2-2.1-export.json", "https://www.ascio.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js?ver=0.13.9", "https://www.google-analytics.com/gtm/optimize.js?id=OPT-NVZ8RF3", "https://www.googletagmanager.com/gtag/js?id=G-8M7FT2S1TV&l=dataLayer&cx=c" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4203, "hostname": 1221, "domain": 2558, "FileHash-SHA256": 622, "CVE": 1 }, "indicator_count": 8605, "is_author": false, "is_subscribing": null, "subscriber_count": 73, "modified_text": "1405 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://t.window.show", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://t.window.show", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776639440.1768165 }