{
  "type": "URL",
  "indicator": "https://tr.p2pname.org",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://tr.p2pname.org",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3783837604,
      "indicator": "https://tr.p2pname.org",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "66d86e0d76778bf1bcb47e5d",
          "name": "AS140227 enriched",
          "description": "",
          "modified": "2025-06-07T15:40:37.476000",
          "created": "2024-09-04T14:26:21.356000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/g883116b41ba0417e98c7d99988fd2464797fb1fe54054692a35fe49c03255297"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 15,
            "FileHash-SHA1": 15,
            "FileHash-SHA256": 1331,
            "domain": 4165,
            "hostname": 3720,
            "URL": 11188,
            "CVE": 1
          },
          "indicator_count": 20435,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 181,
          "modified_text": "316 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d8d8d8238606c85e7a3979",
          "name": "AS200019 alexhost srl",
          "description": "",
          "modified": "2025-06-07T15:39:05.533000",
          "created": "2024-09-04T22:02:00.596000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/gf011ff2560014743857f4dc25899d89d7afb2779d5ae47a28a60412eb0de8f07"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1193,
            "hostname": 1141,
            "URL": 3301,
            "FileHash-SHA256": 626,
            "CVE": 3
          },
          "indicator_count": 6264,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 178,
          "modified_text": "316 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "66d6341755ef38f09a7c453e",
          "name": "AS51852 private layer inc (enriched)",
          "description": "",
          "modified": "2025-06-04T04:47:01.941000",
          "created": "2024-09-02T21:54:31.775000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/graph/gfb1be34080154f81b3668eb5767e7b3c859b449582674e94be05c63c9487e8cb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 9,
            "FileHash-SHA1": 5,
            "FileHash-SHA256": 321,
            "URL": 951,
            "domain": 522,
            "hostname": 265
          },
          "indicator_count": 2073,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 177,
          "modified_text": "319 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bbca54daebb7d2084f350d",
          "name": "Phishing HSBC (identity theft) -  Hijack Execution Flow",
          "description": "Hijack Execution Flow: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
          "modified": "2024-03-02T16:00:27.416000",
          "created": "2024-02-01T16:44:04.317000",
          "tags": [
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist http",
            "hsbc group",
            "phishtank http",
            "phishing hsbc",
            "traffic",
            "tor exit",
            "exit",
            "node tcp",
            "et tor",
            "known tor",
            "tor known",
            "http spammer",
            "node",
            "spammer",
            "malicious",
            "malware",
            "team",
            "download",
            "http response",
            "final url",
            "xamzexpires600",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers",
            "algorithm",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "llc registry",
            "expiry date",
            "date",
            "dns replication",
            "basic",
            "pe32 executable",
            "ms windows",
            "intel",
            "win32 dynamic",
            "link library",
            "os2 executable",
            "clipper dos",
            "executable",
            "pe32",
            "win16 ne",
            "pe32 installer",
            "mitre"
          ],
          "references": [
            "http://www.tripphouse.com/th_ext.php",
            "www.tripphouse.com",
            "https://attack.mitre.org/techniques/T1574/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Phishing HSBC",
              "display_name": "Phishing HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2190,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 775,
            "URL": 2229,
            "domain": 545,
            "hostname": 723,
            "CVE": 1,
            "email": 2
          },
          "indicator_count": 6709,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658b9e86f7a149333882bfb9",
          "name": "Hijacking | Typosquatting | Masquerading Shared Modules",
          "description": "*Shared Modules\t\nExecution\nAdversaries may execute malicious payloads via loading shared modules.\n\n*Masquerading\t\nDefense Evasion\nAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.\n\nComponent Object Model Hijacking\t\nPersistence\nPrivilege Escalation\nAdversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.\nPulse: http://ww1.thecoolzipextractorapp.com/\nFound in: https://www.hallrender.com/attorney/brian-sabey/",
          "modified": "2024-01-26T01:05:54.754000",
          "created": "2023-12-27T03:48:22.319000",
          "tags": [
            "threat",
            "feeds ioc",
            "new ioc",
            "teams api",
            "contact",
            "maltiverse",
            "dinkle threat",
            "paste",
            "iocs",
            "analyze",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "communicating",
            "whois whois",
            "siblings parent",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12134,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 3982,
            "hostname": 2878,
            "domain": 2159,
            "CVE": 1
          },
          "indicator_count": 21357,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "658ca3f53717bb3a25e96065",
          "name": "Hijacking | Typosquatting | Masquerading Shared Modules | http://ww1.thecoolzipextractorapp.com/ via https://www.hallrender.com/attorney/brian-sabey/",
          "description": "",
          "modified": "2024-01-26T01:05:54.754000",
          "created": "2023-12-27T22:23:49.562000",
          "tags": [
            "threat",
            "feeds ioc",
            "new ioc",
            "teams api",
            "contact",
            "maltiverse",
            "dinkle threat",
            "paste",
            "iocs",
            "analyze",
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "historical ssl",
            "communicating",
            "whois whois",
            "siblings parent",
            "execution"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "658b9e86f7a149333882bfb9",
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12134,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 101,
            "FileHash-SHA256": 3982,
            "hostname": 2878,
            "domain": 2159,
            "CVE": 1
          },
          "indicator_count": 21357,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "814 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655950034e6ae4650a6b02ce",
          "name": "Python Initiated Connection | Spyware |  Remote Attacks  |  | Part 4",
          "description": "Apple, Mac, iOS, phishing, frauds services, malware, trojan.allesgreh/trojan.allesgreh/respat, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and possibly others. Python Initiated Connection, WScriptShell_Case_Anomaly.\nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
          "modified": "2023-12-18T23:03:18.732000",
          "created": "2023-11-19T00:00:03.258000",
          "tags": [
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "contenttype",
            "phpsessid",
            "cisco umbrella",
            "alexa top",
            "million",
            "safe site",
            "site",
            "whois record",
            "ssl certificate",
            "execution",
            "dropped",
            "whois whois",
            "historical ssl",
            "copy",
            "tsara brashears",
            "communicating",
            "referrer",
            "cobalt strike",
            "hacktool",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "relic",
            "monitoring",
            "installer",
            "android",
            "agent tesla",
            "et",
            "october",
            "contacted",
            "threat roundup",
            "january",
            "cyberstalking",
            "attack",
            "icmp",
            "banker",
            "keylogger",
            "google llc",
            "gc abuse",
            "orgid",
            "direct",
            "whois lookup",
            "netrange",
            "nethandle",
            "net34",
            "net340000",
            "googl2",
            "comment",
            "gc",
            "dns replication",
            "date",
            "domain",
            "win32 exe",
            "driver pro",
            "files",
            "detections type",
            "name",
            "optimizer pro",
            "javascript",
            "text",
            "text ip",
            "aacr",
            "type name",
            "email",
            "email delivery",
            "email fwd",
            "delivery status",
            "notification",
            "name verdict",
            "runtime process",
            "sha1",
            "size",
            "localappdata",
            "temp",
            "prefetch8",
            "unicode text",
            "type data",
            "programfiles",
            "win64",
            "hybrid",
            "click",
            "strings",
            "youth",
            "pe resource",
            "apple private",
            "data collection",
            "hidden privacy",
            "threats https",
            "legal",
            "amazon aws",
            "wife happy",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "magic pe32",
            "intel",
            "ms windows",
            "trid windows",
            "os2 executable",
            "compiler",
            "delphi",
            "sections",
            "md5 code",
            "data",
            "children",
            "file size",
            "dropped files",
            "google update",
            "setup sha256",
            "kb file"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "GC",
              "display_name": "GC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12901,
            "hostname": 4445,
            "domain": 3685,
            "FileHash-MD5": 197,
            "FileHash-SHA256": 5136,
            "FileHash-SHA1": 170,
            "CIDR": 1,
            "email": 2,
            "CVE": 4
          },
          "indicator_count": 26541,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "853 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655aef8a8cc2e0929f2aa5ea",
          "name": "Python Initiated Connection | Spyware | Remote Attacks |",
          "description": "",
          "modified": "2023-12-18T23:03:18.732000",
          "created": "2023-11-20T05:32:58.400000",
          "tags": [
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "contenttype",
            "phpsessid",
            "cisco umbrella",
            "alexa top",
            "million",
            "safe site",
            "site",
            "whois record",
            "ssl certificate",
            "execution",
            "dropped",
            "whois whois",
            "historical ssl",
            "copy",
            "tsara brashears",
            "communicating",
            "referrer",
            "cobalt strike",
            "hacktool",
            "emotet",
            "download",
            "malware",
            "malicious",
            "critical",
            "relic",
            "monitoring",
            "installer",
            "android",
            "agent tesla",
            "et",
            "october",
            "contacted",
            "threat roundup",
            "january",
            "cyberstalking",
            "attack",
            "icmp",
            "banker",
            "keylogger",
            "google llc",
            "gc abuse",
            "orgid",
            "direct",
            "whois lookup",
            "netrange",
            "nethandle",
            "net34",
            "net340000",
            "googl2",
            "comment",
            "gc",
            "dns replication",
            "date",
            "domain",
            "win32 exe",
            "driver pro",
            "files",
            "detections type",
            "name",
            "optimizer pro",
            "javascript",
            "text",
            "text ip",
            "aacr",
            "type name",
            "email",
            "email delivery",
            "email fwd",
            "delivery status",
            "notification",
            "name verdict",
            "runtime process",
            "sha1",
            "size",
            "localappdata",
            "temp",
            "prefetch8",
            "unicode text",
            "type data",
            "programfiles",
            "win64",
            "hybrid",
            "click",
            "strings",
            "youth",
            "pe resource",
            "apple private",
            "data collection",
            "hidden privacy",
            "threats https",
            "legal",
            "amazon aws",
            "wife happy",
            "vhash",
            "authentihash",
            "ssdeep",
            "file type",
            "magic pe32",
            "intel",
            "ms windows",
            "trid windows",
            "os2 executable",
            "compiler",
            "delphi",
            "sections",
            "md5 code",
            "data",
            "children",
            "file size",
            "dropped files",
            "google update",
            "setup sha256",
            "kb file"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "GC",
              "display_name": "GC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655950034e6ae4650a6b02ce",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12901,
            "hostname": 4445,
            "domain": 3685,
            "FileHash-MD5": 197,
            "FileHash-SHA256": 5136,
            "FileHash-SHA1": 170,
            "CIDR": 1,
            "email": 2,
            "CVE": 4
          },
          "indicator_count": 26541,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "853 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/graph/gfb1be34080154f81b3668eb5767e7b3c859b449582674e94be05c63c9487e8cb",
        "https://attack.mitre.org/techniques/T1574/",
        "www.tripphouse.com",
        "http://www.tripphouse.com/th_ext.php",
        "https://www.virustotal.com/graph/g883116b41ba0417e98c7d99988fd2464797fb1fe54054692a35fe49c03255297",
        "https://www.virustotal.com/graph/gf011ff2560014743857f4dc25899d89d7afb2779d5ae47a28a60412eb0de8f07"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Phishing hsbc",
            "Et",
            "Gc"
          ],
          "industries": [],
          "unique_indicators": 81331
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/p2pname.org",
    "whois": "http://whois.domaintools.com/p2pname.org",
    "domain": "p2pname.org",
    "hostname": "tr.p2pname.org"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "66d86e0d76778bf1bcb47e5d",
      "name": "AS140227 enriched",
      "description": "",
      "modified": "2025-06-07T15:40:37.476000",
      "created": "2024-09-04T14:26:21.356000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/g883116b41ba0417e98c7d99988fd2464797fb1fe54054692a35fe49c03255297"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 15,
        "FileHash-SHA1": 15,
        "FileHash-SHA256": 1331,
        "domain": 4165,
        "hostname": 3720,
        "URL": 11188,
        "CVE": 1
      },
      "indicator_count": 20435,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 181,
      "modified_text": "316 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d8d8d8238606c85e7a3979",
      "name": "AS200019 alexhost srl",
      "description": "",
      "modified": "2025-06-07T15:39:05.533000",
      "created": "2024-09-04T22:02:00.596000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/gf011ff2560014743857f4dc25899d89d7afb2779d5ae47a28a60412eb0de8f07"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1193,
        "hostname": 1141,
        "URL": 3301,
        "FileHash-SHA256": 626,
        "CVE": 3
      },
      "indicator_count": 6264,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 178,
      "modified_text": "316 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "66d6341755ef38f09a7c453e",
      "name": "AS51852 private layer inc (enriched)",
      "description": "",
      "modified": "2025-06-04T04:47:01.941000",
      "created": "2024-09-02T21:54:31.775000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/graph/gfb1be34080154f81b3668eb5767e7b3c859b449582674e94be05c63c9487e8cb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 9,
        "FileHash-SHA1": 5,
        "FileHash-SHA256": 321,
        "URL": 951,
        "domain": 522,
        "hostname": 265
      },
      "indicator_count": 2073,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 177,
      "modified_text": "319 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bbca54daebb7d2084f350d",
      "name": "Phishing HSBC (identity theft) -  Hijack Execution Flow",
      "description": "Hijack Execution Flow: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
      "modified": "2024-03-02T16:00:27.416000",
      "created": "2024-02-01T16:44:04.317000",
      "tags": [
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist http",
        "hsbc group",
        "phishtank http",
        "phishing hsbc",
        "traffic",
        "tor exit",
        "exit",
        "node tcp",
        "et tor",
        "known tor",
        "tor known",
        "http spammer",
        "node",
        "spammer",
        "malicious",
        "malware",
        "team",
        "download",
        "http response",
        "final url",
        "xamzexpires600",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers",
        "algorithm",
        "v3 serial",
        "number",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "first",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "llc registry",
        "expiry date",
        "date",
        "dns replication",
        "basic",
        "pe32 executable",
        "ms windows",
        "intel",
        "win32 dynamic",
        "link library",
        "os2 executable",
        "clipper dos",
        "executable",
        "pe32",
        "win16 ne",
        "pe32 installer",
        "mitre"
      ],
      "references": [
        "http://www.tripphouse.com/th_ext.php",
        "www.tripphouse.com",
        "https://attack.mitre.org/techniques/T1574/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Phishing HSBC",
          "display_name": "Phishing HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2190,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 775,
        "URL": 2229,
        "domain": 545,
        "hostname": 723,
        "CVE": 1,
        "email": 2
      },
      "indicator_count": 6709,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "778 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658b9e86f7a149333882bfb9",
      "name": "Hijacking | Typosquatting | Masquerading Shared Modules",
      "description": "*Shared Modules\t\nExecution\nAdversaries may execute malicious payloads via loading shared modules.\n\n*Masquerading\t\nDefense Evasion\nAdversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.\n\nComponent Object Model Hijacking\t\nPersistence\nPrivilege Escalation\nAdversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.\nPulse: http://ww1.thecoolzipextractorapp.com/\nFound in: https://www.hallrender.com/attorney/brian-sabey/",
      "modified": "2024-01-26T01:05:54.754000",
      "created": "2023-12-27T03:48:22.319000",
      "tags": [
        "threat",
        "feeds ioc",
        "new ioc",
        "teams api",
        "contact",
        "maltiverse",
        "dinkle threat",
        "paste",
        "iocs",
        "analyze",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "communicating",
        "whois whois",
        "siblings parent",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12134,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 3982,
        "hostname": 2878,
        "domain": 2159,
        "CVE": 1
      },
      "indicator_count": 21357,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "814 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "658ca3f53717bb3a25e96065",
      "name": "Hijacking | Typosquatting | Masquerading Shared Modules | http://ww1.thecoolzipextractorapp.com/ via https://www.hallrender.com/attorney/brian-sabey/",
      "description": "",
      "modified": "2024-01-26T01:05:54.754000",
      "created": "2023-12-27T22:23:49.562000",
      "tags": [
        "threat",
        "feeds ioc",
        "new ioc",
        "teams api",
        "contact",
        "maltiverse",
        "dinkle threat",
        "paste",
        "iocs",
        "analyze",
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "historical ssl",
        "communicating",
        "whois whois",
        "siblings parent",
        "execution"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "658b9e86f7a149333882bfb9",
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12134,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 101,
        "FileHash-SHA256": 3982,
        "hostname": 2878,
        "domain": 2159,
        "CVE": 1
      },
      "indicator_count": 21357,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "814 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655950034e6ae4650a6b02ce",
      "name": "Python Initiated Connection | Spyware |  Remote Attacks  |  | Part 4",
      "description": "Apple, Mac, iOS, phishing, frauds services, malware, trojan.allesgreh/trojan.allesgreh/respat, spyware, Google abuse, used to obsessively spy and stalk SA victim Tsara Brashears and possibly others. Python Initiated Connection, WScriptShell_Case_Anomaly.\nPulse: http://secure-appleid-com-uh2hdgo2m7pjuusohde19c8tqs.sssa79.com/\n[Concerning Pre populated content: A security alert has been sent to a secure Apple account in the US, but what exactly is it and what does it mean? and how did it end up in this post-mortem?\u2190((threat?))Let me tell you a]",
      "modified": "2023-12-18T23:03:18.732000",
      "created": "2023-11-19T00:00:03.258000",
      "tags": [
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "contenttype",
        "phpsessid",
        "cisco umbrella",
        "alexa top",
        "million",
        "safe site",
        "site",
        "whois record",
        "ssl certificate",
        "execution",
        "dropped",
        "whois whois",
        "historical ssl",
        "copy",
        "tsara brashears",
        "communicating",
        "referrer",
        "cobalt strike",
        "hacktool",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "relic",
        "monitoring",
        "installer",
        "android",
        "agent tesla",
        "et",
        "october",
        "contacted",
        "threat roundup",
        "january",
        "cyberstalking",
        "attack",
        "icmp",
        "banker",
        "keylogger",
        "google llc",
        "gc abuse",
        "orgid",
        "direct",
        "whois lookup",
        "netrange",
        "nethandle",
        "net34",
        "net340000",
        "googl2",
        "comment",
        "gc",
        "dns replication",
        "date",
        "domain",
        "win32 exe",
        "driver pro",
        "files",
        "detections type",
        "name",
        "optimizer pro",
        "javascript",
        "text",
        "text ip",
        "aacr",
        "type name",
        "email",
        "email delivery",
        "email fwd",
        "delivery status",
        "notification",
        "name verdict",
        "runtime process",
        "sha1",
        "size",
        "localappdata",
        "temp",
        "prefetch8",
        "unicode text",
        "type data",
        "programfiles",
        "win64",
        "hybrid",
        "click",
        "strings",
        "youth",
        "pe resource",
        "apple private",
        "data collection",
        "hidden privacy",
        "threats https",
        "legal",
        "amazon aws",
        "wife happy",
        "vhash",
        "authentihash",
        "ssdeep",
        "file type",
        "magic pe32",
        "intel",
        "ms windows",
        "trid windows",
        "os2 executable",
        "compiler",
        "delphi",
        "sections",
        "md5 code",
        "data",
        "children",
        "file size",
        "dropped files",
        "google update",
        "setup sha256",
        "kb file"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "GC",
          "display_name": "GC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12901,
        "hostname": 4445,
        "domain": 3685,
        "FileHash-MD5": 197,
        "FileHash-SHA256": 5136,
        "FileHash-SHA1": 170,
        "CIDR": 1,
        "email": 2,
        "CVE": 4
      },
      "indicator_count": 26541,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "853 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655aef8a8cc2e0929f2aa5ea",
      "name": "Python Initiated Connection | Spyware | Remote Attacks |",
      "description": "",
      "modified": "2023-12-18T23:03:18.732000",
      "created": "2023-11-20T05:32:58.400000",
      "tags": [
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "contenttype",
        "phpsessid",
        "cisco umbrella",
        "alexa top",
        "million",
        "safe site",
        "site",
        "whois record",
        "ssl certificate",
        "execution",
        "dropped",
        "whois whois",
        "historical ssl",
        "copy",
        "tsara brashears",
        "communicating",
        "referrer",
        "cobalt strike",
        "hacktool",
        "emotet",
        "download",
        "malware",
        "malicious",
        "critical",
        "relic",
        "monitoring",
        "installer",
        "android",
        "agent tesla",
        "et",
        "october",
        "contacted",
        "threat roundup",
        "january",
        "cyberstalking",
        "attack",
        "icmp",
        "banker",
        "keylogger",
        "google llc",
        "gc abuse",
        "orgid",
        "direct",
        "whois lookup",
        "netrange",
        "nethandle",
        "net34",
        "net340000",
        "googl2",
        "comment",
        "gc",
        "dns replication",
        "date",
        "domain",
        "win32 exe",
        "driver pro",
        "files",
        "detections type",
        "name",
        "optimizer pro",
        "javascript",
        "text",
        "text ip",
        "aacr",
        "type name",
        "email",
        "email delivery",
        "email fwd",
        "delivery status",
        "notification",
        "name verdict",
        "runtime process",
        "sha1",
        "size",
        "localappdata",
        "temp",
        "prefetch8",
        "unicode text",
        "type data",
        "programfiles",
        "win64",
        "hybrid",
        "click",
        "strings",
        "youth",
        "pe resource",
        "apple private",
        "data collection",
        "hidden privacy",
        "threats https",
        "legal",
        "amazon aws",
        "wife happy",
        "vhash",
        "authentihash",
        "ssdeep",
        "file type",
        "magic pe32",
        "intel",
        "ms windows",
        "trid windows",
        "os2 executable",
        "compiler",
        "delphi",
        "sections",
        "md5 code",
        "data",
        "children",
        "file size",
        "dropped files",
        "google update",
        "setup sha256",
        "kb file"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "GC",
          "display_name": "GC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655950034e6ae4650a6b02ce",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12901,
        "hostname": 4445,
        "domain": 3685,
        "FileHash-MD5": 197,
        "FileHash-SHA256": 5136,
        "FileHash-SHA1": 170,
        "CIDR": 1,
        "email": 2,
        "CVE": 4
      },
      "indicator_count": 26541,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "853 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://tr.p2pname.org",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://tr.p2pname.org",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641713.3534188
}