{ "type": "URL", "indicator": "https://training.box.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://training.box.com", "type": "url", "type_title": "URL", "validation": [ { "source": "akamai", "message": "Akamai rank: #966", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain box.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain box.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4281621410, "indicator": "https://training.box.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "69d0d006e9c253ccedb3097c", "name": "VirusTotal report\n for il Archive_07.04.24 to 07.17.24_(greg.strong@dlxlaw.com).olm", "description": "The full text of the report on the Akama server, published on 1 July 2017, is below:.com, the site where the server was set up, and the address it is registered.>>>wrong last name.", "modified": "2026-04-04T08:47:02.305000", "created": "2026-04-04T08:47:02.305000", "tags": [ "present apr", "united", "asnone country", "aaaa", "as20940", "servers", "status", "whitelisted", "nxdomain", "date", "title", "mitre attack", "network info", "file type", "category", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "persistence", "malicious", "next", "zip archive", "sweet home", "design", "text text", "unicode text", "utf8 text", "crlf line", "generic ini", "json array", "settings", "first counter", "default", "inprocserver32", "inprochandler32", "mbisslshort", "bearer", "cname", "mwdb", "bazaar", "bridge", "info", "accept", "agent", "shutdown", "root", "sigma", "https", "windows folder", "office macro", "creates", "office outbound", "phishing", "connections", "performs dns", "algorithm", "full name", "number", "cus odigicert", "inc cndigicert", "ev rsa", "ca g2", "validity", "organization", "lsan francisco", "host name", "handle", "rdap database", "iana registrar", "dnssec", "yes conformance", "server", "domain status", "registrar abuse", "registrar", "domain name", "us registrant", "email", "contact email", "docusign", "docusign iam", "learn", "create", "javascript", "docusign online", "sign", "linkedin", "website", "company", "google search", "please click", "name", "create date", "domain", "expiry date", "query time", "update date", "mail", "google", "checker api", "pass", "dns complaint", "spf info", "search", "proofpoint", "stateprovince", "iana id", "creation date", "tech country", "graph summary", "abuse contact", "contact phone", "registrar iana" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/547b482b7dbac03718ef64a926b85be15ea0600156951b13d3ce4dabde20085f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291763&Signature=fEqFIERj%2BIC5oH27rZMlFofwvtRQzDydQkMRnl3XBEoujL32eJpmNN%2BCc1ZUvzt4OTCn%2BkYs1BA%2F08n1orzNW8qg847w83GC6Dbnn8ne5tXh0ogZ5K0KFGoEX3NQMJm3GXWrxY8P1SdQqjWZCbGz7k0XX%2FXtokCinqT3y1yUDpEgPLBENBLHAFZcdEdMbqNY3GnmYTvwQWKkS8OnIvlUQ0kvvV1%2FeLrnWjvnmwjkfzVIDlFUrC", "https://vtbehaviour.commondatastorage.googleapis.com/5fdb5bffef52d84d2621f8b5fc357a235db152b3cca4bd0eb848f8aba2f59574_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291886&Signature=Z5FzthSdmWyHzVdusmkNb3t%2FyzOYPBVYXbgWZWZX4xB8Z6YO%2BVZ0xZaCfg6yi0khANClXUFahw059%2FRPtPj0xBun8ajIUBenpC%2BRLA9VXB55MTyba4tUZIx%2FSRqmIU76lcYaKn9P2pENN1SuQSX7aYS3wNBYE0SiXje50LlXcsHsbJGx7tHn0S2N%2B9owuxwXdB3OXTcKCSQjueZAAXEkToTOB68XT%2FWCYXR6kzuuVXlui0Rv", "https://vtbehaviour.commondatastorage.googleapis.com/5fdb5bffef52d84d2621f8b5fc357a235db152b3cca4bd0eb848f8aba2f59574_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291972&Signature=2wy9WDPgs10KQsFdLBDHbDDkVU7oKbsyJkWcXdhk3AKHzPw9RcJ3MvuDz5rIj2v%2FspTagJZ8VKH4Ao3M%2FtLPyjXSC3J%2BjbhcdpUAlWS7HM%2BhCLcrP3m720SxHuZ09dcFiLc9Xl9%2BPQTG99hd2%2FF1IdivIHH%2Bj2OjvAJelVaXWcowwtWj3VJo5%2B%2FwwObLgnSYbuZL7y0Td1dl80iFDZ6a1Y39UV%2F3pqDj%2BSgcal6%2BtXL5U7", "https://www.google.com/search?client=ms-google-coop&q=%22docusign.com%22&cx=003414466004237966221:dgg7iftvryo", "https://www.google.com/search?client=ms-google-coop&q=%22mxb-00567a01.gslb.pphosted.com%22&cx=003414466004237966221:dgg7iftvryo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 61, "FileHash-MD5": 328, "FileHash-SHA1": 71, "FileHash-SHA256": 374, "IPv6": 56, "domain": 35, "email": 5, "hostname": 201, "URL": 197 }, "indicator_count": 1328, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "15 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c35be945887205276dbd94", "name": "VirusTotal report for il Archive_07.04.24 to 07.17.24_", "description": "", "modified": "2026-03-25T04:54:52.187000", "created": "2026-03-25T03:52:09.410000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 1, "URL": 63, "domain": 5, "email": 1, "hostname": 19 }, "indicator_count": 95, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c35bb5fd49c45b2d1ac87c", "name": "VirusTotal report", "description": "", "modified": "2026-03-25T04:38:39.568000", "created": "2026-03-25T03:51:17.278000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 185, "FileHash-SHA1": 198, "FileHash-SHA256": 991, "URL": 301, "domain": 26, "email": 5, "hostname": 105, "IPv4": 6 }, "indicator_count": 1817, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://www.google.com/search?client=ms-google-coop&q=%22docusign.com%22&cx=003414466004237966221:dgg7iftvryo", "https://vtbehaviour.commondatastorage.googleapis.com/5fdb5bffef52d84d2621f8b5fc357a235db152b3cca4bd0eb848f8aba2f59574_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291886&Signature=Z5FzthSdmWyHzVdusmkNb3t%2FyzOYPBVYXbgWZWZX4xB8Z6YO%2BVZ0xZaCfg6yi0khANClXUFahw059%2FRPtPj0xBun8ajIUBenpC%2BRLA9VXB55MTyba4tUZIx%2FSRqmIU76lcYaKn9P2pENN1SuQSX7aYS3wNBYE0SiXje50LlXcsHsbJGx7tHn0S2N%2B9owuxwXdB3OXTcKCSQjueZAAXEkToTOB68XT%2FWCYXR6kzuuVXlui0Rv", "https://www.google.com/search?client=ms-google-coop&q=%22mxb-00567a01.gslb.pphosted.com%22&cx=003414466004237966221:dgg7iftvryo", "https://vtbehaviour.commondatastorage.googleapis.com/547b482b7dbac03718ef64a926b85be15ea0600156951b13d3ce4dabde20085f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291763&Signature=fEqFIERj%2BIC5oH27rZMlFofwvtRQzDydQkMRnl3XBEoujL32eJpmNN%2BCc1ZUvzt4OTCn%2BkYs1BA%2F08n1orzNW8qg847w83GC6Dbnn8ne5tXh0ogZ5K0KFGoEX3NQMJm3GXWrxY8P1SdQqjWZCbGz7k0XX%2FXtokCinqT3y1yUDpEgPLBENBLHAFZcdEdMbqNY3GnmYTvwQWKkS8OnIvlUQ0kvvV1%2FeLrnWjvnmwjkfzVIDlFUrC", "https://vtbehaviour.commondatastorage.googleapis.com/5fdb5bffef52d84d2621f8b5fc357a235db152b3cca4bd0eb848f8aba2f59574_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291972&Signature=2wy9WDPgs10KQsFdLBDHbDDkVU7oKbsyJkWcXdhk3AKHzPw9RcJ3MvuDz5rIj2v%2FspTagJZ8VKH4Ao3M%2FtLPyjXSC3J%2BjbhcdpUAlWS7HM%2BhCLcrP3m720SxHuZ09dcFiLc9Xl9%2BPQTG99hd2%2FF1IdivIHH%2Bj2OjvAJelVaXWcowwtWj3VJo5%2B%2FwwObLgnSYbuZL7y0Td1dl80iFDZ6a1Y39UV%2F3pqDj%2BSgcal6%2BtXL5U7" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 2081 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/box.com", "whois": "http://whois.domaintools.com/box.com", "domain": "box.com", "hostname": "training.box.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "69d0d006e9c253ccedb3097c", "name": "VirusTotal report\n for il Archive_07.04.24 to 07.17.24_(greg.strong@dlxlaw.com).olm", "description": "The full text of the report on the Akama server, published on 1 July 2017, is below:.com, the site where the server was set up, and the address it is registered.>>>wrong last name.", "modified": "2026-04-04T08:47:02.305000", "created": "2026-04-04T08:47:02.305000", "tags": [ "present apr", "united", "asnone country", "aaaa", "as20940", "servers", "status", "whitelisted", "nxdomain", "date", "title", "mitre attack", "network info", "file type", "category", "overview", "dropped info", "processes extra", "overview zenbox", "linux verdict", "guest system", "persistence", "malicious", "next", "zip archive", "sweet home", "design", "text text", "unicode text", "utf8 text", "crlf line", "generic ini", "json array", "settings", "first counter", "default", "inprocserver32", "inprochandler32", "mbisslshort", "bearer", "cname", "mwdb", "bazaar", "bridge", "info", "accept", "agent", "shutdown", "root", "sigma", "https", "windows folder", "office macro", "creates", "office outbound", "phishing", "connections", "performs dns", "algorithm", "full name", "number", "cus odigicert", "inc cndigicert", "ev rsa", "ca g2", "validity", "organization", "lsan francisco", "host name", "handle", "rdap database", "iana registrar", "dnssec", "yes conformance", "server", "domain status", "registrar abuse", "registrar", "domain name", "us registrant", "email", "contact email", "docusign", "docusign iam", "learn", "create", "javascript", "docusign online", "sign", "linkedin", "website", "company", "google search", "please click", "name", "create date", "domain", "expiry date", "query time", "update date", "mail", "google", "checker api", "pass", "dns complaint", "spf info", "search", "proofpoint", "stateprovince", "iana id", "creation date", "tech country", "graph summary", "abuse contact", "contact phone", "registrar iana" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/547b482b7dbac03718ef64a926b85be15ea0600156951b13d3ce4dabde20085f_Zenbox%20Linux.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291763&Signature=fEqFIERj%2BIC5oH27rZMlFofwvtRQzDydQkMRnl3XBEoujL32eJpmNN%2BCc1ZUvzt4OTCn%2BkYs1BA%2F08n1orzNW8qg847w83GC6Dbnn8ne5tXh0ogZ5K0KFGoEX3NQMJm3GXWrxY8P1SdQqjWZCbGz7k0XX%2FXtokCinqT3y1yUDpEgPLBENBLHAFZcdEdMbqNY3GnmYTvwQWKkS8OnIvlUQ0kvvV1%2FeLrnWjvnmwjkfzVIDlFUrC", "https://vtbehaviour.commondatastorage.googleapis.com/5fdb5bffef52d84d2621f8b5fc357a235db152b3cca4bd0eb848f8aba2f59574_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291886&Signature=Z5FzthSdmWyHzVdusmkNb3t%2FyzOYPBVYXbgWZWZX4xB8Z6YO%2BVZ0xZaCfg6yi0khANClXUFahw059%2FRPtPj0xBun8ajIUBenpC%2BRLA9VXB55MTyba4tUZIx%2FSRqmIU76lcYaKn9P2pENN1SuQSX7aYS3wNBYE0SiXje50LlXcsHsbJGx7tHn0S2N%2B9owuxwXdB3OXTcKCSQjueZAAXEkToTOB68XT%2FWCYXR6kzuuVXlui0Rv", "https://vtbehaviour.commondatastorage.googleapis.com/5fdb5bffef52d84d2621f8b5fc357a235db152b3cca4bd0eb848f8aba2f59574_Zenbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1775291972&Signature=2wy9WDPgs10KQsFdLBDHbDDkVU7oKbsyJkWcXdhk3AKHzPw9RcJ3MvuDz5rIj2v%2FspTagJZ8VKH4Ao3M%2FtLPyjXSC3J%2BjbhcdpUAlWS7HM%2BhCLcrP3m720SxHuZ09dcFiLc9Xl9%2BPQTG99hd2%2FF1IdivIHH%2Bj2OjvAJelVaXWcowwtWj3VJo5%2B%2FwwObLgnSYbuZL7y0Td1dl80iFDZ6a1Y39UV%2F3pqDj%2BSgcal6%2BtXL5U7", "https://www.google.com/search?client=ms-google-coop&q=%22docusign.com%22&cx=003414466004237966221:dgg7iftvryo", "https://www.google.com/search?client=ms-google-coop&q=%22mxb-00567a01.gslb.pphosted.com%22&cx=003414466004237966221:dgg7iftvryo" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1036", "name": "Masquerading", "display_name": "T1036 - Masquerading" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1083", "name": "File and Directory Discovery", "display_name": "T1083 - File and Directory Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1543", "name": "Create or Modify System Process", "display_name": "T1543 - Create or Modify System Process" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "IPv4": 61, "FileHash-MD5": 328, "FileHash-SHA1": 71, "FileHash-SHA256": 374, "IPv6": 56, "domain": 35, "email": 5, "hostname": 201, "URL": 197 }, "indicator_count": 1328, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "15 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c35be945887205276dbd94", "name": "VirusTotal report for il Archive_07.04.24 to 07.17.24_", "description": "", "modified": "2026-03-25T04:54:52.187000", "created": "2026-03-25T03:52:09.410000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 2, "FileHash-SHA1": 4, "FileHash-SHA256": 1, "URL": 63, "domain": 5, "email": 1, "hostname": 19 }, "indicator_count": 95, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69c35bb5fd49c45b2d1ac87c", "name": "VirusTotal report", "description": "", "modified": "2026-03-25T04:38:39.568000", "created": "2026-03-25T03:51:17.278000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 185, "FileHash-SHA1": 198, "FileHash-SHA256": 991, "URL": 301, "domain": 26, "email": 5, "hostname": 105, "IPv4": 6 }, "indicator_count": 1817, "is_author": false, "is_subscribing": null, "subscriber_count": 48, "modified_text": "25 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://training.box.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://training.box.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776629517.4446359 }