{
  "type": "URL",
  "indicator": "https://verticle.io/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://verticle.io/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4113472262,
      "indicator": "https://verticle.io/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68923ea4efbf58b7ba48acec",
          "name": "Hosted App",
          "description": "",
          "modified": "2025-09-04T16:03:17.037000",
          "created": "2025-08-05T17:25:56.454000",
          "tags": [
            "issuer wr3",
            "log id",
            "gmtn",
            "abn timestamp",
            "ad180b80",
            "full name",
            "extensionsstr",
            "web server",
            "ca issuers",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "mitre att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "ascii text",
            "pattern match",
            "show technique",
            "date",
            "format",
            "august",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "flag",
            "usa windows",
            "hwp support",
            "march",
            "december",
            "united",
            "markmonitor",
            "overview dns",
            "requests domain",
            "country",
            "contacted hosts",
            "ip address",
            "process details",
            "t1179 hooking",
            "access windows",
            "installs",
            "control att",
            "found",
            "development att",
            "name server",
            "show process",
            "programfiles",
            "command decode",
            "suricata ipv4",
            "ck matrix",
            "comspec",
            "model",
            "general",
            "dynamicloader",
            "unknown",
            "as16509",
            "whitelisted",
            "medium",
            "write c",
            "as15169",
            "search",
            "high",
            "write",
            "android",
            "malware",
            "copy",
            "next",
            "formbook cnc",
            "checkin",
            "entries",
            "passive dns",
            "next associated",
            "site",
            "neue",
            "ipv4",
            "pulse pulses",
            "exploit",
            "trojan",
            "virtool",
            "body",
            "refer",
            "present dec",
            "epub",
            "present jan",
            "present nov",
            "present oct",
            "showing",
            "urls show",
            "win32",
            "win64",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "prefetch8",
            "localappdata",
            "prefetch1"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3409,
            "hostname": 4127,
            "URL": 8408,
            "SSLCertFingerprint": 9,
            "FileHash-SHA256": 1175,
            "FileHash-MD5": 144,
            "FileHash-SHA1": 134,
            "CVE": 2
          },
          "indicator_count": 17408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6891bf5f58c1ae303f6d313e",
          "name": "Jeeng | Powerbox | Tracking | Mirai \u2022 Palantir plugin",
          "description": "#ELF:Mirai-ALC\\ [Trj]\n* [https://d1-myadmin.dpdlocal.co.uk/login]\n\u2022 [cf20ed53-cb6d-4dfd-a4e8-794fbe163efc.pcap]\nAlfper:BrowserModifier:Win32/DeepSync.C\n#prometheus #trojan #malware #elf #mirai dpd #palantir # plugin #tracking #monitoring #call #tracker #spyware #worm #virus #election_ news",
          "modified": "2025-09-04T08:05:56.240000",
          "created": "2025-08-05T08:22:55.113000",
          "tags": [
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "url http",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "iocs",
            "learn more",
            "filehashsha256",
            "types",
            "indicators show",
            "search",
            "present jul",
            "present jun",
            "present may",
            "present aug",
            "present apr",
            "present mar",
            "present feb",
            "united",
            "unknown aaaa",
            "all ipv4",
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "location united",
            "america flag",
            "america asn",
            "open",
            "registrar",
            "limited ta",
            "com laude",
            "nomiq",
            "creation date",
            "ip address",
            "date",
            "domain",
            "hostname",
            "files ip",
            "address",
            "asn as21342",
            "scan",
            "ipv4",
            "pulses",
            "servers",
            "hostname add",
            "pulse submit",
            "url analysis",
            "verdict",
            "france unknown",
            "name servers",
            "present",
            "whois show",
            "record value",
            "domain name",
            "expiration date",
            "status",
            "domain add",
            "filehashmd5",
            "idhttp",
            "tidcustomhttp",
            "classes",
            "medium",
            "crlf line",
            "show",
            "registry",
            "service",
            "copy",
            "patch",
            "write",
            "next",
            "markus",
            "delphi",
            "win32",
            "persistence",
            "execution",
            "http",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "refresh57959",
            "windows xp",
            "pack",
            "shows",
            "cc08",
            "f06a6b",
            "pulses hostname",
            "germany unknown",
            "aaaa",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "ssl certificate",
            "spawns",
            "development att",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "ascii text",
            "pattern match",
            "mitre att",
            "show technique",
            "format",
            "august",
            "hybrid",
            "local",
            "path",
            "click",
            "strings",
            "filehashsha1",
            "palantir feb",
            "difference feb"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3809,
            "hostname": 1197,
            "domain": 456,
            "FileHash-MD5": 170,
            "FileHash-SHA256": 579,
            "FileHash-SHA1": 161,
            "CVE": 1,
            "email": 1,
            "SSLCertFingerprint": 6
          },
          "indicator_count": 6380,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6891980740656e8b21b31d0a",
          "name": "Tracker | Mirai | Virtool | Tofsee | Phishing +",
          "description": "Tracker found in \u2018alleged \u2018 Jefferson County, Co website also a single link was found in a collection of phishing websites by a OTX researcher in 2023. \nI can\u2019t comment much. \n#overreach\n#https://reviewable.io/reviews/palantir/godel-conjure-plugin/549",
          "modified": "2025-09-04T05:03:13.563000",
          "created": "2025-08-05T05:35:03.786000",
          "tags": [
            "url https",
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "date",
            "for privacy",
            "redacted for",
            "status",
            "hostname add",
            "pulse submit",
            "url analysis",
            "files",
            "united",
            "entries",
            "search",
            "unknown aaaa",
            "overview ip",
            "address",
            "location united",
            "asn as35916",
            "whois registrar",
            "showing",
            "next associated",
            "meta http",
            "content",
            "index",
            "th th",
            "443 ma2592000",
            "body",
            "ip address",
            "asn as54113",
            "name servers",
            "expiration date",
            "resources whois",
            "urlvoid",
            "related",
            "comments",
            "whois show",
            "present jun",
            "script urls",
            "enom",
            "record value",
            "certificate",
            "formbook cnc",
            "checkin",
            "neue",
            "ipv4",
            "exploit",
            "trojan",
            "virtool",
            "ransom",
            "win32",
            "ipv4 add",
            "unknown cname",
            "unknown ns",
            "script domains",
            "meta",
            "config",
            "associated urls",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next http",
            "present may",
            "present oct",
            "present jul",
            "aaaa",
            "present sep",
            "domain",
            "creation date",
            "expiration",
            "url http",
            "present dec",
            "present jan",
            "reverse dns",
            "present mar",
            "present nov",
            "a domains",
            "verdict",
            "files ip",
            "next related",
            "domains show",
            "domain related",
            "cryp",
            "date hash",
            "avast avg",
            "entries related",
            "mtb may",
            "trojandropper",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "files show",
            "none google",
            "safe browsing",
            "death",
            "indicator facts",
            "historical otx",
            "twitter running",
            "open ports",
            "memcommit",
            "medium",
            "read c",
            "post http",
            "delete",
            "windows nt",
            "malware",
            "copy",
            "write",
            "msie",
            "chrome",
            "backdoor",
            "junkpoly",
            "worm"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4488,
            "hostname": 1442,
            "domain": 746,
            "email": 6,
            "FileHash-SHA256": 1122,
            "FileHash-MD5": 345,
            "FileHash-SHA1": 337,
            "CVE": 2
          },
          "indicator_count": 8488,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68919fdceabd582b8502932b",
          "name": "Reviewable.io w/ Palantir plugin - Malicious IoC\u2019s",
          "description": "",
          "modified": "2025-09-04T05:03:13.563000",
          "created": "2025-08-05T06:08:28.757000",
          "tags": [
            "united",
            "formbook cnc",
            "checkin",
            "entries",
            "passive dns",
            "next associated",
            "neue",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "exploit",
            "trojan",
            "virtool",
            "body",
            "files",
            "ip address",
            "location united",
            "asn as54113",
            "less whois",
            "registrar",
            "gandi sas",
            "creation date",
            "pulses",
            "present aug",
            "unknown ns",
            "search",
            "showing",
            "record value",
            "domain id",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "win64",
            "certificate",
            "error",
            "present showing",
            "next http",
            "scans show",
            "france unknown",
            "name servers",
            "date",
            "hostname",
            "pulse submit",
            "url analysis",
            "dynamicloader",
            "show",
            "vwu codeoverlap",
            "yara detections",
            "medium",
            "delete",
            "default",
            "copy",
            "write",
            "dupzom",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 366,
            "domain": 161,
            "hostname": 253,
            "FileHash-MD5": 204,
            "FileHash-SHA1": 201,
            "FileHash-SHA256": 328,
            "CVE": 2
          },
          "indicator_count": 1515,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 31364
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/verticle.io",
    "whois": "http://whois.domaintools.com/verticle.io",
    "domain": "verticle.io",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68923ea4efbf58b7ba48acec",
      "name": "Hosted App",
      "description": "",
      "modified": "2025-09-04T16:03:17.037000",
      "created": "2025-08-05T17:25:56.454000",
      "tags": [
        "issuer wr3",
        "log id",
        "gmtn",
        "abn timestamp",
        "ad180b80",
        "full name",
        "extensionsstr",
        "web server",
        "ca issuers",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "mitre att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "ascii text",
        "pattern match",
        "show technique",
        "date",
        "format",
        "august",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "flag",
        "usa windows",
        "hwp support",
        "march",
        "december",
        "united",
        "markmonitor",
        "overview dns",
        "requests domain",
        "country",
        "contacted hosts",
        "ip address",
        "process details",
        "t1179 hooking",
        "access windows",
        "installs",
        "control att",
        "found",
        "development att",
        "name server",
        "show process",
        "programfiles",
        "command decode",
        "suricata ipv4",
        "ck matrix",
        "comspec",
        "model",
        "general",
        "dynamicloader",
        "unknown",
        "as16509",
        "whitelisted",
        "medium",
        "write c",
        "as15169",
        "search",
        "high",
        "write",
        "android",
        "malware",
        "copy",
        "next",
        "formbook cnc",
        "checkin",
        "entries",
        "passive dns",
        "next associated",
        "site",
        "neue",
        "ipv4",
        "pulse pulses",
        "exploit",
        "trojan",
        "virtool",
        "body",
        "refer",
        "present dec",
        "epub",
        "present jan",
        "present nov",
        "present oct",
        "showing",
        "urls show",
        "win32",
        "win64",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "prefetch8",
        "localappdata",
        "prefetch1"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1043",
          "name": "Commonly Used Port",
          "display_name": "T1043 - Commonly Used Port"
        },
        {
          "id": "T1179",
          "name": "Hooking",
          "display_name": "T1179 - Hooking"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3409,
        "hostname": 4127,
        "URL": 8408,
        "SSLCertFingerprint": 9,
        "FileHash-SHA256": 1175,
        "FileHash-MD5": 144,
        "FileHash-SHA1": 134,
        "CVE": 2
      },
      "indicator_count": 17408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6891bf5f58c1ae303f6d313e",
      "name": "Jeeng | Powerbox | Tracking | Mirai \u2022 Palantir plugin",
      "description": "#ELF:Mirai-ALC\\ [Trj]\n* [https://d1-myadmin.dpdlocal.co.uk/login]\n\u2022 [cf20ed53-cb6d-4dfd-a4e8-794fbe163efc.pcap]\nAlfper:BrowserModifier:Win32/DeepSync.C\n#prometheus #trojan #malware #elf #mirai dpd #palantir # plugin #tracking #monitoring #call #tracker #spyware #worm #virus #election_ news",
      "modified": "2025-09-04T08:05:56.240000",
      "created": "2025-08-05T08:22:55.113000",
      "tags": [
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "entries",
        "url http",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "iocs",
        "learn more",
        "filehashsha256",
        "types",
        "indicators show",
        "search",
        "present jul",
        "present jun",
        "present may",
        "present aug",
        "present apr",
        "present mar",
        "present feb",
        "united",
        "unknown aaaa",
        "all ipv4",
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "location united",
        "america flag",
        "america asn",
        "open",
        "registrar",
        "limited ta",
        "com laude",
        "nomiq",
        "creation date",
        "ip address",
        "date",
        "domain",
        "hostname",
        "files ip",
        "address",
        "asn as21342",
        "scan",
        "ipv4",
        "pulses",
        "servers",
        "hostname add",
        "pulse submit",
        "url analysis",
        "verdict",
        "france unknown",
        "name servers",
        "present",
        "whois show",
        "record value",
        "domain name",
        "expiration date",
        "status",
        "domain add",
        "filehashmd5",
        "idhttp",
        "tidcustomhttp",
        "classes",
        "medium",
        "crlf line",
        "show",
        "registry",
        "service",
        "copy",
        "patch",
        "write",
        "next",
        "markus",
        "delphi",
        "win32",
        "persistence",
        "execution",
        "http",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "refresh57959",
        "windows xp",
        "pack",
        "shows",
        "cc08",
        "f06a6b",
        "pulses hostname",
        "germany unknown",
        "aaaa",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "ssl certificate",
        "spawns",
        "development att",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "ascii text",
        "pattern match",
        "mitre att",
        "show technique",
        "format",
        "august",
        "hybrid",
        "local",
        "path",
        "click",
        "strings",
        "filehashsha1",
        "palantir feb",
        "difference feb"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3809,
        "hostname": 1197,
        "domain": 456,
        "FileHash-MD5": 170,
        "FileHash-SHA256": 579,
        "FileHash-SHA1": 161,
        "CVE": 1,
        "email": 1,
        "SSLCertFingerprint": 6
      },
      "indicator_count": 6380,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6891980740656e8b21b31d0a",
      "name": "Tracker | Mirai | Virtool | Tofsee | Phishing +",
      "description": "Tracker found in \u2018alleged \u2018 Jefferson County, Co website also a single link was found in a collection of phishing websites by a OTX researcher in 2023. \nI can\u2019t comment much. \n#overreach\n#https://reviewable.io/reviews/palantir/godel-conjure-plugin/549",
      "modified": "2025-09-04T05:03:13.563000",
      "created": "2025-08-05T05:35:03.786000",
      "tags": [
        "url https",
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "date",
        "for privacy",
        "redacted for",
        "status",
        "hostname add",
        "pulse submit",
        "url analysis",
        "files",
        "united",
        "entries",
        "search",
        "unknown aaaa",
        "overview ip",
        "address",
        "location united",
        "asn as35916",
        "whois registrar",
        "showing",
        "next associated",
        "meta http",
        "content",
        "index",
        "th th",
        "443 ma2592000",
        "body",
        "ip address",
        "asn as54113",
        "name servers",
        "expiration date",
        "resources whois",
        "urlvoid",
        "related",
        "comments",
        "whois show",
        "present jun",
        "script urls",
        "enom",
        "record value",
        "certificate",
        "formbook cnc",
        "checkin",
        "neue",
        "ipv4",
        "exploit",
        "trojan",
        "virtool",
        "ransom",
        "win32",
        "ipv4 add",
        "unknown cname",
        "unknown ns",
        "script domains",
        "meta",
        "config",
        "associated urls",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next http",
        "present may",
        "present oct",
        "present jul",
        "aaaa",
        "present sep",
        "domain",
        "creation date",
        "expiration",
        "url http",
        "present dec",
        "present jan",
        "reverse dns",
        "present mar",
        "present nov",
        "a domains",
        "verdict",
        "files ip",
        "next related",
        "domains show",
        "domain related",
        "cryp",
        "date hash",
        "avast avg",
        "entries related",
        "mtb may",
        "trojandropper",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "files show",
        "none google",
        "safe browsing",
        "death",
        "indicator facts",
        "historical otx",
        "twitter running",
        "open ports",
        "memcommit",
        "medium",
        "read c",
        "post http",
        "delete",
        "windows nt",
        "malware",
        "copy",
        "write",
        "msie",
        "chrome",
        "backdoor",
        "junkpoly",
        "worm"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4488,
        "hostname": 1442,
        "domain": 746,
        "email": 6,
        "FileHash-SHA256": 1122,
        "FileHash-MD5": 345,
        "FileHash-SHA1": 337,
        "CVE": 2
      },
      "indicator_count": 8488,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68919fdceabd582b8502932b",
      "name": "Reviewable.io w/ Palantir plugin - Malicious IoC\u2019s",
      "description": "",
      "modified": "2025-09-04T05:03:13.563000",
      "created": "2025-08-05T06:08:28.757000",
      "tags": [
        "united",
        "formbook cnc",
        "checkin",
        "entries",
        "passive dns",
        "next associated",
        "neue",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "exploit",
        "trojan",
        "virtool",
        "body",
        "files",
        "ip address",
        "location united",
        "asn as54113",
        "less whois",
        "registrar",
        "gandi sas",
        "creation date",
        "pulses",
        "present aug",
        "unknown ns",
        "search",
        "showing",
        "record value",
        "domain id",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "win64",
        "certificate",
        "error",
        "present showing",
        "next http",
        "scans show",
        "france unknown",
        "name servers",
        "date",
        "hostname",
        "pulse submit",
        "url analysis",
        "dynamicloader",
        "show",
        "vwu codeoverlap",
        "yara detections",
        "medium",
        "delete",
        "default",
        "copy",
        "write",
        "dupzom",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 366,
        "domain": 161,
        "hostname": 253,
        "FileHash-MD5": 204,
        "FileHash-SHA1": 201,
        "FileHash-SHA256": 328,
        "CVE": 2
      },
      "indicator_count": 1515,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://verticle.io/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://verticle.io/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776640553.743347
}