{
  "type": "URL",
  "indicator": "https://workatgreatclips.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://workatgreatclips.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3183222966,
      "indicator": "https://workatgreatclips.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6891980740656e8b21b31d0a",
          "name": "Tracker | Mirai | Virtool | Tofsee | Phishing +",
          "description": "Tracker found in \u2018alleged \u2018 Jefferson County, Co website also a single link was found in a collection of phishing websites by a OTX researcher in 2023. \nI can\u2019t comment much. \n#overreach\n#https://reviewable.io/reviews/palantir/godel-conjure-plugin/549",
          "modified": "2025-09-04T05:03:13.563000",
          "created": "2025-08-05T05:35:03.786000",
          "tags": [
            "url https",
            "passive dns",
            "urls",
            "url add",
            "pulse pulses",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "date",
            "for privacy",
            "redacted for",
            "status",
            "hostname add",
            "pulse submit",
            "url analysis",
            "files",
            "united",
            "entries",
            "search",
            "unknown aaaa",
            "overview ip",
            "address",
            "location united",
            "asn as35916",
            "whois registrar",
            "showing",
            "next associated",
            "meta http",
            "content",
            "index",
            "th th",
            "443 ma2592000",
            "body",
            "ip address",
            "asn as54113",
            "name servers",
            "expiration date",
            "resources whois",
            "urlvoid",
            "related",
            "comments",
            "whois show",
            "present jun",
            "script urls",
            "enom",
            "record value",
            "certificate",
            "formbook cnc",
            "checkin",
            "neue",
            "ipv4",
            "exploit",
            "trojan",
            "virtool",
            "ransom",
            "win32",
            "ipv4 add",
            "unknown cname",
            "unknown ns",
            "script domains",
            "meta",
            "config",
            "associated urls",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "next http",
            "present may",
            "present oct",
            "present jul",
            "aaaa",
            "present sep",
            "domain",
            "creation date",
            "expiration",
            "url http",
            "present dec",
            "present jan",
            "reverse dns",
            "present mar",
            "present nov",
            "a domains",
            "verdict",
            "files ip",
            "next related",
            "domains show",
            "domain related",
            "cryp",
            "date hash",
            "avast avg",
            "entries related",
            "mtb may",
            "trojandropper",
            "lowfi",
            "gmt cache",
            "sameorigin",
            "files show",
            "none google",
            "safe browsing",
            "death",
            "indicator facts",
            "historical otx",
            "twitter running",
            "open ports",
            "memcommit",
            "medium",
            "read c",
            "post http",
            "delete",
            "windows nt",
            "malware",
            "copy",
            "write",
            "msie",
            "chrome",
            "backdoor",
            "junkpoly",
            "worm"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4488,
            "hostname": 1442,
            "domain": 746,
            "email": 6,
            "FileHash-SHA256": 1122,
            "FileHash-MD5": 345,
            "FileHash-SHA1": 337,
            "CVE": 2
          },
          "indicator_count": 8488,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "227 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a20ff8db3854e863dca324",
          "name": "Shared Modules | Hijacker | Masquerading",
          "description": "",
          "modified": "2024-02-12T04:01:56.040000",
          "created": "2024-01-13T04:22:16.961000",
          "tags": [
            "filehashmd5",
            "no expiration",
            "iocs",
            "next",
            "scan endpoints",
            "all octoseek",
            "create new",
            "pulse use",
            "pdf report",
            "pcap",
            "filehashsha1",
            "filehashsha256",
            "ipv4",
            "hostname",
            "expiration",
            "domain",
            "url https",
            "url http",
            "source",
            "stix",
            "email",
            "email abuse",
            "goreasonlimited",
            "cc no",
            "tompc",
            "sum35",
            "domain xn",
            "searchbox0",
            "domainname0",
            "view",
            "apple",
            "apple id",
            "hijacking",
            "masquerading",
            "exploit",
            "cams",
            "monitoring",
            "loki bot",
            "dns",
            "open ports",
            "malvertizing",
            "malware hosting",
            "apple script",
            "js user",
            "dga",
            "dga domains",
            "malware",
            "multiple_versions",
            "wagersta",
            "decode",
            "system information discovery",
            "decrypt",
            "evasion",
            "defense evasion",
            "emotet",
            "android",
            "ios",
            "wannacry",
            "trojan",
            "worm",
            "cyber threat",
            "benjamin",
            "whois record",
            "ssl certificate",
            "contacted",
            "historical ssl",
            "referrer",
            "contacted urls",
            "execution",
            "whois whois",
            "whois sslcert",
            "and china",
            "drop",
            "uchealth",
            "university of cincinnati health"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1444",
              "name": "Masquerade as Legitimate Application",
              "display_name": "T1444 - Masquerade as Legitimate Application"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1546.015",
              "name": "Component Object Model Hijacking",
              "display_name": "T1546.015 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2701,
            "FileHash-SHA1": 2296,
            "FileHash-SHA256": 3362,
            "URL": 6191,
            "domain": 2033,
            "hostname": 3097,
            "email": 37,
            "CVE": 2
          },
          "indicator_count": 19719,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "797 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 28389
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/workatgreatclips.com",
    "whois": "http://whois.domaintools.com/workatgreatclips.com",
    "domain": "workatgreatclips.com",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6891980740656e8b21b31d0a",
      "name": "Tracker | Mirai | Virtool | Tofsee | Phishing +",
      "description": "Tracker found in \u2018alleged \u2018 Jefferson County, Co website also a single link was found in a collection of phishing websites by a OTX researcher in 2023. \nI can\u2019t comment much. \n#overreach\n#https://reviewable.io/reviews/palantir/godel-conjure-plugin/549",
      "modified": "2025-09-04T05:03:13.563000",
      "created": "2025-08-05T05:35:03.786000",
      "tags": [
        "url https",
        "passive dns",
        "urls",
        "url add",
        "pulse pulses",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "date",
        "for privacy",
        "redacted for",
        "status",
        "hostname add",
        "pulse submit",
        "url analysis",
        "files",
        "united",
        "entries",
        "search",
        "unknown aaaa",
        "overview ip",
        "address",
        "location united",
        "asn as35916",
        "whois registrar",
        "showing",
        "next associated",
        "meta http",
        "content",
        "index",
        "th th",
        "443 ma2592000",
        "body",
        "ip address",
        "asn as54113",
        "name servers",
        "expiration date",
        "resources whois",
        "urlvoid",
        "related",
        "comments",
        "whois show",
        "present jun",
        "script urls",
        "enom",
        "record value",
        "certificate",
        "formbook cnc",
        "checkin",
        "neue",
        "ipv4",
        "exploit",
        "trojan",
        "virtool",
        "ransom",
        "win32",
        "ipv4 add",
        "unknown cname",
        "unknown ns",
        "script domains",
        "meta",
        "config",
        "associated urls",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "next http",
        "present may",
        "present oct",
        "present jul",
        "aaaa",
        "present sep",
        "domain",
        "creation date",
        "expiration",
        "url http",
        "present dec",
        "present jan",
        "reverse dns",
        "present mar",
        "present nov",
        "a domains",
        "verdict",
        "files ip",
        "next related",
        "domains show",
        "domain related",
        "cryp",
        "date hash",
        "avast avg",
        "entries related",
        "mtb may",
        "trojandropper",
        "lowfi",
        "gmt cache",
        "sameorigin",
        "files show",
        "none google",
        "safe browsing",
        "death",
        "indicator facts",
        "historical otx",
        "twitter running",
        "open ports",
        "memcommit",
        "medium",
        "read c",
        "post http",
        "delete",
        "windows nt",
        "malware",
        "copy",
        "write",
        "msie",
        "chrome",
        "backdoor",
        "junkpoly",
        "worm"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4488,
        "hostname": 1442,
        "domain": 746,
        "email": 6,
        "FileHash-SHA256": 1122,
        "FileHash-MD5": 345,
        "FileHash-SHA1": 337,
        "CVE": 2
      },
      "indicator_count": 8488,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "227 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a20ff8db3854e863dca324",
      "name": "Shared Modules | Hijacker | Masquerading",
      "description": "",
      "modified": "2024-02-12T04:01:56.040000",
      "created": "2024-01-13T04:22:16.961000",
      "tags": [
        "filehashmd5",
        "no expiration",
        "iocs",
        "next",
        "scan endpoints",
        "all octoseek",
        "create new",
        "pulse use",
        "pdf report",
        "pcap",
        "filehashsha1",
        "filehashsha256",
        "ipv4",
        "hostname",
        "expiration",
        "domain",
        "url https",
        "url http",
        "source",
        "stix",
        "email",
        "email abuse",
        "goreasonlimited",
        "cc no",
        "tompc",
        "sum35",
        "domain xn",
        "searchbox0",
        "domainname0",
        "view",
        "apple",
        "apple id",
        "hijacking",
        "masquerading",
        "exploit",
        "cams",
        "monitoring",
        "loki bot",
        "dns",
        "open ports",
        "malvertizing",
        "malware hosting",
        "apple script",
        "js user",
        "dga",
        "dga domains",
        "malware",
        "multiple_versions",
        "wagersta",
        "decode",
        "system information discovery",
        "decrypt",
        "evasion",
        "defense evasion",
        "emotet",
        "android",
        "ios",
        "wannacry",
        "trojan",
        "worm",
        "cyber threat",
        "benjamin",
        "whois record",
        "ssl certificate",
        "contacted",
        "historical ssl",
        "referrer",
        "contacted urls",
        "execution",
        "whois whois",
        "whois sslcert",
        "and china",
        "drop",
        "uchealth",
        "university of cincinnati health"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1444",
          "name": "Masquerade as Legitimate Application",
          "display_name": "T1444 - Masquerade as Legitimate Application"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1546.015",
          "name": "Component Object Model Hijacking",
          "display_name": "T1546.015 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2701,
        "FileHash-SHA1": 2296,
        "FileHash-SHA256": 3362,
        "URL": 6191,
        "domain": 2033,
        "hostname": 3097,
        "email": 37,
        "CVE": 2
      },
      "indicator_count": 19719,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "797 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://workatgreatclips.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://workatgreatclips.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629944.750689
}