{
  "type": "URL",
  "indicator": "https://www-sidify-com.webpkgcache.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www-sidify-com.webpkgcache.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4110706367,
      "indicator": "https://www-sidify-com.webpkgcache.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "688e401a6f5537232c6fc6ca",
          "name": "Different view of iWin",
          "description": "Residuals and different view of Pulse [https://otx.alienvault.com/pulse/688e31b80edd775fe5d2f34f] Does OTX Pulse:\nMitre: T1055.015 ListPlanting Defense Evasion Privilege Escalation Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.\n\nTarget & Cousin scammed?",
          "modified": "2025-09-01T16:02:12.221000",
          "created": "2025-08-02T16:43:06.981000",
          "tags": [
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "sha1",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "mitre att",
            "show technique",
            "ck matrix",
            "ascii text",
            "date",
            "august",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "body",
            "layer network",
            "as46606",
            "us note",
            "route",
            "ptr record",
            "windows nt",
            "apache",
            "span",
            "pragma",
            "meta",
            "footer",
            "google",
            "us seen",
            "general info",
            "geo united",
            "as15169",
            "t1045",
            "packing",
            "t1060",
            "run keys",
            "startup",
            "folder",
            "t1119",
            "t1057",
            "discovery",
            "t1071",
            "showing",
            "entries",
            "present jul",
            "error jul",
            "present showing",
            "next http",
            "scans record",
            "value",
            "body html",
            "head title",
            "title head",
            "accept",
            "ip address",
            "location united",
            "asn as46606",
            "whois registrar",
            "creation date",
            "pulses",
            "related tags",
            "indicator",
            "response ip",
            "address google",
            "safe browsing",
            "title",
            "head",
            "search",
            "passive dns",
            "urls",
            "record value",
            "emails",
            "error",
            "meta http",
            "content",
            "gmt server",
            "content type",
            "script urls",
            "script script",
            "service",
            "code",
            "filehashmd5",
            "filehashsha1",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "ipv4",
            "url http",
            "indicator role",
            "title added",
            "active related",
            "pulses ipv4",
            "ccus asnas15169",
            "role"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 145,
            "FileHash-SHA1": 149,
            "FileHash-SHA256": 494,
            "SSLCertFingerprint": 3,
            "URL": 319,
            "domain": 63,
            "hostname": 228,
            "CIDR": 3,
            "email": 4
          },
          "indicator_count": 1408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688e31b80edd775fe5d2f34f",
          "name": "Social Engineering led to -#Lowfi:HSTR:Win32/iWin.B",
          "description": "Likely: Phone referral led to an in person meeting, financial transaction, telephone numbers exchange, website click, in home service call. The alternative is compromised target was redirected to malicious host or service provider became compromised by targeted persons issue.\nThere are several targeted people. This person is closely associated with a target.(idk -malicious)\nMitre: T1055.015\tListPlanting\t\nDefense Evasion\nPrivilege Escalation\nAdversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.",
          "modified": "2025-09-01T15:02:58.791000",
          "created": "2025-08-02T15:41:44.319000",
          "tags": [
            "united",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "gmt server",
            "gmt content",
            "certificate",
            "apache",
            "encrypt",
            "gmt path",
            "set cookie",
            "httponly",
            "passive dns",
            "urls",
            "address",
            "meta",
            "dynamicloader",
            "write c",
            "medium",
            "tlsv1",
            "show",
            "entries",
            "high",
            "http",
            "copy",
            "upatre",
            "write",
            "unknown",
            "asn15169",
            "google",
            "asn46606",
            "unifiedlayeras1",
            "frankfurt",
            "main",
            "germany",
            "google safe",
            "browsing",
            "script urls",
            "a domains",
            "libs",
            "monstroid2",
            "link",
            "accept encoding",
            "script domains",
            "title",
            "vary",
            "jquery",
            "pulse pulses",
            "hostname xn",
            "files domain",
            "showing",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "present jul",
            "for privacy",
            "roboto",
            "delete",
            "trojan",
            "globalc",
            "mozilla",
            "guard",
            "malware",
            "iwin",
            "local",
            "lowfi",
            "helper",
            "nsisdl",
            "executable",
            "amazon s3",
            "pe exe",
            "dll windows",
            "http yara",
            "alerts",
            "meta http",
            "content",
            "pragma",
            "content type",
            "body",
            "service",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "defense evasion",
            "spawns",
            "found",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "windows nt",
            "mitre att",
            "ascii text",
            "show technique",
            "path",
            "span",
            "click",
            "august",
            "hybrid",
            "general",
            "strings",
            "footer",
            "ck matrix"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 460,
            "hostname": 744,
            "URL": 3496,
            "email": 4,
            "domain": 394,
            "FileHash-SHA256": 2072,
            "FileHash-MD5": 464,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 7641,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "230 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 8267
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/webpkgcache.com",
    "whois": "http://whois.domaintools.com/webpkgcache.com",
    "domain": "webpkgcache.com",
    "hostname": "www-sidify-com.webpkgcache.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "688e401a6f5537232c6fc6ca",
      "name": "Different view of iWin",
      "description": "Residuals and different view of Pulse [https://otx.alienvault.com/pulse/688e31b80edd775fe5d2f34f] Does OTX Pulse:\nMitre: T1055.015 ListPlanting Defense Evasion Privilege Escalation Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.\n\nTarget & Cousin scammed?",
      "modified": "2025-09-01T16:02:12.221000",
      "created": "2025-08-02T16:43:06.981000",
      "tags": [
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "sha1",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "mitre att",
        "show technique",
        "ck matrix",
        "ascii text",
        "date",
        "august",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "body",
        "layer network",
        "as46606",
        "us note",
        "route",
        "ptr record",
        "windows nt",
        "apache",
        "span",
        "pragma",
        "meta",
        "footer",
        "google",
        "us seen",
        "general info",
        "geo united",
        "as15169",
        "t1045",
        "packing",
        "t1060",
        "run keys",
        "startup",
        "folder",
        "t1119",
        "t1057",
        "discovery",
        "t1071",
        "showing",
        "entries",
        "present jul",
        "error jul",
        "present showing",
        "next http",
        "scans record",
        "value",
        "body html",
        "head title",
        "title head",
        "accept",
        "ip address",
        "location united",
        "asn as46606",
        "whois registrar",
        "creation date",
        "pulses",
        "related tags",
        "indicator",
        "response ip",
        "address google",
        "safe browsing",
        "title",
        "head",
        "search",
        "passive dns",
        "urls",
        "record value",
        "emails",
        "error",
        "meta http",
        "content",
        "gmt server",
        "content type",
        "script urls",
        "script script",
        "service",
        "code",
        "filehashmd5",
        "filehashsha1",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "ipv4",
        "url http",
        "indicator role",
        "title added",
        "active related",
        "pulses ipv4",
        "ccus asnas15169",
        "role"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 145,
        "FileHash-SHA1": 149,
        "FileHash-SHA256": 494,
        "SSLCertFingerprint": 3,
        "URL": 319,
        "domain": 63,
        "hostname": 228,
        "CIDR": 3,
        "email": 4
      },
      "indicator_count": 1408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688e31b80edd775fe5d2f34f",
      "name": "Social Engineering led to -#Lowfi:HSTR:Win32/iWin.B",
      "description": "Likely: Phone referral led to an in person meeting, financial transaction, telephone numbers exchange, website click, in home service call. The alternative is compromised target was redirected to malicious host or service provider became compromised by targeted persons issue.\nThere are several targeted people. This person is closely associated with a target.(idk -malicious)\nMitre: T1055.015\tListPlanting\t\nDefense Evasion\nPrivilege Escalation\nAdversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.",
      "modified": "2025-09-01T15:02:58.791000",
      "created": "2025-08-02T15:41:44.319000",
      "tags": [
        "united",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "gmt server",
        "gmt content",
        "certificate",
        "apache",
        "encrypt",
        "gmt path",
        "set cookie",
        "httponly",
        "passive dns",
        "urls",
        "address",
        "meta",
        "dynamicloader",
        "write c",
        "medium",
        "tlsv1",
        "show",
        "entries",
        "high",
        "http",
        "copy",
        "upatre",
        "write",
        "unknown",
        "asn15169",
        "google",
        "asn46606",
        "unifiedlayeras1",
        "frankfurt",
        "main",
        "germany",
        "google safe",
        "browsing",
        "script urls",
        "a domains",
        "libs",
        "monstroid2",
        "link",
        "accept encoding",
        "script domains",
        "title",
        "vary",
        "jquery",
        "pulse pulses",
        "hostname xn",
        "files domain",
        "showing",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "present jul",
        "for privacy",
        "roboto",
        "delete",
        "trojan",
        "globalc",
        "mozilla",
        "guard",
        "malware",
        "iwin",
        "local",
        "lowfi",
        "helper",
        "nsisdl",
        "executable",
        "amazon s3",
        "pe exe",
        "dll windows",
        "http yara",
        "alerts",
        "meta http",
        "content",
        "pragma",
        "content type",
        "body",
        "service",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "defense evasion",
        "spawns",
        "found",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "windows nt",
        "mitre att",
        "ascii text",
        "show technique",
        "path",
        "span",
        "click",
        "august",
        "hybrid",
        "general",
        "strings",
        "footer",
        "ck matrix"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 460,
        "hostname": 744,
        "URL": 3496,
        "email": 4,
        "domain": 394,
        "FileHash-SHA256": 2072,
        "FileHash-MD5": 464,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 7641,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "230 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www-sidify-com.webpkgcache.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www-sidify-com.webpkgcache.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776631389.132439
}