{ "type": "URL", "indicator": "https://www.adobe.com/go/ipmreaderepdf3_11_0Sign", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://www.adobe.com/go/ipmreaderepdf3_11_0Sign", "type": "url", "type_title": "URL", "validation": [ { "source": "alexa", "message": "Alexa rank: #40", "name": "Listed on Alexa" }, { "source": "akamai", "message": "Akamai rank: #305", "name": "Akamai Popular Domain" }, { "source": "whitelist", "message": "Whitelisted domain adobe.com", "name": "Whitelisted domain" }, { "source": "majestic", "message": "Whitelisted domain adobe.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 4268240034, "indicator": "https://www.adobe.com/go/ipmreaderepdf3_11_0Sign", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "69eb254f17eb4a2a990f07e5", "name": "LevelBlue - Open Threat Exchange", "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]", "modified": "2026-05-28T07:10:11.800000", "created": "2026-04-24T08:09:51.488000", "tags": [ "pdfkit", "cve202225765", "exploit script", "github", "unicordev", "cves", "xml external", "entity", "pdfs", "knowledge base", "python", "mozilla", "virustotal", "cisa", "apple", "microsoft", "pdfkit ruby", "remote code", "execution", "urls", "malware", "raid", "caddywiper", "wipes", "cve202543529", "webkit", "february", "cve202620643", "bypass", "march", "webkit bug", "command", "control", "levelblue", "open threat" ], "references": [ "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wipes", "display_name": "Wipes", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1084, "FileHash-SHA1": 874, "FileHash-SHA256": 3052, "CVE": 36, "domain": 437, "hostname": 1086, "URL": 1411, "CIDR": 15, "email": 13 }, "indicator_count": 8008, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b913f35d265bca66ab1956", "name": "CAPE Sandbox", "description": "", "modified": "2026-04-16T08:05:04.592000", "created": "2026-03-17T08:42:27.848000", "tags": [ "description", "ingest manager", "nameduseronline", "environment5", "npdid", "setconfig", "nglrunmode0", "ingest process", "state", "ingest monitor" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/dba358379f753d50b3ee2647c5e8113721f145d429991125e5009b1b13dd1f92_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773737048&Signature=hRkxM0tPEnoeeyMc1g5E8BXDI5oM7%2BDytlHAP4x3ph0f3E48UMhSfKqH9lPQ%2BTLwpvAtgqTe6x036mlgRsVipomGE%2FPH1GRNAyn7gwhDJHy%2BIKxZj24aSBTM20mQdsUhPskzFS5ymX1etiTMYMRyEjTCqfsa9ipuBeya6pge4OPzloQarmxrMKPv11TfVFIMnQAE3atM5T%2BSDvUzzlry75xD3W7BqQrtuBJVBUl7P6zS3CNbxj8Y" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 1, "FileHash-MD5": 102, "FileHash-SHA1": 90, "FileHash-SHA256": 82, "URL": 115, "domain": 7, "hostname": 58 }, "indicator_count": 455, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "45 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/dba358379f753d50b3ee2647c5e8113721f145d429991125e5009b1b13dd1f92_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773737048&Signature=hRkxM0tPEnoeeyMc1g5E8BXDI5oM7%2BDytlHAP4x3ph0f3E48UMhSfKqH9lPQ%2BTLwpvAtgqTe6x036mlgRsVipomGE%2FPH1GRNAyn7gwhDJHy%2BIKxZj24aSBTM20mQdsUhPskzFS5ymX1etiTMYMRyEjTCqfsa9ipuBeya6pge4OPzloQarmxrMKPv11TfVFIMnQAE3atM5T%2BSDvUzzlry75xD3W7BqQrtuBJVBUl7P6zS3CNbxj8Y", "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters." ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Wipes" ], "industries": [], "unique_indicators": 4304 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/adobe.com", "whois": "http://whois.domaintools.com/adobe.com", "domain": "adobe.com", "hostname": "www.adobe.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "69eb254f17eb4a2a990f07e5", "name": "LevelBlue - Open Threat Exchange", "description": "[ As part of security research, we look at some of the most well-known vulnerabilities in the PDF ecosystem, and how they can be identified and mitigated, with the help of a simple hash.] [64xxxx]", "modified": "2026-05-28T07:10:11.800000", "created": "2026-04-24T08:09:51.488000", "tags": [ "pdfkit", "cve202225765", "exploit script", "github", "unicordev", "cves", "xml external", "entity", "pdfs", "knowledge base", "python", "mozilla", "virustotal", "cisa", "apple", "microsoft", "pdfkit ruby", "remote code", "execution", "urls", "malware", "raid", "caddywiper", "wipes", "cve202543529", "webkit", "february", "cve202620643", "bypass", "march", "webkit bug", "command", "control", "levelblue", "open threat" ], "references": [ "https://otx.alienvault.com/indicator/ip/198.49.23.145#:~:text=CIDR:%206%20%7C%20CVE:%20107,infrastructure%20into%20global%20botnet%20clusters." ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "Wipes", "display_name": "Wipes", "target": null } ], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 1084, "FileHash-SHA1": 874, "FileHash-SHA256": 3052, "CVE": 36, "domain": 437, "hostname": 1086, "URL": 1411, "CIDR": 15, "email": 13 }, "indicator_count": 8008, "is_author": false, "is_subscribing": null, "subscriber_count": 70, "modified_text": "3 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "69b913f35d265bca66ab1956", "name": "CAPE Sandbox", "description": "", "modified": "2026-04-16T08:05:04.592000", "created": "2026-03-17T08:42:27.848000", "tags": [ "description", "ingest manager", "nameduseronline", "environment5", "npdid", "setconfig", "nglrunmode0", "ingest process", "state", "ingest monitor" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/dba358379f753d50b3ee2647c5e8113721f145d429991125e5009b1b13dd1f92_CAPE%20Sandbox.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1773737048&Signature=hRkxM0tPEnoeeyMc1g5E8BXDI5oM7%2BDytlHAP4x3ph0f3E48UMhSfKqH9lPQ%2BTLwpvAtgqTe6x036mlgRsVipomGE%2FPH1GRNAyn7gwhDJHy%2BIKxZj24aSBTM20mQdsUhPskzFS5ymX1etiTMYMRyEjTCqfsa9ipuBeya6pge4OPzloQarmxrMKPv11TfVFIMnQAE3atM5T%2BSDvUzzlry75xD3W7BqQrtuBJVBUl7P6zS3CNbxj8Y" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CIDR": 1, "FileHash-MD5": 102, "FileHash-SHA1": 90, "FileHash-SHA256": 82, "URL": 115, "domain": 7, "hostname": 58 }, "indicator_count": 455, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "45 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://www.adobe.com/go/ipmreaderepdf3_11_0Sign", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://www.adobe.com/go/ipmreaderepdf3_11_0Sign", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780289604.8971326 }