{
  "type": "URL",
  "indicator": "https://www.cloudflare.com/favicon.ico",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.cloudflare.com/favicon.ico",
    "type": "url",
    "type_title": "URL",
    "validation": [
      {
        "source": "alexa",
        "message": "Alexa rank: #465",
        "name": "Listed on Alexa"
      },
      {
        "source": "akamai",
        "message": "Akamai rank: #268",
        "name": "Akamai Popular Domain"
      },
      {
        "source": "whitelist",
        "message": "Whitelisted domain cloudflare.com",
        "name": "Whitelisted domain"
      },
      {
        "source": "majestic",
        "message": "Whitelisted domain cloudflare.com",
        "name": "Whitelisted domain"
      }
    ],
    "base_indicator": {
      "id": 4154304636,
      "indicator": "https://www.cloudflare.com/favicon.ico",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "69ca38fb0db58d66ca0c73aa",
          "name": "Untitled.",
          "description": "Pulses are the latest in a series of web-based attacks, which have seen more than 1.5 million infections since its launch in 2008.. and the first of its kind.",
          "modified": "2026-04-29T08:14:54.179000",
          "created": "2026-03-30T08:48:59.142000",
          "tags": [
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "domain",
            "ip whois",
            "registrar",
            "domain names",
            "creation date",
            "thumbprint",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus cngts",
            "ogoogle trust",
            "llc validity",
            "subject public",
            "key info",
            "key algorithm",
            "server",
            "aaaa",
            "status",
            "domain status",
            "registrar abuse",
            "data",
            "date",
            "google",
            "levelblue",
            "alienvault otx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 154,
            "domain": 170,
            "FileHash-SHA1": 155,
            "FileHash-MD5": 156,
            "FileHash-SHA256": 487,
            "URL": 322,
            "email": 6
          },
          "indicator_count": 1450,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "31 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6926228c245602830fd82fe5",
          "name": "hxxps://www[.]cloudflare[.]com/5xx-error-landing - 11.25.25",
          "description": "Cloudflare Abuse",
          "modified": "2025-12-25T21:00:52.783000",
          "created": "2025-11-25T21:41:32.156000",
          "tags": [
            "sandbox",
            "static analyzer",
            "emulation",
            "analyzer",
            "url",
            "scanner",
            "reputation",
            "phishing",
            "malware",
            "cloudflare",
            "warning icon",
            "share report",
            "domain",
            "systems",
            "host",
            "amazon web",
            "services",
            "varnish",
            "onetrust",
            "error",
            "bunny",
            "write",
            "virus",
            "trojan",
            "ransomware",
            "static",
            "analysis",
            "indicator of compromise",
            "ioc",
            "extraction",
            "online",
            "submit",
            "sample",
            "download",
            "platform",
            "vxstream",
            "apt",
            "hybrid analysis",
            "api key",
            "vetting process",
            "please note",
            "please",
            "javascript",
            "ansi",
            "runtime data",
            "file string",
            "dumps",
            "varchar",
            "null",
            "integer default",
            "localappdata",
            "integer not",
            "license",
            "path",
            "date",
            "facebook",
            "close",
            "roboto",
            "meta",
            "title",
            "span",
            "body",
            "blink",
            "win64",
            "contact",
            "mexico",
            "protect",
            "enterprise",
            "project",
            "suspicious",
            "hybrid",
            "mendoza",
            "mini",
            "code",
            "galileo",
            "4629",
            "false",
            "media",
            "critical",
            "fast",
            "stream",
            "cloud",
            "click",
            "hosts",
            "dorv",
            "lion",
            "cascade",
            "august",
            "general",
            "strings",
            "malicious"
          ],
          "references": [
            "https://app.threat.zone/submission/5b29d473-2767-440f-8f03-12e48c58fd29/url-analysis-report",
            "https://urlquery.net/report/4eec9c27-98f9-4826-96ee-3e02a77c3646",
            "https://www.filescan.io/uploads/69261defaf4aba3912d48f77/reports/ad684d0b-2509-498d-8ab4-3c67a075029f/ioc",
            "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582",
            "https://www.virustotal.com/gui/url/72220e2a2e1b36610c2efcd3585aa08ba8021ad13891821e47bbfd1f26709128/details",
            "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582/64ddb54ab6da189fe1047708"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1498",
              "name": "Network Denial of Service",
              "display_name": "T1498 - Network Denial of Service"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 520,
            "FileHash-MD5": 136,
            "FileHash-SHA1": 82,
            "domain": 120,
            "hostname": 275,
            "FileHash-SHA256": 136,
            "email": 12
          },
          "indicator_count": 1281,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "156 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.filescan.io/uploads/69261defaf4aba3912d48f77/reports/ad684d0b-2509-498d-8ab4-3c67a075029f/ioc",
        "https://urlquery.net/report/4eec9c27-98f9-4826-96ee-3e02a77c3646",
        "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582/64ddb54ab6da189fe1047708",
        "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582",
        "https://app.threat.zone/submission/5b29d473-2767-440f-8f03-12e48c58fd29/url-analysis-report",
        "https://www.virustotal.com/gui/url/72220e2a2e1b36610c2efcd3585aa08ba8021ad13891821e47bbfd1f26709128/details"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 2120
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/cloudflare.com",
    "whois": "http://whois.domaintools.com/cloudflare.com",
    "domain": "cloudflare.com",
    "hostname": "www.cloudflare.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "69ca38fb0db58d66ca0c73aa",
      "name": "Untitled.",
      "description": "Pulses are the latest in a series of web-based attacks, which have seen more than 1.5 million infections since its launch in 2008.. and the first of its kind.",
      "modified": "2026-04-29T08:14:54.179000",
      "created": "2026-03-30T08:48:59.142000",
      "tags": [
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "domain",
        "ip whois",
        "registrar",
        "domain names",
        "creation date",
        "thumbprint",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus cngts",
        "ogoogle trust",
        "llc validity",
        "subject public",
        "key info",
        "key algorithm",
        "server",
        "aaaa",
        "status",
        "domain status",
        "registrar abuse",
        "data",
        "date",
        "google",
        "levelblue",
        "alienvault otx"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 154,
        "domain": 170,
        "FileHash-SHA1": 155,
        "FileHash-MD5": 156,
        "FileHash-SHA256": 487,
        "URL": 322,
        "email": 6
      },
      "indicator_count": 1450,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "31 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6926228c245602830fd82fe5",
      "name": "hxxps://www[.]cloudflare[.]com/5xx-error-landing - 11.25.25",
      "description": "Cloudflare Abuse",
      "modified": "2025-12-25T21:00:52.783000",
      "created": "2025-11-25T21:41:32.156000",
      "tags": [
        "sandbox",
        "static analyzer",
        "emulation",
        "analyzer",
        "url",
        "scanner",
        "reputation",
        "phishing",
        "malware",
        "cloudflare",
        "warning icon",
        "share report",
        "domain",
        "systems",
        "host",
        "amazon web",
        "services",
        "varnish",
        "onetrust",
        "error",
        "bunny",
        "write",
        "virus",
        "trojan",
        "ransomware",
        "static",
        "analysis",
        "indicator of compromise",
        "ioc",
        "extraction",
        "online",
        "submit",
        "sample",
        "download",
        "platform",
        "vxstream",
        "apt",
        "hybrid analysis",
        "api key",
        "vetting process",
        "please note",
        "please",
        "javascript",
        "ansi",
        "runtime data",
        "file string",
        "dumps",
        "varchar",
        "null",
        "integer default",
        "localappdata",
        "integer not",
        "license",
        "path",
        "date",
        "facebook",
        "close",
        "roboto",
        "meta",
        "title",
        "span",
        "body",
        "blink",
        "win64",
        "contact",
        "mexico",
        "protect",
        "enterprise",
        "project",
        "suspicious",
        "hybrid",
        "mendoza",
        "mini",
        "code",
        "galileo",
        "4629",
        "false",
        "media",
        "critical",
        "fast",
        "stream",
        "cloud",
        "click",
        "hosts",
        "dorv",
        "lion",
        "cascade",
        "august",
        "general",
        "strings",
        "malicious"
      ],
      "references": [
        "https://app.threat.zone/submission/5b29d473-2767-440f-8f03-12e48c58fd29/url-analysis-report",
        "https://urlquery.net/report/4eec9c27-98f9-4826-96ee-3e02a77c3646",
        "https://www.filescan.io/uploads/69261defaf4aba3912d48f77/reports/ad684d0b-2509-498d-8ab4-3c67a075029f/ioc",
        "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582",
        "https://www.virustotal.com/gui/url/72220e2a2e1b36610c2efcd3585aa08ba8021ad13891821e47bbfd1f26709128/details",
        "https://hybrid-analysis.com/sample/fa4f8265e8be5eb4d59ced85c040c15fadf017ce9ae2ffe4869da356ec184582/64ddb54ab6da189fe1047708"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1498",
          "name": "Network Denial of Service",
          "display_name": "T1498 - Network Denial of Service"
        },
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 520,
        "FileHash-MD5": 136,
        "FileHash-SHA1": 82,
        "domain": 120,
        "hostname": 275,
        "FileHash-SHA256": 136,
        "email": 12
      },
      "indicator_count": 1281,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "156 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.cloudflare.com/favicon.ico",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.cloudflare.com/favicon.ico",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780200348.8787572
}