{
  "type": "URL",
  "indicator": "https://www.codeqihan.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.codeqihan.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3785228949,
      "indicator": "https://www.codeqihan.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "689b9b9fab42ca4f016a226f",
          "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
          "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
          "modified": "2025-09-11T13:03:18.814000",
          "created": "2025-08-12T19:53:03.953000",
          "tags": [
            "url http",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "pulses url",
            "entries",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "spawns",
            "mitre att",
            "ck techniques",
            "evasion att",
            "href",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "show technique",
            "ck matrix",
            "null",
            "refresh",
            "body",
            "span",
            "general",
            "local",
            "path",
            "iframe",
            "click",
            "date",
            "strings",
            "error",
            "tools",
            "look",
            "verify",
            "restart",
            "united",
            "unknown ns",
            "ip address",
            "creation date",
            "search",
            "present sep",
            "moved",
            "domain add",
            "encrypt",
            "accept",
            "please",
            "passive dns",
            "msie",
            "next associated",
            "html",
            "background",
            "unknown site",
            "div div",
            "trojan",
            "zeus",
            "process32nextw",
            "read c",
            "show",
            "shellexecuteexw",
            "windows nt",
            "wow64",
            "copy",
            "dock",
            "write",
            "malware",
            "unknown",
            "defense evasion",
            "t1480 execution",
            "file defense",
            "august",
            "hybrid",
            "port",
            "destination",
            "tlsv1",
            "as15169",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "persistence",
            "data upload",
            "extraction",
            "win32",
            "ransom",
            "trojandropper",
            "mtb nov",
            "forcud",
            "files show",
            "date hash",
            "avast avg"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4179,
            "domain": 774,
            "hostname": 1673,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 110,
            "FileHash-SHA256": 2073,
            "email": 1,
            "SSLCertFingerprint": 13,
            "CVE": 1
          },
          "indicator_count": 8993,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "220 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "685186035e5fb63846d29e45",
          "name": "Regarding Minority Report 2.0 | Aggresive Remote device tracking (multiple) | Network Rat",
          "description": "Abuse.\nWhy is so much of this in plain sight? .\nMalicious tactics abused by  preemptive policing recently implemented by Tech Bros under current Trump administration.\nThee governing Cyber Defense / AI / Data collection firm. | foundry2-lbl.dvr.dn2.n-helix.com | \nhttp://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://nl.cyberriskalliance.com/assets/icons/twitter.png |\nhttps://axis.snxd.com/track/0\n| track.getbuilt.com  | \nRelates to Denver female \u2018allegedly\u2019 injured \u2018in PT.\nA malicious prosecution case against alleged victim after a Detective brought \u2018MTI\u2019 case to controlled Denver DA was dismissed by judge. Injured victim paid a pathetic settlement; especially considering the seriousness of the response of the government.  \nThis type\nof tracking silencing is critically dangerous. \nHosanna make no haste to rescue all\nof victims of civilian & victim targeting.\n*Crowdsourced",
          "modified": "2025-07-17T14:01:34.245000",
          "created": "2025-06-17T15:13:07.233000",
          "tags": [
            "body",
            "cps https",
            "location",
            "urls server",
            "cloudfront",
            "united",
            "unknown aaaa",
            "search",
            "digital press",
            "moved",
            "digital culture",
            "ip address",
            "creation date",
            "record value",
            "entries",
            "date",
            "meta",
            "urls",
            "http",
            "passive dns",
            "unique",
            "pulse pulses",
            "related nids",
            "files location",
            "flag united",
            "showing",
            "rich content",
            "system",
            "cdn amazon",
            "amazons3 tls",
            "certificate",
            "redirects",
            "ua9385760744",
            "utc na",
            "utc google",
            "tag manager",
            "gk4vnlmd3b9",
            "server",
            "amazon",
            "net1832001",
            "net18160001",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "present mar",
            "present feb",
            "unknown cname",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "aaaa"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2075,
            "URL": 5471,
            "hostname": 1531,
            "domain": 1013,
            "FileHash-MD5": 55,
            "FileHash-SHA1": 53,
            "CVE": 1,
            "SSLCertFingerprint": 1,
            "email": 1,
            "CIDR": 2
          },
          "indicator_count": 10203,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "276 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "685186983a4dd00c2b45b255",
          "name": "Source:\thttps://cloud.samsara.com/o/79639/flee",
          "description": "",
          "modified": "2025-07-17T14:01:34.245000",
          "created": "2025-06-17T15:15:36.505000",
          "tags": [
            "body",
            "cps https",
            "location",
            "urls server",
            "cloudfront",
            "united",
            "unknown aaaa",
            "search",
            "digital press",
            "moved",
            "digital culture",
            "ip address",
            "creation date",
            "record value",
            "entries",
            "date",
            "meta",
            "urls",
            "http",
            "passive dns",
            "unique",
            "pulse pulses",
            "related nids",
            "files location",
            "flag united",
            "showing",
            "rich content",
            "system",
            "cdn amazon",
            "amazons3 tls",
            "certificate",
            "redirects",
            "ua9385760744",
            "utc na",
            "utc google",
            "tag manager",
            "gk4vnlmd3b9",
            "server",
            "amazon",
            "net1832001",
            "net18160001",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "present mar",
            "present feb",
            "unknown cname",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "aaaa"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "685186035e5fb63846d29e45",
          "export_count": 47,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2075,
            "URL": 5471,
            "hostname": 1531,
            "domain": 1013,
            "FileHash-MD5": 55,
            "FileHash-SHA1": 53,
            "CVE": 1,
            "SSLCertFingerprint": 1,
            "email": 1,
            "CIDR": 2
          },
          "indicator_count": 10203,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "276 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bca8fcbe62297d71b47c33",
          "name": "Ragnar Locker",
          "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
          "modified": "2024-03-03T08:00:03.432000",
          "created": "2024-02-02T08:34:04.425000",
          "tags": [
            "referrer",
            "contacted",
            "whois record",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "execution",
            "historical ssl",
            "red team",
            "gang breached",
            "agent tesla",
            "redline stealer",
            "metro",
            "android",
            "urls url",
            "files",
            "kgs0",
            "kls0",
            "orgtechhandle",
            "orgtechref",
            "orgabusehandle",
            "orgdnshandle",
            "orgdnsref",
            "whois lookup",
            "netrange",
            "nethandle",
            "net108",
            "net1080000",
            "communicating",
            "urls http",
            "ransomware gang",
            "breached",
            "team",
            "first",
            "utc submissions",
            "submitters",
            "gandi sas",
            "psiusa",
            "domain robot",
            "porkbun llc",
            "keysystems gmbh",
            "csc corporate",
            "domains",
            "domain name",
            "network pty",
            "tucows",
            "com laude",
            "dynadot inc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8354,
            "FileHash-MD5": 104,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 2711,
            "CIDR": 5,
            "CVE": 6,
            "domain": 1489,
            "hostname": 3058,
            "email": 5
          },
          "indicator_count": 15813,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "777 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655e5c72277117d3b0e00fbd",
          "name": "Command and Scripting Interpreter",
          "description": "https:/www.usaopps.com/government_contractors/contractor-5388777-SIERRA-PIPELINE-INC-.htm",
          "modified": "2023-12-22T19:00:52.050000",
          "created": "2023-11-22T19:54:26.925000",
          "tags": [
            "whois record",
            "contacted",
            "execution",
            "ssl certificate",
            "historical ssl",
            "resolutions",
            "problems",
            "red team",
            "whois whois",
            "referrer",
            "startpage",
            "generic malware",
            "cobaltstrike",
            "malware generic",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist https",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "malicious site",
            "malware site",
            "malicious url",
            "phishing site",
            "alexa",
            "phishing",
            "redline stealer",
            "bank",
            "team",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "live",
            "zbot",
            "united",
            "cyber threat",
            "covid19",
            "mail spammer",
            "malicious host",
            "anonymizer",
            "engineering",
            "purplewave",
            "malicious",
            "keybase",
            "union",
            "asyncrat",
            "cobalt strike",
            "dnspionage",
            "ransomware",
            "maltiverse",
            "malicious link",
            "detection list",
            "blacklist",
            "pattern match",
            "file",
            "ascii text",
            "windows nt",
            "appdata",
            "mitre att",
            "null",
            "date",
            "ck id",
            "show technique",
            "unknown",
            "accept",
            "hybrid",
            "local",
            "click",
            "strings",
            "class",
            "generator",
            "critical",
            "error",
            "fast",
            "blacklist http",
            "heur",
            "adware",
            "unsafe",
            "riskware",
            "agent",
            "swrort",
            "exploit",
            "crack",
            "opencandy",
            "tiggre",
            "cleaner",
            "conduit",
            "wacatac",
            "nircmd",
            "filetour",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "acint",
            "systweak",
            "behav",
            "genkryptik",
            "xtrat",
            "softcnapp",
            "fusioncore",
            "installpack",
            "xrat",
            "jquery",
            "content scraper",
            "malware hosting",
            "bid site",
            "https:/www.usaopps.com/government_contractors/contractor-5388777",
            "CVE-2017-11882",
            "CVE-2017-0147",
            "CVE-2017-8570",
            "CVE-2005-1790",
            "CVE-2009-3672",
            "CVE-2010-3962",
            "CVE-2012-3993",
            "CVE-2014-3153",
            "CVE-2014-6332",
            "CVE-2016-0189",
            "CVE-2017-0199",
            "CVE-2018-4893",
            "CVE-2020-0601",
            "CVE-2020-0674",
            "CVE-2021-27065",
            "CVE-2021-40444"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/bc437a855075805df699bd915cd27814a799969bb38db45f09f5f16a54ccc5b6/655e548bc2555fc8280ba976",
            "https:/www.usaopps.com/government_contractors/contractor-5388777-SIERRA-PIPELINE-INC-.htm"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [
            "Business",
            "Economy",
            "Government",
            "Legal"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 608,
            "FileHash-SHA1": 312,
            "FileHash-SHA256": 1086,
            "URL": 2843,
            "domain": 341,
            "hostname": 1091,
            "CVE": 16
          },
          "indicator_count": 6297,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "849 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https:/www.usaopps.com/government_contractors/contractor-5388777-SIERRA-PIPELINE-INC-.htm",
        "https://www.hybrid-analysis.com/sample/bc437a855075805df699bd915cd27814a799969bb38db45f09f5f16a54ccc5b6/655e548bc2555fc8280ba976"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Government",
            "Legal",
            "Economy",
            "Business"
          ],
          "unique_indicators": 41383
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/codeqihan.com",
    "whois": "http://whois.domaintools.com/codeqihan.com",
    "domain": "codeqihan.com",
    "hostname": "www.codeqihan.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "689b9b9fab42ca4f016a226f",
      "name": "Elastic's Al-driven Endpoint Security - Red Team Malicious (moved?)",
      "description": "Endgame - Unruy Activity -System infection | (Moved) Endpoint security (MOVED) from Elastic\nElastic's Al-driven security analytics empowers you with comprehensive endpoint protection. Detect, investigate, and respond to threats faster with a single agent and unified console. Gain actionable insights for a proactive defense posture. All built on the Search\nAl platform.\n| Used maliciously against monitored non-criminal targets. |\n{ virus - https://universitycenter.uccs.edu/}\n#unruy #activity #monitored_target #red_team_malicious #trojan #worm #moved\n#ai #adversarial #custom_malware #ransom #crypt #guardrails #dns #cnc #evasive #domain_generation #remote_access #devices #remotewd #virus #custom_malware #rip #endgame \n\u2022 TrojanDropper\t\t\t\n\u2022 Win32:Evo-gen\t\u2022 Cassini\n\u2022 RansomX-gen\u2022 Zombie.A\n\u2022 win32:MalwareX-gen\t\u2022 Win32:Malware-gen \u2022  Nymeria\n\u2022 Forcud +",
      "modified": "2025-09-11T13:03:18.814000",
      "created": "2025-08-12T19:53:03.953000",
      "tags": [
        "url http",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "pulses url",
        "entries",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "spawns",
        "mitre att",
        "ck techniques",
        "evasion att",
        "href",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "show technique",
        "ck matrix",
        "null",
        "refresh",
        "body",
        "span",
        "general",
        "local",
        "path",
        "iframe",
        "click",
        "date",
        "strings",
        "error",
        "tools",
        "look",
        "verify",
        "restart",
        "united",
        "unknown ns",
        "ip address",
        "creation date",
        "search",
        "present sep",
        "moved",
        "domain add",
        "encrypt",
        "accept",
        "please",
        "passive dns",
        "msie",
        "next associated",
        "html",
        "background",
        "unknown site",
        "div div",
        "trojan",
        "zeus",
        "process32nextw",
        "read c",
        "show",
        "shellexecuteexw",
        "windows nt",
        "wow64",
        "copy",
        "dock",
        "write",
        "malware",
        "unknown",
        "defense evasion",
        "t1480 execution",
        "file defense",
        "august",
        "hybrid",
        "port",
        "destination",
        "tlsv1",
        "as15169",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "persistence",
        "data upload",
        "extraction",
        "win32",
        "ransom",
        "trojandropper",
        "mtb nov",
        "forcud",
        "files show",
        "date hash",
        "avast avg"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4179,
        "domain": 774,
        "hostname": 1673,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 110,
        "FileHash-SHA256": 2073,
        "email": 1,
        "SSLCertFingerprint": 13,
        "CVE": 1
      },
      "indicator_count": 8993,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "220 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "685186035e5fb63846d29e45",
      "name": "Regarding Minority Report 2.0 | Aggresive Remote device tracking (multiple) | Network Rat",
      "description": "Abuse.\nWhy is so much of this in plain sight? .\nMalicious tactics abused by  preemptive policing recently implemented by Tech Bros under current Trump administration.\nThee governing Cyber Defense / AI / Data collection firm. | foundry2-lbl.dvr.dn2.n-helix.com | \nhttp://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://nl.cyberriskalliance.com/assets/icons/twitter.png |\nhttps://axis.snxd.com/track/0\n| track.getbuilt.com  | \nRelates to Denver female \u2018allegedly\u2019 injured \u2018in PT.\nA malicious prosecution case against alleged victim after a Detective brought \u2018MTI\u2019 case to controlled Denver DA was dismissed by judge. Injured victim paid a pathetic settlement; especially considering the seriousness of the response of the government.  \nThis type\nof tracking silencing is critically dangerous. \nHosanna make no haste to rescue all\nof victims of civilian & victim targeting.\n*Crowdsourced",
      "modified": "2025-07-17T14:01:34.245000",
      "created": "2025-06-17T15:13:07.233000",
      "tags": [
        "body",
        "cps https",
        "location",
        "urls server",
        "cloudfront",
        "united",
        "unknown aaaa",
        "search",
        "digital press",
        "moved",
        "digital culture",
        "ip address",
        "creation date",
        "record value",
        "entries",
        "date",
        "meta",
        "urls",
        "http",
        "passive dns",
        "unique",
        "pulse pulses",
        "related nids",
        "files location",
        "flag united",
        "showing",
        "rich content",
        "system",
        "cdn amazon",
        "amazons3 tls",
        "certificate",
        "redirects",
        "ua9385760744",
        "utc na",
        "utc google",
        "tag manager",
        "gk4vnlmd3b9",
        "server",
        "amazon",
        "net1832001",
        "net18160001",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "present mar",
        "present feb",
        "unknown cname",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "aaaa"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2075,
        "URL": 5471,
        "hostname": 1531,
        "domain": 1013,
        "FileHash-MD5": 55,
        "FileHash-SHA1": 53,
        "CVE": 1,
        "SSLCertFingerprint": 1,
        "email": 1,
        "CIDR": 2
      },
      "indicator_count": 10203,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "276 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "685186983a4dd00c2b45b255",
      "name": "Source:\thttps://cloud.samsara.com/o/79639/flee",
      "description": "",
      "modified": "2025-07-17T14:01:34.245000",
      "created": "2025-06-17T15:15:36.505000",
      "tags": [
        "body",
        "cps https",
        "location",
        "urls server",
        "cloudfront",
        "united",
        "unknown aaaa",
        "search",
        "digital press",
        "moved",
        "digital culture",
        "ip address",
        "creation date",
        "record value",
        "entries",
        "date",
        "meta",
        "urls",
        "http",
        "passive dns",
        "unique",
        "pulse pulses",
        "related nids",
        "files location",
        "flag united",
        "showing",
        "rich content",
        "system",
        "cdn amazon",
        "amazons3 tls",
        "certificate",
        "redirects",
        "ua9385760744",
        "utc na",
        "utc google",
        "tag manager",
        "gk4vnlmd3b9",
        "server",
        "amazon",
        "net1832001",
        "net18160001",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "present mar",
        "present feb",
        "unknown cname",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "aaaa"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "685186035e5fb63846d29e45",
      "export_count": 47,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2075,
        "URL": 5471,
        "hostname": 1531,
        "domain": 1013,
        "FileHash-MD5": 55,
        "FileHash-SHA1": 53,
        "CVE": 1,
        "SSLCertFingerprint": 1,
        "email": 1,
        "CIDR": 2
      },
      "indicator_count": 10203,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "276 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bca8fcbe62297d71b47c33",
      "name": "Ragnar Locker",
      "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n  108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.",
      "modified": "2024-03-03T08:00:03.432000",
      "created": "2024-02-02T08:34:04.425000",
      "tags": [
        "referrer",
        "contacted",
        "whois record",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "execution",
        "historical ssl",
        "red team",
        "gang breached",
        "agent tesla",
        "redline stealer",
        "metro",
        "android",
        "urls url",
        "files",
        "kgs0",
        "kls0",
        "orgtechhandle",
        "orgtechref",
        "orgabusehandle",
        "orgdnshandle",
        "orgdnsref",
        "whois lookup",
        "netrange",
        "nethandle",
        "net108",
        "net1080000",
        "communicating",
        "urls http",
        "ransomware gang",
        "breached",
        "team",
        "first",
        "utc submissions",
        "submitters",
        "gandi sas",
        "psiusa",
        "domain robot",
        "porkbun llc",
        "keysystems gmbh",
        "csc corporate",
        "domains",
        "domain name",
        "network pty",
        "tucows",
        "com laude",
        "dynadot inc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8354,
        "FileHash-MD5": 104,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 2711,
        "CIDR": 5,
        "CVE": 6,
        "domain": 1489,
        "hostname": 3058,
        "email": 5
      },
      "indicator_count": 15813,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "777 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655e5c72277117d3b0e00fbd",
      "name": "Command and Scripting Interpreter",
      "description": "https:/www.usaopps.com/government_contractors/contractor-5388777-SIERRA-PIPELINE-INC-.htm",
      "modified": "2023-12-22T19:00:52.050000",
      "created": "2023-11-22T19:54:26.925000",
      "tags": [
        "whois record",
        "contacted",
        "execution",
        "ssl certificate",
        "historical ssl",
        "resolutions",
        "problems",
        "red team",
        "whois whois",
        "referrer",
        "startpage",
        "generic malware",
        "cobaltstrike",
        "malware generic",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist https",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "malicious site",
        "malware site",
        "malicious url",
        "phishing site",
        "alexa",
        "phishing",
        "redline stealer",
        "bank",
        "team",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "live",
        "zbot",
        "united",
        "cyber threat",
        "covid19",
        "mail spammer",
        "malicious host",
        "anonymizer",
        "engineering",
        "purplewave",
        "malicious",
        "keybase",
        "union",
        "asyncrat",
        "cobalt strike",
        "dnspionage",
        "ransomware",
        "maltiverse",
        "malicious link",
        "detection list",
        "blacklist",
        "pattern match",
        "file",
        "ascii text",
        "windows nt",
        "appdata",
        "mitre att",
        "null",
        "date",
        "ck id",
        "show technique",
        "unknown",
        "accept",
        "hybrid",
        "local",
        "click",
        "strings",
        "class",
        "generator",
        "critical",
        "error",
        "fast",
        "blacklist http",
        "heur",
        "adware",
        "unsafe",
        "riskware",
        "agent",
        "swrort",
        "exploit",
        "crack",
        "opencandy",
        "tiggre",
        "cleaner",
        "conduit",
        "wacatac",
        "nircmd",
        "filetour",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "installcore",
        "webshell",
        "acint",
        "systweak",
        "behav",
        "genkryptik",
        "xtrat",
        "softcnapp",
        "fusioncore",
        "installpack",
        "xrat",
        "jquery",
        "content scraper",
        "malware hosting",
        "bid site",
        "https:/www.usaopps.com/government_contractors/contractor-5388777",
        "CVE-2017-11882",
        "CVE-2017-0147",
        "CVE-2017-8570",
        "CVE-2005-1790",
        "CVE-2009-3672",
        "CVE-2010-3962",
        "CVE-2012-3993",
        "CVE-2014-3153",
        "CVE-2014-6332",
        "CVE-2016-0189",
        "CVE-2017-0199",
        "CVE-2018-4893",
        "CVE-2020-0601",
        "CVE-2020-0674",
        "CVE-2021-27065",
        "CVE-2021-40444"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/bc437a855075805df699bd915cd27814a799969bb38db45f09f5f16a54ccc5b6/655e548bc2555fc8280ba976",
        "https:/www.usaopps.com/government_contractors/contractor-5388777-SIERRA-PIPELINE-INC-.htm"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [
        "Business",
        "Economy",
        "Government",
        "Legal"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 608,
        "FileHash-SHA1": 312,
        "FileHash-SHA256": 1086,
        "URL": 2843,
        "domain": 341,
        "hostname": 1091,
        "CVE": 16
      },
      "indicator_count": 6297,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "849 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.codeqihan.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.codeqihan.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630045.540034
}