{
  "type": "URL",
  "indicator": "https://www.digpro.com/about-us",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.digpro.com/about-us",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3765698724,
      "indicator": "https://www.digpro.com/about-us",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "692e131f210ea9c656748c0c",
          "name": "iOS Exploits \u2022\u2019 Cutwail Botnet  - Telef\u00f3nica, S.A.",
          "description": "Cutwail Botnet  has a long history as a spambot. Sends malicious communications, may take system root. Cyber criminals.\n\n[OTX auto populated - Adversaries may be able to gain access to a victim's network by browsing a website over the normal course of browsing, but only if the victim is aware of the target's location and settings.]",
          "modified": "2025-12-31T21:02:25",
          "created": "2025-12-01T22:13:50.416000",
          "tags": [
            "canada canada",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "t1590 gather",
            "victim network",
            "mitre att",
            "ck techniques",
            "contacted hosts",
            "ip address",
            "unknown",
            "tls handshake",
            "failure",
            "forbidden",
            "msie",
            "windows nt",
            "tlsv1",
            "search",
            "show",
            "copy",
            "write",
            "malware",
            "next"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2784,
            "hostname": 2271,
            "URL": 6612,
            "FileHash-SHA256": 956,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 100,
            "SSLCertFingerprint": 10
          },
          "indicator_count": 12835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "109 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692e13386db2fdd32faf8999",
          "name": "iOS Exploits \u2022\u2019 Cutwail Botnet  - Telef\u00f3nica, S.A.",
          "description": "Cutwail Botnet  has a long history as a spambot. Sends malicious communications, may take system root. Cyber criminals.\n\n[OTX auto populated - Adversaries may be able to gain access to a victim's network by browsing a website over the normal course of browsing, but only if the victim is aware of the target's location and settings.]",
          "modified": "2025-12-31T21:02:25",
          "created": "2025-12-01T22:14:16.628000",
          "tags": [
            "canada canada",
            "united",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "t1590 gather",
            "victim network",
            "mitre att",
            "ck techniques",
            "contacted hosts",
            "ip address",
            "unknown",
            "tls handshake",
            "failure",
            "forbidden",
            "msie",
            "windows nt",
            "tlsv1",
            "search",
            "show",
            "copy",
            "write",
            "malware",
            "next"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2784,
            "hostname": 2271,
            "URL": 6612,
            "FileHash-SHA256": 956,
            "FileHash-MD5": 102,
            "FileHash-SHA1": 100,
            "SSLCertFingerprint": 10
          },
          "indicator_count": 12835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "109 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7fc464f9f56ac33a389",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-12-06T16:57:32.030000",
          "created": "2023-12-06T16:57:32.030000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3487,
            "domain": 3202,
            "CVE": 5,
            "FileHash-SHA256": 1943,
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 114,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a7e7daf278491d9f9eb4",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-12-06T16:57:11.228000",
          "created": "2023-12-06T16:57:11.228000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3487,
            "domain": 3202,
            "CVE": 5,
            "FileHash-SHA256": 1943,
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652044fb2f28d46e91d29160",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-06T17:33:47.403000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65204565ac1e8bce4de26df3",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-06T17:35:33.618000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1df9a7da086561b9897f",
          "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
          "description": "",
          "modified": "2023-11-05T14:05:48.545000",
          "created": "2023-10-30T03:07:37.963000",
          "tags": [
            "ssl certificate",
            "whois whois",
            "iocs",
            "milum botnet",
            "army",
            "isp stuff",
            "whois record",
            "travel stuff",
            "misp",
            "threat roundup",
            "july",
            "apple",
            "password",
            "apple ios",
            "whois",
            "emotet",
            "powershell",
            "hacktool",
            "crypto",
            "pornhub",
            "tulach",
            "tsara",
            "camera",
            "connect",
            "tsara brashears",
            "brashears",
            "scanning_host",
            "trojan",
            "phishing",
            "afro",
            "june",
            "misc attack",
            "et tor",
            "known tor",
            "relayrouter",
            "exit",
            "node traffic",
            "http traffic",
            "suricata alerts",
            "event category",
            "description sid",
            "websma",
            "webabo",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "malware",
            "alexa",
            "heur",
            "malicious site",
            "malicious url",
            "unsafe",
            "agent",
            "phishing",
            "riskware",
            "bank",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "genkryptik",
            "fuery",
            "wacatac",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "download",
            "union",
            "team",
            "opencandy",
            "exploit",
            "mimikatz",
            "blacklist https",
            "a1mara"
          ],
          "references": [
            "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
            "Research and Data Analysis",
            "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
          ],
          "public": 1,
          "adversary": "Tulach",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1070.003",
              "name": "Clear Command History",
              "display_name": "T1070.003 - Clear Command History"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65204565ac1e8bce4de26df3",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 14072,
            "FileHash-MD5": 70,
            "FileHash-SHA1": 56,
            "FileHash-SHA256": 1943,
            "domain": 3202,
            "hostname": 3487,
            "CVE": 5
          },
          "indicator_count": 22835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "896 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8",
        "Research and Data Analysis",
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Tulach"
          ],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 34981
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/digpro.com",
    "whois": "http://whois.domaintools.com/digpro.com",
    "domain": "digpro.com",
    "hostname": "www.digpro.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "692e131f210ea9c656748c0c",
      "name": "iOS Exploits \u2022\u2019 Cutwail Botnet  - Telef\u00f3nica, S.A.",
      "description": "Cutwail Botnet  has a long history as a spambot. Sends malicious communications, may take system root. Cyber criminals.\n\n[OTX auto populated - Adversaries may be able to gain access to a victim's network by browsing a website over the normal course of browsing, but only if the victim is aware of the target's location and settings.]",
      "modified": "2025-12-31T21:02:25",
      "created": "2025-12-01T22:13:50.416000",
      "tags": [
        "canada canada",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "t1590 gather",
        "victim network",
        "mitre att",
        "ck techniques",
        "contacted hosts",
        "ip address",
        "unknown",
        "tls handshake",
        "failure",
        "forbidden",
        "msie",
        "windows nt",
        "tlsv1",
        "search",
        "show",
        "copy",
        "write",
        "malware",
        "next"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2784,
        "hostname": 2271,
        "URL": 6612,
        "FileHash-SHA256": 956,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 100,
        "SSLCertFingerprint": 10
      },
      "indicator_count": 12835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "109 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692e13386db2fdd32faf8999",
      "name": "iOS Exploits \u2022\u2019 Cutwail Botnet  - Telef\u00f3nica, S.A.",
      "description": "Cutwail Botnet  has a long history as a spambot. Sends malicious communications, may take system root. Cyber criminals.\n\n[OTX auto populated - Adversaries may be able to gain access to a victim's network by browsing a website over the normal course of browsing, but only if the victim is aware of the target's location and settings.]",
      "modified": "2025-12-31T21:02:25",
      "created": "2025-12-01T22:14:16.628000",
      "tags": [
        "canada canada",
        "united",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "t1590 gather",
        "victim network",
        "mitre att",
        "ck techniques",
        "contacted hosts",
        "ip address",
        "unknown",
        "tls handshake",
        "failure",
        "forbidden",
        "msie",
        "windows nt",
        "tlsv1",
        "search",
        "show",
        "copy",
        "write",
        "malware",
        "next"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2784,
        "hostname": 2271,
        "URL": 6612,
        "FileHash-SHA256": 956,
        "FileHash-MD5": 102,
        "FileHash-SHA1": 100,
        "SSLCertFingerprint": 10
      },
      "indicator_count": 12835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "109 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7fc464f9f56ac33a389",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-12-06T16:57:32.030000",
      "created": "2023-12-06T16:57:32.030000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3487,
        "domain": 3202,
        "CVE": 5,
        "FileHash-SHA256": 1943,
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 114,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a7e7daf278491d9f9eb4",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-12-06T16:57:11.228000",
      "created": "2023-12-06T16:57:11.228000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3487,
        "domain": 3202,
        "CVE": 5,
        "FileHash-SHA256": 1943,
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "652044fb2f28d46e91d29160",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-06T17:33:47.403000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65204565ac1e8bce4de26df3",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "Packed. Miscellaneous Attacks. Hidden Users \nTarget: tsara brashears",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-06T17:35:33.618000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f1df9a7da086561b9897f",
      "name": "Hidden Users |Injection| Milum Botnet | Tulach Malware | Emotet",
      "description": "",
      "modified": "2023-11-05T14:05:48.545000",
      "created": "2023-10-30T03:07:37.963000",
      "tags": [
        "ssl certificate",
        "whois whois",
        "iocs",
        "milum botnet",
        "army",
        "isp stuff",
        "whois record",
        "travel stuff",
        "misp",
        "threat roundup",
        "july",
        "apple",
        "password",
        "apple ios",
        "whois",
        "emotet",
        "powershell",
        "hacktool",
        "crypto",
        "pornhub",
        "tulach",
        "tsara",
        "camera",
        "connect",
        "tsara brashears",
        "brashears",
        "scanning_host",
        "trojan",
        "phishing",
        "afro",
        "june",
        "misc attack",
        "et tor",
        "known tor",
        "relayrouter",
        "exit",
        "node traffic",
        "http traffic",
        "suricata alerts",
        "event category",
        "description sid",
        "websma",
        "webabo",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "malware",
        "alexa",
        "heur",
        "malicious site",
        "malicious url",
        "unsafe",
        "agent",
        "phishing",
        "riskware",
        "bank",
        "iframe",
        "downldr",
        "presenoker",
        "artemis",
        "genkryptik",
        "fuery",
        "wacatac",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "download",
        "union",
        "team",
        "opencandy",
        "exploit",
        "mimikatz",
        "blacklist https",
        "a1mara"
      ],
      "references": [
        "https://qvdcz.farmersdaughtersvirginia.com/sharecamera-search/19857150",
        "Research and Data Analysis",
        "https://www.hybrid-analysis.com/sample/9b6b166a36b69e296ba3516cfe2d1feb7945289b1583f71329f34d9a649c94d8"
      ],
      "public": 1,
      "adversary": "Tulach",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1070.003",
          "name": "Clear Command History",
          "display_name": "T1070.003 - Clear Command History"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65204565ac1e8bce4de26df3",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 14072,
        "FileHash-MD5": 70,
        "FileHash-SHA1": 56,
        "FileHash-SHA256": 1943,
        "domain": 3202,
        "hostname": 3487,
        "CVE": 5
      },
      "indicator_count": 22835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 218,
      "modified_text": "896 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.digpro.com/about-us",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.digpro.com/about-us",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642668.797533
}