{
  "type": "URL",
  "indicator": "https://www.escochart.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.escochart.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3848300279,
      "indicator": "https://www.escochart.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "68ee5e9f8cfc5fbc73142660",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:30:55.471000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68ee5ea4d51d4a1cabdb4ee9",
          "name": "Gaming Studios - YouTube - MyDoom",
          "description": "",
          "modified": "2025-11-13T12:05:32.283000",
          "created": "2025-10-14T14:31:00.172000",
          "tags": [
            "no expiration",
            "url https",
            "url http",
            "iocs",
            "ipv4",
            "enter source",
            "indicator role",
            "title added",
            "active related",
            "united",
            "present jul",
            "unknown ns",
            "search",
            "for privacy",
            "moved",
            "ip address",
            "encrypt",
            "a domains",
            "script urls",
            "meta",
            "pragma",
            "general full",
            "reverse dns",
            "software",
            "resource",
            "security tls",
            "piscataway",
            "asn20473",
            "asn15169",
            "google",
            "asvultr",
            "portfolio",
            "josh theriault",
            "upei",
            "university",
            "island",
            "roblox",
            "jmt studios",
            "moon engine",
            "android",
            "icpc",
            "north america",
            "qualifier",
            "hello",
            "apache",
            "runner",
            "eric everest",
            "games",
            "cloudflar",
            "amazon02",
            "as autonomous",
            "system",
            "canada",
            "value",
            "domainpath name",
            "cgjerrieegaggq",
            "name value",
            "form",
            "game development",
            "blog",
            "jmt99",
            "developer",
            "event",
            "bullseye",
            "trick or treat",
            "unofficial trick or treat 2014",
            "unofficial trick or treat 2015",
            "egg hunt",
            "gift hunt",
            "hallows quest",
            "studio",
            "experience",
            "fall",
            "january",
            "july",
            "founder",
            "studio head",
            "passive dns",
            "urls",
            "registrar",
            "title",
            "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
            "press copyright",
            "contact",
            "privacy policy",
            "safety how",
            "youtube",
            "test",
            "nfl sunday",
            "ticket",
            "google llc",
            "data upload",
            "extraction",
            "failed",
            "files",
            "twitter",
            "variables",
            "cgjjtbieggagla",
            "nid value",
            "expiration date",
            "files ip",
            "dynamicloader",
            "write c",
            "delete c",
            "intel",
            "ms windows",
            "medium",
            "default",
            "write",
            "guard",
            "mozilla",
            "malware",
            "defender",
            "unknown",
            "domains",
            "hashes",
            "url analysis",
            "unknown aaaa",
            "script domains",
            "certificate",
            "game",
            "servers",
            "unofficial",
            "settings",
            "public",
            "endpoints",
            "currently",
            "game servers",
            "current",
            "meta name",
            "robots content",
            "x ua",
            "ieedge chrome1",
            "incapsula",
            "request",
            "role title",
            "related pulses",
            "domain v",
            "url indicator",
            "nameilname",
            "ascii text",
            "mitre att",
            "ck id",
            "ck matrix",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "pe file",
            "high",
            "yara detections",
            "dynamic",
            "v hostname",
            "se fos",
            "include v",
            "domain url",
            "data",
            "alltypes",
            "win32mydoom oct",
            "trojan",
            "url add",
            "http",
            "related nids",
            "files location",
            "canada flag",
            "canada hostname",
            "canada unknown",
            "canada",
            "present aug",
            "name servers",
            "present sep",
            "aaaa",
            "present oct",
            "crlf line",
            "unicode text",
            "music",
            "suspicious",
            "bricked.wtf",
            "flag united",
            "google safe",
            "domain",
            "address domain",
            "united states",
            "filehashsha256",
            "hostname xn",
            "finland unknown",
            "filehashmd5",
            "indicators hong",
            "kong",
            "south korea",
            "present jun",
            "present mar",
            "present may",
            "olet",
            "cnr12",
            "tlsv1",
            "get updates",
            "upatre",
            "added active",
            "apple",
            "everest",
            "josh paul",
            "upadter",
            "convagent",
            "info stealing",
            "delete service",
            "phishing",
            "fraud",
            "social engineering",
            "gamer",
            "hacker",
            "adversaries",
            "icloud",
            "found",
            "gmt content",
            "error",
            "redacted for",
            "meta http",
            "content",
            "gmt server",
            "france unknown",
            "poland unknown",
            "content type",
            "xml title",
            "hostname add",
            "address",
            "location united",
            "life",
            "century link llc",
            "xfinity",
            "livesex",
            "domain add",
            "users",
            "show",
            "delete",
            "blocked by quad9",
            "showing",
            "record value",
            "location canada",
            "canada asn",
            "accept",
            "cookie",
            "macbook",
            "ipv4 add",
            "america flag",
            "america asn",
            "asn as714",
            "less",
            "woodynet",
            "next associated",
            "status",
            "exclude sugges",
            "ip related",
            "t1027.013"
          ],
          "references": [
            "https://www.jmtstudios.org/farewell/",
            "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
            "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
            "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
            "ConventionEngine_Term_Dropbox \u2022 Dropbox",
            "http://api.jmtstudios.org/",
            "bricked.wtf",
            "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
            "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
            "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
            "https://forwardemail.net/es/blog/open-source/apple-email-clients",
            "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
            "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
            "http://www.visitbooker.com/Dropbox-07/index.htm",
            "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
            "Appears to be closely associated with  close relative and initial victim of attack.",
            "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Hong Kong",
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Convagent-9981433-0",
              "display_name": "Win.Malware.Convagent-9981433-0",
              "target": null
            },
            {
              "id": "Upadter",
              "display_name": "Upadter",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6996,
            "FileHash-MD5": 281,
            "FileHash-SHA1": 220,
            "FileHash-SHA256": 2673,
            "domain": 1747,
            "email": 24,
            "hostname": 2803,
            "SSLCertFingerprint": 3
          },
          "indicator_count": 14747,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "157 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "688af30ab2a5242f48ba2c21",
          "name": "IoC\u2019s of Potentially \u2018falsified\u2019 LinkedIn of attempted Hitman DPD let walk",
          "description": "IoC\u2019s of Potentially \u2018falsified\u2019 LinkedIn profile of attempted Hitman DPD let walk. Name removed from pulse attempted HM. Denver Police positively identified driver , plates& vehicle positive walk. All attorneys accepted then dropped her case alleging \u2019she \u2019was too hacked?\u2019 \n\nAlleged traffic officer lets positively identified driver who intentionally tried to drive target Tsara Brashears of of the I - 25 after a PT  unexpectedly reported Jeffrey Reimer to DORA without victims knowledge or permission . Officer falsely states Brashears didn\u2019t have a drivers license. Wreck led to worsening a new SCI injury that eventually led to \u2026\n\n#corruption #denver #why #rip #dpd #stop",
          "modified": "2025-08-30T04:01:11.958000",
          "created": "2025-07-31T04:37:30.179000",
          "tags": [
            "dynamicloader",
            "entries",
            "search",
            "stun binding",
            "request",
            "port",
            "show",
            "write c",
            "medium",
            "whitelisted",
            "copy",
            "themida",
            "guard",
            "write",
            "risepro",
            "malware",
            "win64",
            "next",
            "software",
            "united",
            "for privacy",
            "unknown aaaa",
            "ip address",
            "creation date",
            "found",
            "gmt content",
            "443 ma2592000",
            "error"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 587,
            "FileHash-SHA256": 1137,
            "URL": 2279,
            "FileHash-MD5": 109,
            "FileHash-SHA1": 100,
            "domain": 291,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 4505,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "232 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party.",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "bricked.wtf",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://www.jmtstudios.org/farewell/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "http://api.jmtstudios.org/",
        "http://www.visitbooker.com/Dropbox-07/index.htm"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Mydoom",
            "Win.malware.convagent-9981433-0",
            "Upadter"
          ],
          "industries": [],
          "unique_indicators": 19157
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/escochart.com",
    "whois": "http://whois.domaintools.com/escochart.com",
    "domain": "escochart.com",
    "hostname": "www.escochart.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "68ee5e9f8cfc5fbc73142660",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:30:55.471000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68ee5ea4d51d4a1cabdb4ee9",
      "name": "Gaming Studios - YouTube - MyDoom",
      "description": "",
      "modified": "2025-11-13T12:05:32.283000",
      "created": "2025-10-14T14:31:00.172000",
      "tags": [
        "no expiration",
        "url https",
        "url http",
        "iocs",
        "ipv4",
        "enter source",
        "indicator role",
        "title added",
        "active related",
        "united",
        "present jul",
        "unknown ns",
        "search",
        "for privacy",
        "moved",
        "ip address",
        "encrypt",
        "a domains",
        "script urls",
        "meta",
        "pragma",
        "general full",
        "reverse dns",
        "software",
        "resource",
        "security tls",
        "piscataway",
        "asn20473",
        "asn15169",
        "google",
        "asvultr",
        "portfolio",
        "josh theriault",
        "upei",
        "university",
        "island",
        "roblox",
        "jmt studios",
        "moon engine",
        "android",
        "icpc",
        "north america",
        "qualifier",
        "hello",
        "apache",
        "runner",
        "eric everest",
        "games",
        "cloudflar",
        "amazon02",
        "as autonomous",
        "system",
        "canada",
        "value",
        "domainpath name",
        "cgjerrieegaggq",
        "name value",
        "form",
        "game development",
        "blog",
        "jmt99",
        "developer",
        "event",
        "bullseye",
        "trick or treat",
        "unofficial trick or treat 2014",
        "unofficial trick or treat 2015",
        "egg hunt",
        "gift hunt",
        "hallows quest",
        "studio",
        "experience",
        "fall",
        "january",
        "july",
        "founder",
        "studio head",
        "passive dns",
        "urls",
        "registrar",
        "title",
        "roblox jmt99 \"jmt studios\" \"trick or treat\" \"egg hunt\"",
        "press copyright",
        "contact",
        "privacy policy",
        "safety how",
        "youtube",
        "test",
        "nfl sunday",
        "ticket",
        "google llc",
        "data upload",
        "extraction",
        "failed",
        "files",
        "twitter",
        "variables",
        "cgjjtbieggagla",
        "nid value",
        "expiration date",
        "files ip",
        "dynamicloader",
        "write c",
        "delete c",
        "intel",
        "ms windows",
        "medium",
        "default",
        "write",
        "guard",
        "mozilla",
        "malware",
        "defender",
        "unknown",
        "domains",
        "hashes",
        "url analysis",
        "unknown aaaa",
        "script domains",
        "certificate",
        "game",
        "servers",
        "unofficial",
        "settings",
        "public",
        "endpoints",
        "currently",
        "game servers",
        "current",
        "meta name",
        "robots content",
        "x ua",
        "ieedge chrome1",
        "incapsula",
        "request",
        "role title",
        "related pulses",
        "domain v",
        "url indicator",
        "nameilname",
        "ascii text",
        "mitre att",
        "ck id",
        "ck matrix",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "pe file",
        "high",
        "yara detections",
        "dynamic",
        "v hostname",
        "se fos",
        "include v",
        "domain url",
        "data",
        "alltypes",
        "win32mydoom oct",
        "trojan",
        "url add",
        "http",
        "related nids",
        "files location",
        "canada flag",
        "canada hostname",
        "canada unknown",
        "canada",
        "present aug",
        "name servers",
        "present sep",
        "aaaa",
        "present oct",
        "crlf line",
        "unicode text",
        "music",
        "suspicious",
        "bricked.wtf",
        "flag united",
        "google safe",
        "domain",
        "address domain",
        "united states",
        "filehashsha256",
        "hostname xn",
        "finland unknown",
        "filehashmd5",
        "indicators hong",
        "kong",
        "south korea",
        "present jun",
        "present mar",
        "present may",
        "olet",
        "cnr12",
        "tlsv1",
        "get updates",
        "upatre",
        "added active",
        "apple",
        "everest",
        "josh paul",
        "upadter",
        "convagent",
        "info stealing",
        "delete service",
        "phishing",
        "fraud",
        "social engineering",
        "gamer",
        "hacker",
        "adversaries",
        "icloud",
        "found",
        "gmt content",
        "error",
        "redacted for",
        "meta http",
        "content",
        "gmt server",
        "france unknown",
        "poland unknown",
        "content type",
        "xml title",
        "hostname add",
        "address",
        "location united",
        "life",
        "century link llc",
        "xfinity",
        "livesex",
        "domain add",
        "users",
        "show",
        "delete",
        "blocked by quad9",
        "showing",
        "record value",
        "location canada",
        "canada asn",
        "accept",
        "cookie",
        "macbook",
        "ipv4 add",
        "america flag",
        "america asn",
        "asn as714",
        "less",
        "woodynet",
        "next associated",
        "status",
        "exclude sugges",
        "ip related",
        "t1027.013"
      ],
      "references": [
        "https://www.jmtstudios.org/farewell/",
        "https://www.youtube.com/channel/UCSYMkiAJcNXbO5-aemTSxvw",
        "graphql.accounts.instagram.disk- cloud.link encrynt lenter source leric everest l Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link Data upload Failed Extraction failed, please try again Failed to retrieve suggested indicator for graphql.accounts.instagram.disk- cloud.link showing system",
        "https://www.fireeye.com/blog/threat-research/2019/08/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware.html",
        "ConventionEngine_Term_Dropbox \u2022 Dropbox",
        "http://api.jmtstudios.org/",
        "bricked.wtf",
        "ic1-privaterelay.appleid.com \u2022 ic2-privaterelay.appleid.com\t\u2022 ic4-privaterelay.appleid.com",
        "http://apple-carry-relay.fastly-edge.com \u2022 appleid.com \u2022 charterhomeschoolacademy.appleid.com",
        "careersandenterprise.appleid.com \u2022 http://apple.appleid.com/",
        "https://forwardemail.net/es/blog/open-source/apple-email-clients",
        "accounts.instagram.disk-cloud.link \u2022\tgraphql.accounts.instagram.disk-cloud",
        "http://mc.yandex-team.settings.storage-cloud.link/ \u2022 ru.disk-cloud.link",
        "http://www.visitbooker.com/Dropbox-07/index.htm",
        "dash.ocrobot.com \u2022 robottherobot.com \u2022http://www.robottherobot.com/",
        "Appears to be closely associated with  close relative and initial victim of attack.",
        "Potentially disturbing , personal , invasive, aggressive, intimate behavior of party."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Hong Kong",
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Convagent-9981433-0",
          "display_name": "Win.Malware.Convagent-9981433-0",
          "target": null
        },
        {
          "id": "Upadter",
          "display_name": "Upadter",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6996,
        "FileHash-MD5": 281,
        "FileHash-SHA1": 220,
        "FileHash-SHA256": 2673,
        "domain": 1747,
        "email": 24,
        "hostname": 2803,
        "SSLCertFingerprint": 3
      },
      "indicator_count": 14747,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "157 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "688af30ab2a5242f48ba2c21",
      "name": "IoC\u2019s of Potentially \u2018falsified\u2019 LinkedIn of attempted Hitman DPD let walk",
      "description": "IoC\u2019s of Potentially \u2018falsified\u2019 LinkedIn profile of attempted Hitman DPD let walk. Name removed from pulse attempted HM. Denver Police positively identified driver , plates& vehicle positive walk. All attorneys accepted then dropped her case alleging \u2019she \u2019was too hacked?\u2019 \n\nAlleged traffic officer lets positively identified driver who intentionally tried to drive target Tsara Brashears of of the I - 25 after a PT  unexpectedly reported Jeffrey Reimer to DORA without victims knowledge or permission . Officer falsely states Brashears didn\u2019t have a drivers license. Wreck led to worsening a new SCI injury that eventually led to \u2026\n\n#corruption #denver #why #rip #dpd #stop",
      "modified": "2025-08-30T04:01:11.958000",
      "created": "2025-07-31T04:37:30.179000",
      "tags": [
        "dynamicloader",
        "entries",
        "search",
        "stun binding",
        "request",
        "port",
        "show",
        "write c",
        "medium",
        "whitelisted",
        "copy",
        "themida",
        "guard",
        "write",
        "risepro",
        "malware",
        "win64",
        "next",
        "software",
        "united",
        "for privacy",
        "unknown aaaa",
        "ip address",
        "creation date",
        "found",
        "gmt content",
        "443 ma2592000",
        "error"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 587,
        "FileHash-SHA256": 1137,
        "URL": 2279,
        "FileHash-MD5": 109,
        "FileHash-SHA1": 100,
        "domain": 291,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 4505,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "232 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.escochart.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.escochart.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776634613.5937676
}