{
  "type": "URL",
  "indicator": "https://www.freeav.com/7",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.freeav.com/7",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4074466655,
      "indicator": "https://www.freeav.com/7",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68ff6bf46f5d8662048ca7a1",
          "name": "symcd.com \u2022 Netify.ai",
          "description": "Seen in multiple attacks including CrowdStrike\nincident that was truly a breach found and reported prior to outage. SYCMD..com\nis consistently removed / deleted from pulses.\n\nI have nothing to say. OTX will pulse this let\u2019s see if anything happens..\n#rootkit? #ai #netify #malware #running_webserver #ottowa #elf #agent #malware #known #network_icmp #nolookup_communication\nantivm_generic_disk #dead host\n#dumped_buffer\n#network_cnc_http\n#network_http\n#allocates_rwx\n#av_detect_china_key #m\n[ELF:Agent-VW\\ [Trj]]\nIDS Detections :\n*GoBrut Service Bruter CnC Activity \n*GoBrut Service Bruter CnC Checkin \n*Generic.Go.Bruteforcer CnC Beacon\neval String.fromCharCode String Which May Be #malicious\nYara Detections:\ncompromised_site_redirector_fromcharcode\nfromCharCode | Yara Detections:\nKnownMaliciousObfuscationPattern\n[External IP Address Lookup via api .ip138 .com]\n[Win.Malware.Softcnapp-6932830-0]\nMultiple malware attack.",
          "modified": "2025-11-26T12:00:39.551000",
          "created": "2025-10-27T12:56:20.090000",
          "tags": [
            "present may",
            "present jun",
            "name servers",
            "united",
            "status",
            "present aug",
            "present oct",
            "present jul",
            "present mar",
            "present nov",
            "date",
            "digicert",
            "whois",
            "forums",
            "symantec",
            "comcast",
            "levelblue",
            "open threat",
            "pulse",
            "urls",
            "as13335",
            "info",
            "server",
            "domain status",
            "registrar abuse",
            "registrar",
            "dnssec",
            "domain name",
            "us registrant",
            "email",
            "contact email",
            "host name",
            "handle",
            "rdap database",
            "iana registrar",
            "present sep",
            "canada unknown",
            "moved",
            "ip address",
            "search",
            "title",
            "encrypt",
            "ubuntu",
            "linux x8664",
            "gobrut service",
            "bruter cnc",
            "entries",
            "show",
            "activity",
            "stca",
            "unknown",
            "malware",
            "copy",
            "next",
            "team",
            "script urls",
            "a domains",
            "passive dns",
            "gmt server",
            "content type",
            "body",
            "meta",
            "for privacy",
            "creation date",
            "name redacted",
            "expiration date",
            "servers",
            "hostname add",
            "pulse pulses",
            "13371",
            "qq v",
            "process32nextw",
            "regopenkeyexw",
            "medium",
            "langchinese",
            "get na",
            "rticon",
            "security",
            "high",
            "win32",
            "write",
            "dynamicloader",
            "checks",
            "alerts",
            "bios",
            "dynamic",
            "total",
            "read",
            "delete",
            "name strings",
            "south korea"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia",
            "Canada",
            "Bulgaria",
            "Germany",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3301,
            "email": 9,
            "hostname": 1202,
            "FileHash-SHA256": 1967,
            "domain": 1885,
            "FileHash-MD5": 153,
            "FileHash-SHA1": 151,
            "CVE": 1,
            "SSLCertFingerprint": 82,
            "FilePath": 1
          },
          "indicator_count": 8752,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "186 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68451577ada8bb0aa0834edb",
          "name": "X - Business Social Media Account used to attack victim",
          "description": "Victims business social media accounts deleted. Used to commit malicious activity against businesses, espionage , financial abuse.",
          "modified": "2025-07-08T04:03:04.386000",
          "created": "2025-06-08T04:45:43.423000",
          "tags": [
            "trojan",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "upxoepplace",
            "pulses none",
            "related tags",
            "none file",
            "markus",
            "april",
            "win32",
            "copy",
            "usvwu",
            "usvw",
            "high",
            "medium",
            "show",
            "uss c",
            "binary file",
            "yara",
            "write",
            "delphi",
            "enigma",
            "present mar",
            "aaaa",
            "united",
            "passive dns",
            "date",
            "present nov",
            "moved",
            "urls",
            "creation date",
            "entries",
            "body",
            "trojandropper",
            "susp",
            "msr jul",
            "next associated",
            "pulse pulses",
            "mtb jun",
            "backdoor",
            "content length",
            "html document",
            "ascii text",
            "search",
            "internalname",
            "entries pe",
            "showing",
            "filehash",
            "md5 add",
            "av detections",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "encrypt",
            "june",
            "hybrid",
            "local",
            "path",
            "click",
            "twitter",
            "strings",
            "url https",
            "url http",
            "report spam",
            "created",
            "hours ago",
            "bad actor",
            "ck ids",
            "t1057",
            "discovery",
            "t1071",
            "amer",
            "ipv4",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "china",
            "hong kong",
            "russia",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "pulses url",
            "filehashsha256",
            "url add",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "domain",
            "hostname",
            "next",
            "filehashmd5",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 637,
            "FileHash-SHA1": 639,
            "FileHash-SHA256": 5380,
            "domain": 676,
            "hostname": 1120,
            "URL": 1031,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9487,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "327 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 19004
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/freeav.com",
    "whois": "http://whois.domaintools.com/freeav.com",
    "domain": "freeav.com",
    "hostname": "www.freeav.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68ff6bf46f5d8662048ca7a1",
      "name": "symcd.com \u2022 Netify.ai",
      "description": "Seen in multiple attacks including CrowdStrike\nincident that was truly a breach found and reported prior to outage. SYCMD..com\nis consistently removed / deleted from pulses.\n\nI have nothing to say. OTX will pulse this let\u2019s see if anything happens..\n#rootkit? #ai #netify #malware #running_webserver #ottowa #elf #agent #malware #known #network_icmp #nolookup_communication\nantivm_generic_disk #dead host\n#dumped_buffer\n#network_cnc_http\n#network_http\n#allocates_rwx\n#av_detect_china_key #m\n[ELF:Agent-VW\\ [Trj]]\nIDS Detections :\n*GoBrut Service Bruter CnC Activity \n*GoBrut Service Bruter CnC Checkin \n*Generic.Go.Bruteforcer CnC Beacon\neval String.fromCharCode String Which May Be #malicious\nYara Detections:\ncompromised_site_redirector_fromcharcode\nfromCharCode | Yara Detections:\nKnownMaliciousObfuscationPattern\n[External IP Address Lookup via api .ip138 .com]\n[Win.Malware.Softcnapp-6932830-0]\nMultiple malware attack.",
      "modified": "2025-11-26T12:00:39.551000",
      "created": "2025-10-27T12:56:20.090000",
      "tags": [
        "present may",
        "present jun",
        "name servers",
        "united",
        "status",
        "present aug",
        "present oct",
        "present jul",
        "present mar",
        "present nov",
        "date",
        "digicert",
        "whois",
        "forums",
        "symantec",
        "comcast",
        "levelblue",
        "open threat",
        "pulse",
        "urls",
        "as13335",
        "info",
        "server",
        "domain status",
        "registrar abuse",
        "registrar",
        "dnssec",
        "domain name",
        "us registrant",
        "email",
        "contact email",
        "host name",
        "handle",
        "rdap database",
        "iana registrar",
        "present sep",
        "canada unknown",
        "moved",
        "ip address",
        "search",
        "title",
        "encrypt",
        "ubuntu",
        "linux x8664",
        "gobrut service",
        "bruter cnc",
        "entries",
        "show",
        "activity",
        "stca",
        "unknown",
        "malware",
        "copy",
        "next",
        "team",
        "script urls",
        "a domains",
        "passive dns",
        "gmt server",
        "content type",
        "body",
        "meta",
        "for privacy",
        "creation date",
        "name redacted",
        "expiration date",
        "servers",
        "hostname add",
        "pulse pulses",
        "13371",
        "qq v",
        "process32nextw",
        "regopenkeyexw",
        "medium",
        "langchinese",
        "get na",
        "rticon",
        "security",
        "high",
        "win32",
        "write",
        "dynamicloader",
        "checks",
        "alerts",
        "bios",
        "dynamic",
        "total",
        "read",
        "delete",
        "name strings",
        "south korea"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia",
        "Canada",
        "Bulgaria",
        "Germany",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3301,
        "email": 9,
        "hostname": 1202,
        "FileHash-SHA256": 1967,
        "domain": 1885,
        "FileHash-MD5": 153,
        "FileHash-SHA1": 151,
        "CVE": 1,
        "SSLCertFingerprint": 82,
        "FilePath": 1
      },
      "indicator_count": 8752,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "186 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68451577ada8bb0aa0834edb",
      "name": "X - Business Social Media Account used to attack victim",
      "description": "Victims business social media accounts deleted. Used to commit malicious activity against businesses, espionage , financial abuse.",
      "modified": "2025-07-08T04:03:04.386000",
      "created": "2025-06-08T04:45:43.423000",
      "tags": [
        "trojan",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "upxoepplace",
        "pulses none",
        "related tags",
        "none file",
        "markus",
        "april",
        "win32",
        "copy",
        "usvwu",
        "usvw",
        "high",
        "medium",
        "show",
        "uss c",
        "binary file",
        "yara",
        "write",
        "delphi",
        "enigma",
        "present mar",
        "aaaa",
        "united",
        "passive dns",
        "date",
        "present nov",
        "moved",
        "urls",
        "creation date",
        "entries",
        "body",
        "trojandropper",
        "susp",
        "msr jul",
        "next associated",
        "pulse pulses",
        "mtb jun",
        "backdoor",
        "content length",
        "html document",
        "ascii text",
        "search",
        "internalname",
        "entries pe",
        "showing",
        "filehash",
        "md5 add",
        "av detections",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "encrypt",
        "june",
        "hybrid",
        "local",
        "path",
        "click",
        "twitter",
        "strings",
        "url https",
        "url http",
        "report spam",
        "created",
        "hours ago",
        "bad actor",
        "ck ids",
        "t1057",
        "discovery",
        "t1071",
        "amer",
        "ipv4",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "china",
        "hong kong",
        "russia",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "pulses url",
        "filehashsha256",
        "url add",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "domain",
        "hostname",
        "next",
        "filehashmd5",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 637,
        "FileHash-SHA1": 639,
        "FileHash-SHA256": 5380,
        "domain": 676,
        "hostname": 1120,
        "URL": 1031,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9487,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "327 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.freeav.com/7",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.freeav.com/7",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780235438.339027
}