{
  "type": "URL",
  "indicator": "https://www.maps.bing.com.au/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.maps.bing.com.au/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4074466058,
      "indicator": "https://www.maps.bing.com.au/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "687c35cf7d17a6aa9a0725d7",
          "name": "Brave Browser | Spyware on servers | Pegasus",
          "description": "After an in-depth investigation it has been concluded that Brave hosts Pegasus spyware on its servers. Brave claims to be a secure and private web browser with a multitude of protections (which actually work). However, Brave is based in San Francisco, California, USA, and apparently they have been forced to install spyware on their servers to comply with court requirements and facilitate law enforcement. This is a direct blow to users' privacy. You can continue to use Brave after blocking all related domains and IP addresses.",
          "modified": "2025-09-04T14:52:00.323000",
          "created": "2025-07-20T00:18:23.144000",
          "tags": [
            "brave",
            "browser",
            "software",
            "spyware",
            "malware",
            "pegasus"
          ],
          "references": [
            "https://cybersecuritynews.com/brave-browser-vulnerability-malicious-website/",
            "https://community.brave.com/t/brave-has-become-malware/510414",
            "https://community.brave.com/t/are-there-any-valid-privacy-or-security-concerns-in-this-discussion/507472"
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [
            "United States of America",
            "Australia",
            "Brazil",
            "Canada",
            "Cuba",
            "France",
            "Iran, Islamic Republic of",
            "Germany",
            "Palestine",
            "Iraq",
            "India",
            "Libya",
            "Mexico",
            "Russian Federation",
            "Spain",
            "China",
            "Venezuela, Bolivarian Republic of"
          ],
          "malware_families": [
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1596.001",
              "name": "DNS/Passive DNS",
              "display_name": "T1596.001 - DNS/Passive DNS"
            },
            {
              "id": "T1596.004",
              "name": "CDNs",
              "display_name": "T1596.004 - CDNs"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1583.002",
              "name": "DNS Server",
              "display_name": "T1583.002 - DNS Server"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1516",
              "name": "Input Injection",
              "display_name": "T1516 - Input Injection"
            },
            {
              "id": "T1476",
              "name": "Deliver Malicious App via Other Means",
              "display_name": "T1476 - Deliver Malicious App via Other Means"
            },
            {
              "id": "T1204.002",
              "name": "Malicious File",
              "display_name": "T1204.002 - Malicious File"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            }
          ],
          "industries": [
            "Civil",
            "Civilians",
            "People"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "privacynotacrime",
            "id": "349346",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 35,
            "domain": 115,
            "hostname": 344,
            "URL": 1034,
            "FileHash-SHA256": 303,
            "CVE": 1
          },
          "indicator_count": 1832,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 59,
          "modified_text": "269 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "686cb765dc6737fd1e882630",
          "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
          "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
          "modified": "2025-08-07T05:01:52.697000",
          "created": "2025-07-08T06:15:01.296000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "iocs",
            "review iocs",
            "pulse show",
            "search",
            "type indicator",
            "role title",
            "expiration",
            "url http",
            "url https",
            "text drag",
            "drop or",
            "enter source",
            "url or",
            "hostname",
            "ipv4",
            "related pulses",
            "showing",
            "entries",
            "drop",
            "domain",
            "enter",
            "extract",
            "browse to",
            "domain xn",
            "select file",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "indicator role",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 840,
            "FileHash-SHA1": 725,
            "FileHash-SHA256": 863,
            "URL": 1663,
            "SSLCertFingerprint": 17,
            "domain": 520,
            "hostname": 734,
            "email": 11
          },
          "indicator_count": 5373,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "297 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "686cb7673e4d5a0067758fd7",
          "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
          "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
          "modified": "2025-08-07T05:01:52.697000",
          "created": "2025-07-08T06:15:03.501000",
          "tags": [
            "no expiration",
            "filehashmd5",
            "filehashsha1",
            "filehashsha256",
            "iocs",
            "review iocs",
            "pulse show",
            "search",
            "type indicator",
            "role title",
            "expiration",
            "url http",
            "url https",
            "text drag",
            "drop or",
            "enter source",
            "url or",
            "hostname",
            "ipv4",
            "related pulses",
            "showing",
            "entries",
            "drop",
            "domain",
            "enter",
            "extract",
            "browse to",
            "domain xn",
            "select file",
            "pdf report",
            "pcap",
            "stix",
            "openioc",
            "indicator role",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 840,
            "FileHash-SHA1": 725,
            "FileHash-SHA256": 863,
            "URL": 1663,
            "SSLCertFingerprint": 17,
            "domain": 520,
            "hostname": 734,
            "email": 11
          },
          "indicator_count": 5373,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "297 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684a3719a2708183b1b16d00",
          "name": "Follow Bot (black-basta_cova_cryptb) affects threat researcher(s)account(s)",
          "description": "Surprised: \nFollow bot account  affects threat researcher(s)account(s). % path , attempts DoS. Threatening account name,. \n\n\n(00285c99b52d41679b1aa3b8a80895b037df8a7500f4ad97ce06068eac4a95b7 | =\nfollow) \n|| {2025-05-20_bf3a6ba6e3421a7214ffbfe97642a578_amadey_black-basta_cova_cryptbot_elex_luca-stealer\nFastCopy5.9.0.exe}\n\nET DNS Query for .cc \n PROTOCOL-ICMP PATH MTU denial of service attempt\nPROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set",
          "modified": "2025-07-12T01:02:11.925000",
          "created": "2025-06-12T02:10:33.839000",
          "tags": [
            "gtmkvjvztk",
            "open threat",
            "learn",
            "levelblue",
            "exchange meta",
            "tags twitter",
            "alienvault",
            "script tags",
            "iframe tags",
            "google tag",
            "html internet",
            "html document",
            "ascii text",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "number",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "cus subject",
            "stwa lredmond",
            "omicrosoft c",
            "resolved ips",
            "get http",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "defense evasion",
            "ta0009 command",
            "impact ta0040",
            "catalog tree",
            "analysis ob0001",
            "analysis ob0002",
            "ob0007 impact",
            "ob0012 file",
            "system oc0001",
            "process oc0003",
            "data oc0004",
            "oc0008",
            "get https",
            "vis1",
            "oid2",
            "post https",
            "cjutxg",
            "base64uidenc",
            "error https"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 162,
            "FileHash-SHA1": 28,
            "FileHash-SHA256": 2459,
            "domain": 889,
            "hostname": 1217,
            "URL": 4326,
            "FilePath": 1
          },
          "indicator_count": 9082,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "324 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68451577ada8bb0aa0834edb",
          "name": "X - Business Social Media Account used to attack victim",
          "description": "Victims business social media accounts deleted. Used to commit malicious activity against businesses, espionage , financial abuse.",
          "modified": "2025-07-08T04:03:04.386000",
          "created": "2025-06-08T04:45:43.423000",
          "tags": [
            "trojan",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "file score",
            "upxoepplace",
            "pulses none",
            "related tags",
            "none file",
            "markus",
            "april",
            "win32",
            "copy",
            "usvwu",
            "usvw",
            "high",
            "medium",
            "show",
            "uss c",
            "binary file",
            "yara",
            "write",
            "delphi",
            "enigma",
            "present mar",
            "aaaa",
            "united",
            "passive dns",
            "date",
            "present nov",
            "moved",
            "urls",
            "creation date",
            "entries",
            "body",
            "trojandropper",
            "susp",
            "msr jul",
            "next associated",
            "pulse pulses",
            "mtb jun",
            "backdoor",
            "content length",
            "html document",
            "ascii text",
            "search",
            "internalname",
            "entries pe",
            "showing",
            "filehash",
            "md5 add",
            "av detections",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "mitre att",
            "ck techniques",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "encrypt",
            "june",
            "hybrid",
            "local",
            "path",
            "click",
            "twitter",
            "strings",
            "url https",
            "url http",
            "report spam",
            "created",
            "hours ago",
            "bad actor",
            "ck ids",
            "t1057",
            "discovery",
            "t1071",
            "amer",
            "ipv4",
            "indicator role",
            "title added",
            "active related",
            "pulses",
            "china",
            "hong kong",
            "russia",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "pulses url",
            "filehashsha256",
            "url add",
            "http",
            "ip address",
            "related nids",
            "files location",
            "flag united",
            "domain",
            "hostname",
            "next",
            "filehashmd5",
            "protocol",
            "t1105",
            "tool transfer",
            "t1480"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 637,
            "FileHash-SHA1": 639,
            "FileHash-SHA256": 5380,
            "domain": 676,
            "hostname": 1120,
            "URL": 1031,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 9487,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "327 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://community.brave.com/t/are-there-any-valid-privacy-or-security-concerns-in-this-discussion/507472",
        "https://cybersecuritynews.com/brave-browser-vulnerability-malicious-website/",
        "https://community.brave.com/t/brave-has-become-malware/510414"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "[Unnamed group]"
          ],
          "malware_families": [
            "Pegasus - mob-s0005"
          ],
          "industries": [
            "Civil",
            "Civilians",
            "People"
          ],
          "unique_indicators": 25656
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/bing.com.au",
    "whois": "http://whois.domaintools.com/bing.com.au",
    "domain": "bing.com.au",
    "hostname": "www.maps.bing.com.au"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "687c35cf7d17a6aa9a0725d7",
      "name": "Brave Browser | Spyware on servers | Pegasus",
      "description": "After an in-depth investigation it has been concluded that Brave hosts Pegasus spyware on its servers. Brave claims to be a secure and private web browser with a multitude of protections (which actually work). However, Brave is based in San Francisco, California, USA, and apparently they have been forced to install spyware on their servers to comply with court requirements and facilitate law enforcement. This is a direct blow to users' privacy. You can continue to use Brave after blocking all related domains and IP addresses.",
      "modified": "2025-09-04T14:52:00.323000",
      "created": "2025-07-20T00:18:23.144000",
      "tags": [
        "brave",
        "browser",
        "software",
        "spyware",
        "malware",
        "pegasus"
      ],
      "references": [
        "https://cybersecuritynews.com/brave-browser-vulnerability-malicious-website/",
        "https://community.brave.com/t/brave-has-become-malware/510414",
        "https://community.brave.com/t/are-there-any-valid-privacy-or-security-concerns-in-this-discussion/507472"
      ],
      "public": 1,
      "adversary": "[Unnamed group]",
      "targeted_countries": [
        "United States of America",
        "Australia",
        "Brazil",
        "Canada",
        "Cuba",
        "France",
        "Iran, Islamic Republic of",
        "Germany",
        "Palestine",
        "Iraq",
        "India",
        "Libya",
        "Mexico",
        "Russian Federation",
        "Spain",
        "China",
        "Venezuela, Bolivarian Republic of"
      ],
      "malware_families": [
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1596.001",
          "name": "DNS/Passive DNS",
          "display_name": "T1596.001 - DNS/Passive DNS"
        },
        {
          "id": "T1596.004",
          "name": "CDNs",
          "display_name": "T1596.004 - CDNs"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1583.002",
          "name": "DNS Server",
          "display_name": "T1583.002 - DNS Server"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1516",
          "name": "Input Injection",
          "display_name": "T1516 - Input Injection"
        },
        {
          "id": "T1476",
          "name": "Deliver Malicious App via Other Means",
          "display_name": "T1476 - Deliver Malicious App via Other Means"
        },
        {
          "id": "T1204.002",
          "name": "Malicious File",
          "display_name": "T1204.002 - Malicious File"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        }
      ],
      "industries": [
        "Civil",
        "Civilians",
        "People"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "privacynotacrime",
        "id": "349346",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 35,
        "domain": 115,
        "hostname": 344,
        "URL": 1034,
        "FileHash-SHA256": 303,
        "CVE": 1
      },
      "indicator_count": 1832,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 59,
      "modified_text": "269 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "686cb765dc6737fd1e882630",
      "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
      "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
      "modified": "2025-08-07T05:01:52.697000",
      "created": "2025-07-08T06:15:01.296000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "iocs",
        "review iocs",
        "pulse show",
        "search",
        "type indicator",
        "role title",
        "expiration",
        "url http",
        "url https",
        "text drag",
        "drop or",
        "enter source",
        "url or",
        "hostname",
        "ipv4",
        "related pulses",
        "showing",
        "entries",
        "drop",
        "domain",
        "enter",
        "extract",
        "browse to",
        "domain xn",
        "select file",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "indicator role",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 840,
        "FileHash-SHA1": 725,
        "FileHash-SHA256": 863,
        "URL": 1663,
        "SSLCertFingerprint": 17,
        "domain": 520,
        "hostname": 734,
        "email": 11
      },
      "indicator_count": 5373,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "297 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "686cb7673e4d5a0067758fd7",
      "name": "2nd Attempt- VirusTotal Ransomware and Device destruction Attack",
      "description": "I hope this generates results. I continue to be unable to annotate. Witnesses attack and 5 very relevant graphs taken. \n#phishing #malware #trojan #ransom #virustotal",
      "modified": "2025-08-07T05:01:52.697000",
      "created": "2025-07-08T06:15:03.501000",
      "tags": [
        "no expiration",
        "filehashmd5",
        "filehashsha1",
        "filehashsha256",
        "iocs",
        "review iocs",
        "pulse show",
        "search",
        "type indicator",
        "role title",
        "expiration",
        "url http",
        "url https",
        "text drag",
        "drop or",
        "enter source",
        "url or",
        "hostname",
        "ipv4",
        "related pulses",
        "showing",
        "entries",
        "drop",
        "domain",
        "enter",
        "extract",
        "browse to",
        "domain xn",
        "select file",
        "pdf report",
        "pcap",
        "stix",
        "openioc",
        "indicator role",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 840,
        "FileHash-SHA1": 725,
        "FileHash-SHA256": 863,
        "URL": 1663,
        "SSLCertFingerprint": 17,
        "domain": 520,
        "hostname": 734,
        "email": 11
      },
      "indicator_count": 5373,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "297 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "684a3719a2708183b1b16d00",
      "name": "Follow Bot (black-basta_cova_cryptb) affects threat researcher(s)account(s)",
      "description": "Surprised: \nFollow bot account  affects threat researcher(s)account(s). % path , attempts DoS. Threatening account name,. \n\n\n(00285c99b52d41679b1aa3b8a80895b037df8a7500f4ad97ce06068eac4a95b7 | =\nfollow) \n|| {2025-05-20_bf3a6ba6e3421a7214ffbfe97642a578_amadey_black-basta_cova_cryptbot_elex_luca-stealer\nFastCopy5.9.0.exe}\n\nET DNS Query for .cc \n PROTOCOL-ICMP PATH MTU denial of service attempt\nPROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set",
      "modified": "2025-07-12T01:02:11.925000",
      "created": "2025-06-12T02:10:33.839000",
      "tags": [
        "gtmkvjvztk",
        "open threat",
        "learn",
        "levelblue",
        "exchange meta",
        "tags twitter",
        "alienvault",
        "script tags",
        "iframe tags",
        "google tag",
        "html internet",
        "html document",
        "ascii text",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "number",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "cus subject",
        "stwa lredmond",
        "omicrosoft c",
        "resolved ips",
        "get http",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "defense evasion",
        "ta0009 command",
        "impact ta0040",
        "catalog tree",
        "analysis ob0001",
        "analysis ob0002",
        "ob0007 impact",
        "ob0012 file",
        "system oc0001",
        "process oc0003",
        "data oc0004",
        "oc0008",
        "get https",
        "vis1",
        "oid2",
        "post https",
        "cjutxg",
        "base64uidenc",
        "error https"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 162,
        "FileHash-SHA1": 28,
        "FileHash-SHA256": 2459,
        "domain": 889,
        "hostname": 1217,
        "URL": 4326,
        "FilePath": 1
      },
      "indicator_count": 9082,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "324 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68451577ada8bb0aa0834edb",
      "name": "X - Business Social Media Account used to attack victim",
      "description": "Victims business social media accounts deleted. Used to commit malicious activity against businesses, espionage , financial abuse.",
      "modified": "2025-07-08T04:03:04.386000",
      "created": "2025-06-08T04:45:43.423000",
      "tags": [
        "trojan",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "file score",
        "upxoepplace",
        "pulses none",
        "related tags",
        "none file",
        "markus",
        "april",
        "win32",
        "copy",
        "usvwu",
        "usvw",
        "high",
        "medium",
        "show",
        "uss c",
        "binary file",
        "yara",
        "write",
        "delphi",
        "enigma",
        "present mar",
        "aaaa",
        "united",
        "passive dns",
        "date",
        "present nov",
        "moved",
        "urls",
        "creation date",
        "entries",
        "body",
        "trojandropper",
        "susp",
        "msr jul",
        "next associated",
        "pulse pulses",
        "mtb jun",
        "backdoor",
        "content length",
        "html document",
        "ascii text",
        "search",
        "internalname",
        "entries pe",
        "showing",
        "filehash",
        "md5 add",
        "av detections",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "mitre att",
        "ck techniques",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "encrypt",
        "june",
        "hybrid",
        "local",
        "path",
        "click",
        "twitter",
        "strings",
        "url https",
        "url http",
        "report spam",
        "created",
        "hours ago",
        "bad actor",
        "ck ids",
        "t1057",
        "discovery",
        "t1071",
        "amer",
        "ipv4",
        "indicator role",
        "title added",
        "active related",
        "pulses",
        "china",
        "hong kong",
        "russia",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "pulses url",
        "filehashsha256",
        "url add",
        "http",
        "ip address",
        "related nids",
        "files location",
        "flag united",
        "domain",
        "hostname",
        "next",
        "filehashmd5",
        "protocol",
        "t1105",
        "tool transfer",
        "t1480"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 637,
        "FileHash-SHA1": 639,
        "FileHash-SHA256": 5380,
        "domain": 676,
        "hostname": 1120,
        "URL": 1031,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 9487,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "327 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.maps.bing.com.au/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.maps.bing.com.au/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780286029.1588547
}