{
  "type": "URL",
  "indicator": "https://www.msps.es",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.msps.es",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3771294017,
      "indicator": "https://www.msps.es",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6529c91a4f8f0c898f48088c",
          "name": "quick look at vk.com",
          "description": "",
          "modified": "2025-06-26T22:23:19.431000",
          "created": "2023-10-13T22:47:54.295000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 18,
            "FileHash-SHA1": 18,
            "FileHash-SHA256": 1981,
            "domain": 506,
            "hostname": 1258,
            "URL": 3080
          },
          "indicator_count": 6861,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 180,
          "modified_text": "297 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a975e2a76dd4ddaec80a",
          "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex",
          "description": "",
          "modified": "2023-12-06T17:03:49.269000",
          "created": "2023-12-06T17:03:49.269000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 8,
            "FileHash-SHA256": 2173,
            "domain": 584,
            "hostname": 1707,
            "URL": 4145,
            "FileHash-SHA1": 545,
            "FileHash-MD5": 1071
          },
          "indicator_count": 10233,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a8ec0568abca6f44e16f",
          "name": "quick look at vk.com",
          "description": "",
          "modified": "2023-12-06T17:01:32.275000",
          "created": "2023-12-06T17:01:32.275000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1981,
            "domain": 506,
            "hostname": 1262,
            "URL": 3080,
            "FileHash-MD5": 18,
            "FileHash-SHA1": 18
          },
          "indicator_count": 6865,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652c33c45c1f1566c4b8c6a2",
          "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex",
          "description": "https://login.live.com/oauth20_remoteconnect.srf\nInvalid CRDS Token\nI suffered quite an attack on my devices. My personal experience, phone service changed, embedding., privilege escalation adversaries,  remote probe, obvious unauthorized microsoft usage multiple logins. embedded  phone service apps, injected, unknown apps, dumping. connect/shared/ tethered to other clouds, apps devices, decrypted phone., cookies turned off after attack, no Google, other search engine access, passwords compromised malicious Google sorry index w/Azorult. I am targeted. Usual suspects\nPrior: 'D241 connect test was successful messages'. Wifi and cellular issues.\nAftermath, Zombie devices. C2. Calls don't connect, keyloggers, etc",
          "modified": "2023-11-14T17:01:45.019000",
          "created": "2023-10-15T18:47:32.354000",
          "tags": [
            "whois record",
            "historical ssl",
            "ssl certificate",
            "communicating",
            "referrer",
            "united",
            "mail spammer",
            "detection list",
            "ip address",
            "blacklist",
            "possiblecerber",
            "outlook",
            "covid19",
            "artemis",
            "unsafe",
            "cisco umbrella",
            "site",
            "safe site",
            "phishing site",
            "malicious site",
            "malware",
            "malware site",
            "alexa top",
            "million",
            "phishingms",
            "exploit",
            "live",
            "blacklist https",
            "javascript",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "p3p cp",
            "pragma",
            "whois whois",
            "contacted",
            "threat network",
            "pe resource",
            "uatrue url",
            "typepv",
            "probe",
            "execution",
            "core",
            "emotet",
            "remcos",
            "nokoyawa",
            "asyncrat",
            "heur",
            "anonymizer",
            "firehol",
            "trojanx",
            "agent",
            "riskware",
            "trojan",
            "binder",
            "small",
            "downloader",
            "hupigon",
            "crypt",
            "cobalt strike",
            "union",
            "team",
            "agent tesla",
            "malicious",
            "fakealert",
            "dbatloader",
            "stealer",
            "nanocore rat",
            "formbook",
            "dropper",
            "dridex",
            "hawkeye",
            "netwire",
            "download",
            "opencandy",
            "bladabindi",
            "phishing",
            "bank",
            "alexa",
            "trojanspy",
            "maltiverse",
            "uatrue",
            "processorx86",
            "langen",
            "generic malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "injected",
            "mitre",
            "attack",
            "cybercrime",
            "Suspicious.Save",
            "dns server",
            "scanning ip's",
            "Backdoor.Remcos",
            "Threats200220200050",
            "IOC_19052020",
            "behaves like emotet"
          ],
          "references": [
            "https://login.live.com/oauth20_remoteconnect.srf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "France"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Agent Tesla - S0331",
              "display_name": "Agent Tesla - S0331",
              "target": null
            },
            {
              "id": "HawkEye Keylogger",
              "display_name": "HawkEye Keylogger",
              "target": null
            },
            {
              "id": "Suspicious.Save",
              "display_name": "Suspicious.Save",
              "target": null
            },
            {
              "id": "Application.Generic",
              "display_name": "Application.Generic",
              "target": null
            },
            {
              "id": "Backdoor.RemoteManipulator",
              "display_name": "Backdoor.RemoteManipulator",
              "target": null
            },
            {
              "id": "Gen:Heur.Ransom.HiddenTears",
              "display_name": "Gen:Heur.Ransom.HiddenTears",
              "target": null
            },
            {
              "id": "XOR.DDoS",
              "display_name": "XOR.DDoS",
              "target": null
            },
            {
              "id": "Backdoor.Remcos",
              "display_name": "Backdoor.Remcos",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 34,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1071,
            "FileHash-SHA1": 545,
            "FileHash-SHA256": 2173,
            "domain": 584,
            "hostname": 1707,
            "URL": 4145,
            "CVE": 8
          },
          "indicator_count": 10233,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "887 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f1c989df5416bd0ff3d38",
          "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex",
          "description": "",
          "modified": "2023-11-14T17:01:45.019000",
          "created": "2023-10-30T03:01:44.846000",
          "tags": [
            "whois record",
            "historical ssl",
            "ssl certificate",
            "communicating",
            "referrer",
            "united",
            "mail spammer",
            "detection list",
            "ip address",
            "blacklist",
            "possiblecerber",
            "outlook",
            "covid19",
            "artemis",
            "unsafe",
            "cisco umbrella",
            "site",
            "safe site",
            "phishing site",
            "malicious site",
            "malware",
            "malware site",
            "alexa top",
            "million",
            "phishingms",
            "exploit",
            "live",
            "blacklist https",
            "javascript",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "p3p cp",
            "pragma",
            "whois whois",
            "contacted",
            "threat network",
            "pe resource",
            "uatrue url",
            "typepv",
            "probe",
            "execution",
            "core",
            "emotet",
            "remcos",
            "nokoyawa",
            "asyncrat",
            "heur",
            "anonymizer",
            "firehol",
            "trojanx",
            "agent",
            "riskware",
            "trojan",
            "binder",
            "small",
            "downloader",
            "hupigon",
            "crypt",
            "cobalt strike",
            "union",
            "team",
            "agent tesla",
            "malicious",
            "fakealert",
            "dbatloader",
            "stealer",
            "nanocore rat",
            "formbook",
            "dropper",
            "dridex",
            "hawkeye",
            "netwire",
            "download",
            "opencandy",
            "bladabindi",
            "phishing",
            "bank",
            "alexa",
            "trojanspy",
            "maltiverse",
            "uatrue",
            "processorx86",
            "langen",
            "generic malware",
            "fakedout threat",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "injected",
            "mitre",
            "attack",
            "cybercrime",
            "Suspicious.Save",
            "dns server",
            "scanning ip's",
            "Backdoor.Remcos",
            "Threats200220200050",
            "IOC_19052020",
            "behaves like emotet"
          ],
          "references": [
            "https://login.live.com/oauth20_remoteconnect.srf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "France"
          ],
          "malware_families": [
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Dridex",
              "display_name": "Dridex",
              "target": null
            },
            {
              "id": "Agent Tesla - S0331",
              "display_name": "Agent Tesla - S0331",
              "target": null
            },
            {
              "id": "HawkEye Keylogger",
              "display_name": "HawkEye Keylogger",
              "target": null
            },
            {
              "id": "Suspicious.Save",
              "display_name": "Suspicious.Save",
              "target": null
            },
            {
              "id": "Application.Generic",
              "display_name": "Application.Generic",
              "target": null
            },
            {
              "id": "Backdoor.RemoteManipulator",
              "display_name": "Backdoor.RemoteManipulator",
              "target": null
            },
            {
              "id": "Gen:Heur.Ransom.HiddenTears",
              "display_name": "Gen:Heur.Ransom.HiddenTears",
              "target": null
            },
            {
              "id": "XOR.DDoS",
              "display_name": "XOR.DDoS",
              "target": null
            },
            {
              "id": "Backdoor.Remcos",
              "display_name": "Backdoor.Remcos",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1593.002",
              "name": "Search Engines",
              "display_name": "T1593.002 - Search Engines"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "652c33c45c1f1566c4b8c6a2",
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1071,
            "FileHash-SHA1": 545,
            "FileHash-SHA256": 2173,
            "domain": 584,
            "hostname": 1707,
            "URL": 4145,
            "CVE": 8
          },
          "indicator_count": 10233,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "887 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://login.live.com/oauth20_remoteconnect.srf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Suspicious.save",
            "Application.generic",
            "Maltiverse",
            "Backdoor.remotemanipulator",
            "Gen:heur.ransom.hiddentears",
            "Backdoor.remcos",
            "Dridex",
            "Xor.ddos",
            "Hawkeye keylogger",
            "Agent tesla - s0331"
          ],
          "industries": [],
          "unique_indicators": 17195
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/msps.es",
    "whois": "http://whois.domaintools.com/msps.es",
    "domain": "msps.es",
    "hostname": "www.msps.es"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6529c91a4f8f0c898f48088c",
      "name": "quick look at vk.com",
      "description": "",
      "modified": "2025-06-26T22:23:19.431000",
      "created": "2023-10-13T22:47:54.295000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 18,
        "FileHash-SHA1": 18,
        "FileHash-SHA256": 1981,
        "domain": 506,
        "hostname": 1258,
        "URL": 3080
      },
      "indicator_count": 6861,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 180,
      "modified_text": "297 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a975e2a76dd4ddaec80a",
      "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex",
      "description": "",
      "modified": "2023-12-06T17:03:49.269000",
      "created": "2023-12-06T17:03:49.269000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 8,
        "FileHash-SHA256": 2173,
        "domain": 584,
        "hostname": 1707,
        "URL": 4145,
        "FileHash-SHA1": 545,
        "FileHash-MD5": 1071
      },
      "indicator_count": 10233,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a8ec0568abca6f44e16f",
      "name": "quick look at vk.com",
      "description": "",
      "modified": "2023-12-06T17:01:32.275000",
      "created": "2023-12-06T17:01:32.275000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1981,
        "domain": 506,
        "hostname": 1262,
        "URL": 3080,
        "FileHash-MD5": 18,
        "FileHash-SHA1": 18
      },
      "indicator_count": 6865,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "652c33c45c1f1566c4b8c6a2",
      "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex",
      "description": "https://login.live.com/oauth20_remoteconnect.srf\nInvalid CRDS Token\nI suffered quite an attack on my devices. My personal experience, phone service changed, embedding., privilege escalation adversaries,  remote probe, obvious unauthorized microsoft usage multiple logins. embedded  phone service apps, injected, unknown apps, dumping. connect/shared/ tethered to other clouds, apps devices, decrypted phone., cookies turned off after attack, no Google, other search engine access, passwords compromised malicious Google sorry index w/Azorult. I am targeted. Usual suspects\nPrior: 'D241 connect test was successful messages'. Wifi and cellular issues.\nAftermath, Zombie devices. C2. Calls don't connect, keyloggers, etc",
      "modified": "2023-11-14T17:01:45.019000",
      "created": "2023-10-15T18:47:32.354000",
      "tags": [
        "whois record",
        "historical ssl",
        "ssl certificate",
        "communicating",
        "referrer",
        "united",
        "mail spammer",
        "detection list",
        "ip address",
        "blacklist",
        "possiblecerber",
        "outlook",
        "covid19",
        "artemis",
        "unsafe",
        "cisco umbrella",
        "site",
        "safe site",
        "phishing site",
        "malicious site",
        "malware",
        "malware site",
        "alexa top",
        "million",
        "phishingms",
        "exploit",
        "live",
        "blacklist https",
        "javascript",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "p3p cp",
        "pragma",
        "whois whois",
        "contacted",
        "threat network",
        "pe resource",
        "uatrue url",
        "typepv",
        "probe",
        "execution",
        "core",
        "emotet",
        "remcos",
        "nokoyawa",
        "asyncrat",
        "heur",
        "anonymizer",
        "firehol",
        "trojanx",
        "agent",
        "riskware",
        "trojan",
        "binder",
        "small",
        "downloader",
        "hupigon",
        "crypt",
        "cobalt strike",
        "union",
        "team",
        "agent tesla",
        "malicious",
        "fakealert",
        "dbatloader",
        "stealer",
        "nanocore rat",
        "formbook",
        "dropper",
        "dridex",
        "hawkeye",
        "netwire",
        "download",
        "opencandy",
        "bladabindi",
        "phishing",
        "bank",
        "alexa",
        "trojanspy",
        "maltiverse",
        "uatrue",
        "processorx86",
        "langen",
        "generic malware",
        "fakedout threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "injected",
        "mitre",
        "attack",
        "cybercrime",
        "Suspicious.Save",
        "dns server",
        "scanning ip's",
        "Backdoor.Remcos",
        "Threats200220200050",
        "IOC_19052020",
        "behaves like emotet"
      ],
      "references": [
        "https://login.live.com/oauth20_remoteconnect.srf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "France"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Dridex",
          "display_name": "Dridex",
          "target": null
        },
        {
          "id": "Agent Tesla - S0331",
          "display_name": "Agent Tesla - S0331",
          "target": null
        },
        {
          "id": "HawkEye Keylogger",
          "display_name": "HawkEye Keylogger",
          "target": null
        },
        {
          "id": "Suspicious.Save",
          "display_name": "Suspicious.Save",
          "target": null
        },
        {
          "id": "Application.Generic",
          "display_name": "Application.Generic",
          "target": null
        },
        {
          "id": "Backdoor.RemoteManipulator",
          "display_name": "Backdoor.RemoteManipulator",
          "target": null
        },
        {
          "id": "Gen:Heur.Ransom.HiddenTears",
          "display_name": "Gen:Heur.Ransom.HiddenTears",
          "target": null
        },
        {
          "id": "XOR.DDoS",
          "display_name": "XOR.DDoS",
          "target": null
        },
        {
          "id": "Backdoor.Remcos",
          "display_name": "Backdoor.Remcos",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 34,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1071,
        "FileHash-SHA1": 545,
        "FileHash-SHA256": 2173,
        "domain": 584,
        "hostname": 1707,
        "URL": 4145,
        "CVE": 8
      },
      "indicator_count": 10233,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "887 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f1c989df5416bd0ff3d38",
      "name": "Remote Access attack | Agent Tesla | C2 | BatLoader | C2 | Dridex",
      "description": "",
      "modified": "2023-11-14T17:01:45.019000",
      "created": "2023-10-30T03:01:44.846000",
      "tags": [
        "whois record",
        "historical ssl",
        "ssl certificate",
        "communicating",
        "referrer",
        "united",
        "mail spammer",
        "detection list",
        "ip address",
        "blacklist",
        "possiblecerber",
        "outlook",
        "covid19",
        "artemis",
        "unsafe",
        "cisco umbrella",
        "site",
        "safe site",
        "phishing site",
        "malicious site",
        "malware",
        "malware site",
        "alexa top",
        "million",
        "phishingms",
        "exploit",
        "live",
        "blacklist https",
        "javascript",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "p3p cp",
        "pragma",
        "whois whois",
        "contacted",
        "threat network",
        "pe resource",
        "uatrue url",
        "typepv",
        "probe",
        "execution",
        "core",
        "emotet",
        "remcos",
        "nokoyawa",
        "asyncrat",
        "heur",
        "anonymizer",
        "firehol",
        "trojanx",
        "agent",
        "riskware",
        "trojan",
        "binder",
        "small",
        "downloader",
        "hupigon",
        "crypt",
        "cobalt strike",
        "union",
        "team",
        "agent tesla",
        "malicious",
        "fakealert",
        "dbatloader",
        "stealer",
        "nanocore rat",
        "formbook",
        "dropper",
        "dridex",
        "hawkeye",
        "netwire",
        "download",
        "opencandy",
        "bladabindi",
        "phishing",
        "bank",
        "alexa",
        "trojanspy",
        "maltiverse",
        "uatrue",
        "processorx86",
        "langen",
        "generic malware",
        "fakedout threat",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "injected",
        "mitre",
        "attack",
        "cybercrime",
        "Suspicious.Save",
        "dns server",
        "scanning ip's",
        "Backdoor.Remcos",
        "Threats200220200050",
        "IOC_19052020",
        "behaves like emotet"
      ],
      "references": [
        "https://login.live.com/oauth20_remoteconnect.srf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "France"
      ],
      "malware_families": [
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Dridex",
          "display_name": "Dridex",
          "target": null
        },
        {
          "id": "Agent Tesla - S0331",
          "display_name": "Agent Tesla - S0331",
          "target": null
        },
        {
          "id": "HawkEye Keylogger",
          "display_name": "HawkEye Keylogger",
          "target": null
        },
        {
          "id": "Suspicious.Save",
          "display_name": "Suspicious.Save",
          "target": null
        },
        {
          "id": "Application.Generic",
          "display_name": "Application.Generic",
          "target": null
        },
        {
          "id": "Backdoor.RemoteManipulator",
          "display_name": "Backdoor.RemoteManipulator",
          "target": null
        },
        {
          "id": "Gen:Heur.Ransom.HiddenTears",
          "display_name": "Gen:Heur.Ransom.HiddenTears",
          "target": null
        },
        {
          "id": "XOR.DDoS",
          "display_name": "XOR.DDoS",
          "target": null
        },
        {
          "id": "Backdoor.Remcos",
          "display_name": "Backdoor.Remcos",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1593.002",
          "name": "Search Engines",
          "display_name": "T1593.002 - Search Engines"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "652c33c45c1f1566c4b8c6a2",
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1071,
        "FileHash-SHA1": 545,
        "FileHash-SHA256": 2173,
        "domain": 584,
        "hostname": 1707,
        "URL": 4145,
        "CVE": 8
      },
      "indicator_count": 10233,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "887 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.msps.es",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.msps.es",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776642192.3251624
}