{
  "type": "URL",
  "indicator": "https://www.pavementgroup.com/content/engine/engine_url_parser.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.pavementgroup.com/content/engine/engine_url_parser.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4119800047,
      "indicator": "https://www.pavementgroup.com/content/engine/engine_url_parser.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "689d5115ad786de4ff048e5b",
          "name": "TEL:ECCert!SSLCO | Mirai Malware Hosting | Multi user Tracker",
          "description": "https://api.mirai.com/MiraiWebService/passbook/180823-77257/4001645 [Malware hosting]\n*TEL:ECCert!SSLCO\nYARA Detections:\nDelphi\nThis program must be run under Win32\ncompilers.\nCode Overlap of Trojan Droppers Backdoors , TrojanSpy\n\n\n#injection_inter_process\n#creates_largekey\n#network_bind\n#ransomware_file_modifications\n#antivm_generic_bios\n#antivm_generic_disk\n#enumerates_physical_drives\n#physical_drive_access\n#deletes_executed_files\n#recon_fingerprint\n#suspicious_command_tools\n#anomalous_deletefile\n#antisandbox_sleep\n#dead_connect\n#dynamic_function_loading\n#http_request\n#ipc_namedpipe\n#network_anomaly\n#powershell_download\n#powershell_request #track #locate #remote_access",
          "modified": "2025-09-13T02:00:42.729000",
          "created": "2025-08-14T02:59:33.036000",
          "tags": [
            "url https",
            "url http",
            "search",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "showing",
            "entries",
            "present sep",
            "united",
            "present aug",
            "present jul",
            "present jun",
            "moved",
            "unknown ns",
            "present may",
            "present apr",
            "passive dns",
            "date",
            "encrypt",
            "body",
            "cookie",
            "gmt server",
            "content type",
            "dynamicloader",
            "medium",
            "x17x03x01",
            "download studio",
            "high",
            "read c",
            "show",
            "windows",
            "copy",
            "powershell",
            "write",
            "anomaly",
            "next",
            "unknown",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "yara detections",
            "delphi",
            "codeoverlap",
            "win32",
            "rgba",
            "memcommit",
            "delete",
            "png image",
            "hash",
            "dock",
            "execution",
            "malware",
            "wine emulator",
            "dynamic",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "capture",
            "persistence",
            "sha256",
            "submitted",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "script",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "null",
            "august",
            "span",
            "refresh",
            "meta",
            "mirai",
            "february",
            "april",
            "june",
            "hybrid",
            "general",
            "local",
            "path",
            "click",
            "strings",
            "error",
            "tools",
            "caribe",
            "rest",
            "accept",
            "friday",
            "look",
            "verify",
            "restart"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1539",
              "name": "Steal Web Session Cookie",
              "display_name": "T1539 - Steal Web Session Cookie"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6211,
            "domain": 682,
            "hostname": 1661,
            "FileHash-MD5": 117,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 1386,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 10162,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "218 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 10225
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/pavementgroup.com",
    "whois": "http://whois.domaintools.com/pavementgroup.com",
    "domain": "pavementgroup.com",
    "hostname": "www.pavementgroup.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "689d5115ad786de4ff048e5b",
      "name": "TEL:ECCert!SSLCO | Mirai Malware Hosting | Multi user Tracker",
      "description": "https://api.mirai.com/MiraiWebService/passbook/180823-77257/4001645 [Malware hosting]\n*TEL:ECCert!SSLCO\nYARA Detections:\nDelphi\nThis program must be run under Win32\ncompilers.\nCode Overlap of Trojan Droppers Backdoors , TrojanSpy\n\n\n#injection_inter_process\n#creates_largekey\n#network_bind\n#ransomware_file_modifications\n#antivm_generic_bios\n#antivm_generic_disk\n#enumerates_physical_drives\n#physical_drive_access\n#deletes_executed_files\n#recon_fingerprint\n#suspicious_command_tools\n#anomalous_deletefile\n#antisandbox_sleep\n#dead_connect\n#dynamic_function_loading\n#http_request\n#ipc_namedpipe\n#network_anomaly\n#powershell_download\n#powershell_request #track #locate #remote_access",
      "modified": "2025-09-13T02:00:42.729000",
      "created": "2025-08-14T02:59:33.036000",
      "tags": [
        "url https",
        "url http",
        "search",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "showing",
        "entries",
        "present sep",
        "united",
        "present aug",
        "present jul",
        "present jun",
        "moved",
        "unknown ns",
        "present may",
        "present apr",
        "passive dns",
        "date",
        "encrypt",
        "body",
        "cookie",
        "gmt server",
        "content type",
        "dynamicloader",
        "medium",
        "x17x03x01",
        "download studio",
        "high",
        "read c",
        "show",
        "windows",
        "copy",
        "powershell",
        "write",
        "anomaly",
        "next",
        "unknown",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "yara detections",
        "delphi",
        "codeoverlap",
        "win32",
        "rgba",
        "memcommit",
        "delete",
        "png image",
        "hash",
        "dock",
        "execution",
        "malware",
        "wine emulator",
        "dynamic",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "capture",
        "persistence",
        "sha256",
        "submitted",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "script",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "null",
        "august",
        "span",
        "refresh",
        "meta",
        "mirai",
        "february",
        "april",
        "june",
        "hybrid",
        "general",
        "local",
        "path",
        "click",
        "strings",
        "error",
        "tools",
        "caribe",
        "rest",
        "accept",
        "friday",
        "look",
        "verify",
        "restart"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1539",
          "name": "Steal Web Session Cookie",
          "display_name": "T1539 - Steal Web Session Cookie"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6211,
        "domain": 682,
        "hostname": 1661,
        "FileHash-MD5": 117,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 1386,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 10162,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "218 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.pavementgroup.com/content/engine/engine_url_parser.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.pavementgroup.com/content/engine/engine_url_parser.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776645639.0484962
}