{
  "type": "URL",
  "indicator": "https://www.rcgt.com/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.rcgt.com/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3745494887,
      "indicator": "https://www.rcgt.com/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "6570a819664c2499fc2adc79",
          "name": "BLOG | cloak-and-dagger | Page 4 of 8",
          "description": "",
          "modified": "2023-12-06T16:58:01.198000",
          "created": "2023-12-06T16:58:01.198000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 4,
            "FileHash-SHA256": 1664,
            "FileHash-MD5": 367,
            "FileHash-SHA1": 237,
            "domain": 1950,
            "URL": 6466,
            "hostname": 2346,
            "email": 1
          },
          "indicator_count": 13035,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 112,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "652214c652025febf66cde33",
          "name": "BLOG | cloak-and-dagger | Page 4 of 8",
          "description": "C2 | scanning_host | Malicious|",
          "modified": "2023-11-07T01:01:57.592000",
          "created": "2023-10-08T02:32:38.609000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "threat roundup",
            "whois whois",
            "october",
            "referrer",
            "resolutions",
            "december",
            "september",
            "hacktool",
            "united",
            "anonymizer",
            "firehol",
            "microsoft",
            "phishing site",
            "malware site",
            "paypal",
            "latam",
            "phishing",
            "malicious site",
            "myetherwallet",
            "heur",
            "malware",
            "zeus",
            "zbot",
            "facebook",
            "artemis",
            "bank",
            "bradesco",
            "riskware",
            "download",
            "telecom",
            "dropper",
            "emotet",
            "formbook",
            "cisco umbrella",
            "site",
            "safe site",
            "blacklist https",
            "generic malware",
            "detection list",
            "blacklist",
            "generic",
            "pe resource",
            "contacted",
            "red team",
            "whois",
            "execution",
            "skynet",
            "u4e0b",
            "falcon sandbox",
            "flag",
            "date",
            "server",
            "name server",
            "markmonitor",
            "domain address",
            "gandi sas",
            "mesh digital",
            "vimeo",
            "static engine",
            "alexa top",
            "million",
            "adwarex",
            "alexa",
            "xrat",
            "downldr",
            "presenoker",
            "maltiverse",
            "ocidmy01rz",
            "runtime process",
            "copy md5",
            "sha1",
            "copy sha1",
            "copy sha256"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 367,
            "FileHash-SHA1": 237,
            "FileHash-SHA256": 1664,
            "URL": 6466,
            "domain": 1950,
            "hostname": 2346,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 13035,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "937 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f15cbb17119f3334c0c57",
          "name": "BLOG | cloak-and-dagger | Page 4 of 8",
          "description": "",
          "modified": "2023-11-07T01:01:57.592000",
          "created": "2023-10-30T02:32:43.922000",
          "tags": [
            "ssl certificate",
            "whois record",
            "historical ssl",
            "threat roundup",
            "whois whois",
            "october",
            "referrer",
            "resolutions",
            "december",
            "september",
            "hacktool",
            "united",
            "anonymizer",
            "firehol",
            "microsoft",
            "phishing site",
            "malware site",
            "paypal",
            "latam",
            "phishing",
            "malicious site",
            "myetherwallet",
            "heur",
            "malware",
            "zeus",
            "zbot",
            "facebook",
            "artemis",
            "bank",
            "bradesco",
            "riskware",
            "download",
            "telecom",
            "dropper",
            "emotet",
            "formbook",
            "cisco umbrella",
            "site",
            "safe site",
            "blacklist https",
            "generic malware",
            "detection list",
            "blacklist",
            "generic",
            "pe resource",
            "contacted",
            "red team",
            "whois",
            "execution",
            "skynet",
            "u4e0b",
            "falcon sandbox",
            "flag",
            "date",
            "server",
            "name server",
            "markmonitor",
            "domain address",
            "gandi sas",
            "mesh digital",
            "vimeo",
            "static engine",
            "alexa top",
            "million",
            "adwarex",
            "alexa",
            "xrat",
            "downldr",
            "presenoker",
            "maltiverse",
            "ocidmy01rz",
            "runtime process",
            "copy md5",
            "sha1",
            "copy sha1",
            "copy sha256"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1115",
              "name": "Clipboard Data",
              "display_name": "T1115 - Clipboard Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "652214c652025febf66cde33",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 367,
            "FileHash-SHA1": 237,
            "FileHash-SHA256": 1664,
            "URL": 6466,
            "domain": 1950,
            "hostname": 2346,
            "CVE": 4,
            "email": 1
          },
          "indicator_count": 13035,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "937 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f12d6276e255c7d06acc0",
          "name": "EWA Phishing & Exploit in short link survey redirect",
          "description": "",
          "modified": "2023-10-30T02:20:06.113000",
          "created": "2023-10-30T02:20:06.113000",
          "tags": [
            "external system",
            "windir",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "hashtablemutex",
            "sample",
            "antivirus",
            "api call",
            "general",
            "pattern match",
            "done adding",
            "catalog file",
            "temp",
            "network related",
            "https webserver",
            "flag",
            "united",
            "server",
            "date",
            "india india",
            "localappdata",
            "source",
            "binary file",
            "click",
            "input",
            "pcap",
            "files clean1",
            "size",
            "type data",
            "av scan",
            "result",
            "copy md5",
            "sha1",
            "copy sha1",
            "runtime process",
            "sha256",
            "copy sha256",
            "asn13335",
            "cloudflarenet",
            "india",
            "asn16509",
            "amazon02",
            "frankfurt",
            "main",
            "germany",
            "asn15169",
            "value",
            "august",
            "variables",
            "zone function",
            "fontawesome",
            "editbox",
            "button function",
            "pushbutton",
            "textfield",
            "passwordfield",
            "domains",
            "hashes"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65133deee8ee099ab75a49aa",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 137,
            "domain": 64,
            "hostname": 34,
            "FileHash-SHA256": 31,
            "FileHash-MD5": 9,
            "FileHash-SHA1": 7
          },
          "indicator_count": 282,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "944 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65133deee8ee099ab75a49aa",
          "name": "EWA Phishing & Exploit in short link survey redirect",
          "description": "",
          "modified": "2023-09-26T20:24:14.268000",
          "created": "2023-09-26T20:24:14.268000",
          "tags": [
            "external system",
            "windir",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "hashtablemutex",
            "sample",
            "antivirus",
            "api call",
            "general",
            "pattern match",
            "done adding",
            "catalog file",
            "temp",
            "network related",
            "https webserver",
            "flag",
            "united",
            "server",
            "date",
            "india india",
            "localappdata",
            "source",
            "binary file",
            "click",
            "input",
            "pcap",
            "files clean1",
            "size",
            "type data",
            "av scan",
            "result",
            "copy md5",
            "sha1",
            "copy sha1",
            "runtime process",
            "sha256",
            "copy sha256",
            "asn13335",
            "cloudflarenet",
            "india",
            "asn16509",
            "amazon02",
            "frankfurt",
            "main",
            "germany",
            "asn15169",
            "value",
            "august",
            "variables",
            "zone function",
            "fontawesome",
            "editbox",
            "button function",
            "pushbutton",
            "textfield",
            "passwordfield",
            "domains",
            "hashes"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "64eae78aa781e6f8be552647",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 137,
            "domain": 64,
            "hostname": 34,
            "FileHash-SHA256": 31,
            "FileHash-MD5": 9,
            "FileHash-SHA1": 7
          },
          "indicator_count": 282,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "978 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64eae78aa781e6f8be552647",
          "name": "EWA Phishing & Exploit in   short link survey redirect.",
          "description": "Malicious redirect for hospital visit survey.  \nShort link: https://sprl.in/HRJqy0eX \u2192exploit_source\t\t\t\nredirects to:  https://www.ewatpa.com/cashless-claim-feedback/N5PZHDSGiMevZASQdsrtLg",
          "modified": "2023-09-26T05:00:14.694000",
          "created": "2023-08-27T06:04:58.559000",
          "tags": [
            "external system",
            "windir",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "hashtablemutex",
            "sample",
            "antivirus",
            "api call",
            "general",
            "pattern match",
            "done adding",
            "catalog file",
            "temp",
            "network related",
            "https webserver",
            "flag",
            "united",
            "server",
            "date",
            "india india",
            "localappdata",
            "source",
            "binary file",
            "click",
            "input",
            "pcap",
            "files clean1",
            "size",
            "type data",
            "av scan",
            "result",
            "copy md5",
            "sha1",
            "copy sha1",
            "runtime process",
            "sha256",
            "copy sha256",
            "asn13335",
            "cloudflarenet",
            "india",
            "asn16509",
            "amazon02",
            "frankfurt",
            "main",
            "germany",
            "asn15169",
            "value",
            "august",
            "variables",
            "zone function",
            "fontawesome",
            "editbox",
            "button function",
            "pushbutton",
            "textfield",
            "passwordfield",
            "domains",
            "hashes"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 137,
            "domain": 64,
            "hostname": 34,
            "FileHash-SHA256": 31,
            "FileHash-MD5": 9,
            "FileHash-SHA1": 7
          },
          "indicator_count": 282,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "978 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Generic",
            "Maltiverse"
          ],
          "industries": [],
          "unique_indicators": 13440
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/rcgt.com",
    "whois": "http://whois.domaintools.com/rcgt.com",
    "domain": "rcgt.com",
    "hostname": "www.rcgt.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "6570a819664c2499fc2adc79",
      "name": "BLOG | cloak-and-dagger | Page 4 of 8",
      "description": "",
      "modified": "2023-12-06T16:58:01.198000",
      "created": "2023-12-06T16:58:01.198000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 4,
        "FileHash-SHA256": 1664,
        "FileHash-MD5": 367,
        "FileHash-SHA1": 237,
        "domain": 1950,
        "URL": 6466,
        "hostname": 2346,
        "email": 1
      },
      "indicator_count": 13035,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 112,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "652214c652025febf66cde33",
      "name": "BLOG | cloak-and-dagger | Page 4 of 8",
      "description": "C2 | scanning_host | Malicious|",
      "modified": "2023-11-07T01:01:57.592000",
      "created": "2023-10-08T02:32:38.609000",
      "tags": [
        "ssl certificate",
        "whois record",
        "historical ssl",
        "threat roundup",
        "whois whois",
        "october",
        "referrer",
        "resolutions",
        "december",
        "september",
        "hacktool",
        "united",
        "anonymizer",
        "firehol",
        "microsoft",
        "phishing site",
        "malware site",
        "paypal",
        "latam",
        "phishing",
        "malicious site",
        "myetherwallet",
        "heur",
        "malware",
        "zeus",
        "zbot",
        "facebook",
        "artemis",
        "bank",
        "bradesco",
        "riskware",
        "download",
        "telecom",
        "dropper",
        "emotet",
        "formbook",
        "cisco umbrella",
        "site",
        "safe site",
        "blacklist https",
        "generic malware",
        "detection list",
        "blacklist",
        "generic",
        "pe resource",
        "contacted",
        "red team",
        "whois",
        "execution",
        "skynet",
        "u4e0b",
        "falcon sandbox",
        "flag",
        "date",
        "server",
        "name server",
        "markmonitor",
        "domain address",
        "gandi sas",
        "mesh digital",
        "vimeo",
        "static engine",
        "alexa top",
        "million",
        "adwarex",
        "alexa",
        "xrat",
        "downldr",
        "presenoker",
        "maltiverse",
        "ocidmy01rz",
        "runtime process",
        "copy md5",
        "sha1",
        "copy sha1",
        "copy sha256"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 367,
        "FileHash-SHA1": 237,
        "FileHash-SHA256": 1664,
        "URL": 6466,
        "domain": 1950,
        "hostname": 2346,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 13035,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "937 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f15cbb17119f3334c0c57",
      "name": "BLOG | cloak-and-dagger | Page 4 of 8",
      "description": "",
      "modified": "2023-11-07T01:01:57.592000",
      "created": "2023-10-30T02:32:43.922000",
      "tags": [
        "ssl certificate",
        "whois record",
        "historical ssl",
        "threat roundup",
        "whois whois",
        "october",
        "referrer",
        "resolutions",
        "december",
        "september",
        "hacktool",
        "united",
        "anonymizer",
        "firehol",
        "microsoft",
        "phishing site",
        "malware site",
        "paypal",
        "latam",
        "phishing",
        "malicious site",
        "myetherwallet",
        "heur",
        "malware",
        "zeus",
        "zbot",
        "facebook",
        "artemis",
        "bank",
        "bradesco",
        "riskware",
        "download",
        "telecom",
        "dropper",
        "emotet",
        "formbook",
        "cisco umbrella",
        "site",
        "safe site",
        "blacklist https",
        "generic malware",
        "detection list",
        "blacklist",
        "generic",
        "pe resource",
        "contacted",
        "red team",
        "whois",
        "execution",
        "skynet",
        "u4e0b",
        "falcon sandbox",
        "flag",
        "date",
        "server",
        "name server",
        "markmonitor",
        "domain address",
        "gandi sas",
        "mesh digital",
        "vimeo",
        "static engine",
        "alexa top",
        "million",
        "adwarex",
        "alexa",
        "xrat",
        "downldr",
        "presenoker",
        "maltiverse",
        "ocidmy01rz",
        "runtime process",
        "copy md5",
        "sha1",
        "copy sha1",
        "copy sha256"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1115",
          "name": "Clipboard Data",
          "display_name": "T1115 - Clipboard Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "652214c652025febf66cde33",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 367,
        "FileHash-SHA1": 237,
        "FileHash-SHA256": 1664,
        "URL": 6466,
        "domain": 1950,
        "hostname": 2346,
        "CVE": 4,
        "email": 1
      },
      "indicator_count": 13035,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "937 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653f12d6276e255c7d06acc0",
      "name": "EWA Phishing & Exploit in short link survey redirect",
      "description": "",
      "modified": "2023-10-30T02:20:06.113000",
      "created": "2023-10-30T02:20:06.113000",
      "tags": [
        "external system",
        "windir",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "hashtablemutex",
        "sample",
        "antivirus",
        "api call",
        "general",
        "pattern match",
        "done adding",
        "catalog file",
        "temp",
        "network related",
        "https webserver",
        "flag",
        "united",
        "server",
        "date",
        "india india",
        "localappdata",
        "source",
        "binary file",
        "click",
        "input",
        "pcap",
        "files clean1",
        "size",
        "type data",
        "av scan",
        "result",
        "copy md5",
        "sha1",
        "copy sha1",
        "runtime process",
        "sha256",
        "copy sha256",
        "asn13335",
        "cloudflarenet",
        "india",
        "asn16509",
        "amazon02",
        "frankfurt",
        "main",
        "germany",
        "asn15169",
        "value",
        "august",
        "variables",
        "zone function",
        "fontawesome",
        "editbox",
        "button function",
        "pushbutton",
        "textfield",
        "passwordfield",
        "domains",
        "hashes"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65133deee8ee099ab75a49aa",
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 137,
        "domain": 64,
        "hostname": 34,
        "FileHash-SHA256": 31,
        "FileHash-MD5": 9,
        "FileHash-SHA1": 7
      },
      "indicator_count": 282,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "944 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65133deee8ee099ab75a49aa",
      "name": "EWA Phishing & Exploit in short link survey redirect",
      "description": "",
      "modified": "2023-09-26T20:24:14.268000",
      "created": "2023-09-26T20:24:14.268000",
      "tags": [
        "external system",
        "windir",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "hashtablemutex",
        "sample",
        "antivirus",
        "api call",
        "general",
        "pattern match",
        "done adding",
        "catalog file",
        "temp",
        "network related",
        "https webserver",
        "flag",
        "united",
        "server",
        "date",
        "india india",
        "localappdata",
        "source",
        "binary file",
        "click",
        "input",
        "pcap",
        "files clean1",
        "size",
        "type data",
        "av scan",
        "result",
        "copy md5",
        "sha1",
        "copy sha1",
        "runtime process",
        "sha256",
        "copy sha256",
        "asn13335",
        "cloudflarenet",
        "india",
        "asn16509",
        "amazon02",
        "frankfurt",
        "main",
        "germany",
        "asn15169",
        "value",
        "august",
        "variables",
        "zone function",
        "fontawesome",
        "editbox",
        "button function",
        "pushbutton",
        "textfield",
        "passwordfield",
        "domains",
        "hashes"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "64eae78aa781e6f8be552647",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 137,
        "domain": 64,
        "hostname": 34,
        "FileHash-SHA256": 31,
        "FileHash-MD5": 9,
        "FileHash-SHA1": 7
      },
      "indicator_count": 282,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "978 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "64eae78aa781e6f8be552647",
      "name": "EWA Phishing & Exploit in   short link survey redirect.",
      "description": "Malicious redirect for hospital visit survey.  \nShort link: https://sprl.in/HRJqy0eX \u2192exploit_source\t\t\t\nredirects to:  https://www.ewatpa.com/cashless-claim-feedback/N5PZHDSGiMevZASQdsrtLg",
      "modified": "2023-09-26T05:00:14.694000",
      "created": "2023-08-27T06:04:58.559000",
      "tags": [
        "external system",
        "windir",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "hashtablemutex",
        "sample",
        "antivirus",
        "api call",
        "general",
        "pattern match",
        "done adding",
        "catalog file",
        "temp",
        "network related",
        "https webserver",
        "flag",
        "united",
        "server",
        "date",
        "india india",
        "localappdata",
        "source",
        "binary file",
        "click",
        "input",
        "pcap",
        "files clean1",
        "size",
        "type data",
        "av scan",
        "result",
        "copy md5",
        "sha1",
        "copy sha1",
        "runtime process",
        "sha256",
        "copy sha256",
        "asn13335",
        "cloudflarenet",
        "india",
        "asn16509",
        "amazon02",
        "frankfurt",
        "main",
        "germany",
        "asn15169",
        "value",
        "august",
        "variables",
        "zone function",
        "fontawesome",
        "editbox",
        "button function",
        "pushbutton",
        "textfield",
        "passwordfield",
        "domains",
        "hashes"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 137,
        "domain": 64,
        "hostname": 34,
        "FileHash-SHA256": 31,
        "FileHash-MD5": 9,
        "FileHash-SHA1": 7
      },
      "indicator_count": 282,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "978 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.rcgt.com/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.rcgt.com/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780277090.7570665
}