{
  "type": "URL",
  "indicator": "https://www.swiftdev.click",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://www.swiftdev.click",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4098025905,
      "indicator": "https://www.swiftdev.click",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "68899ae621ead93f10b78da8",
          "name": "Hacking activities continue to affect multi block communities",
          "description": "Multi block complex (USA) continues to be affected by hacking and espionage activities. Every time I attempt to pulse a community, pulse is reset and malicious IoC\u2019s disappear. So here\u2019s another heap. #virtool #pws #crypter #ransom #tofsee #remote_activities #adversaries #berbew #hacking #denver_communities #infostealers",
          "modified": "2025-08-29T03:04:16.203000",
          "created": "2025-07-30T04:09:10.026000",
          "tags": [
            "url https",
            "location united",
            "asn as16509",
            "et smtp",
            "message",
            "high",
            "et info",
            "domain",
            "yara detections",
            "contacted",
            "show",
            "icmp traffic",
            "irc server",
            "copy",
            "malware",
            "destination",
            "port",
            "united",
            "unknown",
            "united kingdom",
            "search",
            "entries",
            "write",
            "next",
            "google",
            "cloudflar",
            "amazon02",
            "akamaias",
            "microsoft",
            "ip address",
            "as autonomous",
            "system",
            "cdn77 dat",
            "googlecl",
            "cisco",
            "umbrella rank",
            "cisco umbrella",
            "rank",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "present apr",
            "present may",
            "files show",
            "trojan",
            "error aug",
            "spain",
            "win32",
            "passive dns",
            "next associated",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "encrypt",
            "gmt content",
            "type",
            "medium",
            "checks system",
            "total",
            "read",
            "upatre",
            "dynamicloader",
            "dynamic",
            "pcap",
            "reads",
            "pe section",
            "pe file",
            "mtb jul",
            "backdoor",
            "win32upatre jul",
            "mtb jun",
            "ipv4 add",
            "pulse pulses",
            "fakeav",
            "downloader",
            "trojandropper",
            "win32upatre jun",
            "urls",
            "script urls",
            "showing",
            "script domains",
            "meta",
            "certificate",
            "next http",
            "scans show",
            "hostname add",
            "pulse submit",
            "url analysis",
            "files",
            "files ip",
            "address",
            "hostname",
            "verdict",
            "date hash",
            "avast avg",
            "vps reverse",
            "america flag",
            "overview ip",
            "whois registrar",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "script general",
            "full url",
            "present jul",
            "aaaa",
            "present jun",
            "moved",
            "content length",
            "content type",
            "x powered",
            "date",
            "mtb may",
            "mtb sep",
            "b jan",
            "mtb jan",
            "mtb dec",
            "asn as13335",
            "creation date",
            "unknown aaaa",
            "results jul",
            "present feb",
            "present oct",
            "win32spigot jul",
            "alfper",
            "found",
            "error",
            "domain add",
            "enom",
            "urls show",
            "address domain",
            "ip related",
            "pulses none",
            "record value",
            "emails",
            "name david",
            "lex name",
            "city",
            "country ng",
            "asn as15169",
            "pulses",
            "tags",
            "all ipv4",
            "reverse dns",
            "ashburn",
            "unknown ns",
            "llc dba",
            "name servers",
            "present jan",
            "present dec",
            "service",
            "ransom",
            "new pulse",
            "existing pulse",
            "files domain",
            "files related",
            "body html",
            "lowfi",
            "worm",
            "virtool",
            "ch ua",
            "sec ch",
            "rsa tls",
            "issuing ca",
            "mtb apr",
            "yara rule",
            "hardwareid",
            "checks",
            "vmprotectsdk",
            "vmprotectstub",
            "avgetblockcc",
            "delphi",
            "vmprotect"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3262,
            "hostname": 3139,
            "FileHash-SHA256": 2614,
            "URL": 3078,
            "FileHash-MD5": 515,
            "FileHash-SHA1": 517,
            "email": 6,
            "CVE": 1
          },
          "indicator_count": 13132,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "233 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d30048b95aaba628a5ee7",
          "name": "Working on it\u2026\u2026",
          "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
          "modified": "2025-08-19T17:00:59.379000",
          "created": "2025-07-20T18:05:56.587000",
          "tags": [
            "dynamicloader",
            "united",
            "as15169",
            "medium",
            "search",
            "show",
            "write c",
            "whitelisted",
            "brazil as396982",
            "high",
            "themida",
            "write",
            "delphi",
            "copy",
            "upatre",
            "encrypt",
            "june",
            "win32",
            "malware",
            "win64",
            "windows nt",
            "directui",
            "element",
            "classinfobase",
            "value",
            "hwndhost",
            "sapeav12",
            "delete c",
            "worm",
            "explorer",
            "insert",
            "movie",
            "alerts",
            "windows",
            "installs",
            "filehash",
            "sha256 add",
            "pulse pulses",
            "av detections",
            "ids detections",
            "passive dns",
            "urls",
            "http",
            "ip address",
            "related nids",
            "files location",
            "spain flag",
            "spain domain",
            "files related",
            "spain",
            "entries",
            "next associated",
            "meta name",
            "frame src",
            "ok set",
            "cookie",
            "gmt date",
            "gmt content",
            "filehashsha256",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "url http",
            "filehashmd5",
            "showing",
            "url https",
            "indicator role",
            "title added",
            "active related",
            "iocs",
            "learn more",
            "filehashsha1",
            "types of",
            "united kingdom",
            "t1053",
            "taskjob",
            "t1055",
            "injection",
            "t1082",
            "t1119",
            "t1129",
            "modules",
            "t1143",
            "soundcloud",
            "created",
            "hour ago",
            "facebook",
            "twitter",
            "victims website",
            "youtube",
            "jansky",
            "trojandropper",
            "pulses url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2012,
            "FileHash-MD5": 140,
            "FileHash-SHA1": 129,
            "FileHash-SHA256": 1348,
            "SSLCertFingerprint": 3,
            "domain": 288,
            "hostname": 812
          },
          "indicator_count": 4732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 18475
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/swiftdev.click",
    "whois": "http://whois.domaintools.com/swiftdev.click",
    "domain": "swiftdev.click",
    "hostname": "www.swiftdev.click"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "68899ae621ead93f10b78da8",
      "name": "Hacking activities continue to affect multi block communities",
      "description": "Multi block complex (USA) continues to be affected by hacking and espionage activities. Every time I attempt to pulse a community, pulse is reset and malicious IoC\u2019s disappear. So here\u2019s another heap. #virtool #pws #crypter #ransom #tofsee #remote_activities #adversaries #berbew #hacking #denver_communities #infostealers",
      "modified": "2025-08-29T03:04:16.203000",
      "created": "2025-07-30T04:09:10.026000",
      "tags": [
        "url https",
        "location united",
        "asn as16509",
        "et smtp",
        "message",
        "high",
        "et info",
        "domain",
        "yara detections",
        "contacted",
        "show",
        "icmp traffic",
        "irc server",
        "copy",
        "malware",
        "destination",
        "port",
        "united",
        "unknown",
        "united kingdom",
        "search",
        "entries",
        "write",
        "next",
        "google",
        "cloudflar",
        "amazon02",
        "akamaias",
        "microsoft",
        "ip address",
        "as autonomous",
        "system",
        "cdn77 dat",
        "googlecl",
        "cisco",
        "umbrella rank",
        "cisco umbrella",
        "rank",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "present apr",
        "present may",
        "files show",
        "trojan",
        "error aug",
        "spain",
        "win32",
        "passive dns",
        "next associated",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "encrypt",
        "gmt content",
        "type",
        "medium",
        "checks system",
        "total",
        "read",
        "upatre",
        "dynamicloader",
        "dynamic",
        "pcap",
        "reads",
        "pe section",
        "pe file",
        "mtb jul",
        "backdoor",
        "win32upatre jul",
        "mtb jun",
        "ipv4 add",
        "pulse pulses",
        "fakeav",
        "downloader",
        "trojandropper",
        "win32upatre jun",
        "urls",
        "script urls",
        "showing",
        "script domains",
        "meta",
        "certificate",
        "next http",
        "scans show",
        "hostname add",
        "pulse submit",
        "url analysis",
        "files",
        "files ip",
        "address",
        "hostname",
        "verdict",
        "date hash",
        "avast avg",
        "vps reverse",
        "america flag",
        "overview ip",
        "whois registrar",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "script general",
        "full url",
        "present jul",
        "aaaa",
        "present jun",
        "moved",
        "content length",
        "content type",
        "x powered",
        "date",
        "mtb may",
        "mtb sep",
        "b jan",
        "mtb jan",
        "mtb dec",
        "asn as13335",
        "creation date",
        "unknown aaaa",
        "results jul",
        "present feb",
        "present oct",
        "win32spigot jul",
        "alfper",
        "found",
        "error",
        "domain add",
        "enom",
        "urls show",
        "address domain",
        "ip related",
        "pulses none",
        "record value",
        "emails",
        "name david",
        "lex name",
        "city",
        "country ng",
        "asn as15169",
        "pulses",
        "tags",
        "all ipv4",
        "reverse dns",
        "ashburn",
        "unknown ns",
        "llc dba",
        "name servers",
        "present jan",
        "present dec",
        "service",
        "ransom",
        "new pulse",
        "existing pulse",
        "files domain",
        "files related",
        "body html",
        "lowfi",
        "worm",
        "virtool",
        "ch ua",
        "sec ch",
        "rsa tls",
        "issuing ca",
        "mtb apr",
        "yara rule",
        "hardwareid",
        "checks",
        "vmprotectsdk",
        "vmprotectstub",
        "avgetblockcc",
        "delphi",
        "vmprotect"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3262,
        "hostname": 3139,
        "FileHash-SHA256": 2614,
        "URL": 3078,
        "FileHash-MD5": 515,
        "FileHash-SHA1": 517,
        "email": 6,
        "CVE": 1
      },
      "indicator_count": 13132,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "233 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d30048b95aaba628a5ee7",
      "name": "Working on it\u2026\u2026",
      "description": "\u2022 Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\n(onyx-ware.com)\nNS1.ENDGAME.COM\n(endgames.us)\nNS1.ENDGAME.COM\n#deadmau5 #janskyofficial #idk #soundcloud",
      "modified": "2025-08-19T17:00:59.379000",
      "created": "2025-07-20T18:05:56.587000",
      "tags": [
        "dynamicloader",
        "united",
        "as15169",
        "medium",
        "search",
        "show",
        "write c",
        "whitelisted",
        "brazil as396982",
        "high",
        "themida",
        "write",
        "delphi",
        "copy",
        "upatre",
        "encrypt",
        "june",
        "win32",
        "malware",
        "win64",
        "windows nt",
        "directui",
        "element",
        "classinfobase",
        "value",
        "hwndhost",
        "sapeav12",
        "delete c",
        "worm",
        "explorer",
        "insert",
        "movie",
        "alerts",
        "windows",
        "installs",
        "filehash",
        "sha256 add",
        "pulse pulses",
        "av detections",
        "ids detections",
        "passive dns",
        "urls",
        "http",
        "ip address",
        "related nids",
        "files location",
        "spain flag",
        "spain domain",
        "files related",
        "spain",
        "entries",
        "next associated",
        "meta name",
        "frame src",
        "ok set",
        "cookie",
        "gmt date",
        "gmt content",
        "filehashsha256",
        "type indicator",
        "role title",
        "added active",
        "related pulses",
        "url http",
        "filehashmd5",
        "showing",
        "url https",
        "indicator role",
        "title added",
        "active related",
        "iocs",
        "learn more",
        "filehashsha1",
        "types of",
        "united kingdom",
        "t1053",
        "taskjob",
        "t1055",
        "injection",
        "t1082",
        "t1119",
        "t1129",
        "modules",
        "t1143",
        "soundcloud",
        "created",
        "hour ago",
        "facebook",
        "twitter",
        "victims website",
        "youtube",
        "jansky",
        "trojandropper",
        "pulses url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2012,
        "FileHash-MD5": 140,
        "FileHash-SHA1": 129,
        "FileHash-SHA256": 1348,
        "SSLCertFingerprint": 3,
        "domain": 288,
        "hostname": 812
      },
      "indicator_count": 4732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://www.swiftdev.click",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://www.swiftdev.click",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629905.388221
}