{ "type": "URL", "indicator": "https://xia.iygawj.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://xia.iygawj.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3388572508, "indicator": "https://xia.iygawj.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 9, "pulses": [ { "id": "65bca8fcbe62297d71b47c33", "name": "Ragnar Locker", "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n 108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.", "modified": "2024-03-03T08:00:03.432000", "created": "2024-02-02T08:34:04.425000", "tags": [ "referrer", "contacted", "whois record", "ssl certificate", "whois whois", "contacted urls", "execution", "historical ssl", "red team", "gang breached", "agent tesla", "redline stealer", "metro", "android", "urls url", "files", "kgs0", "kls0", "orgtechhandle", "orgtechref", "orgabusehandle", "orgdnshandle", "orgdnsref", "whois lookup", "netrange", "nethandle", "net108", "net1080000", "communicating", "urls http", "ransomware gang", "breached", "team", "first", "utc submissions", "submitters", "gandi sas", "psiusa", "domain robot", "porkbun llc", "keysystems gmbh", "csc corporate", "domains", "domain name", "network pty", "tucows", "com laude", "dynadot inc" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8354, "FileHash-MD5": 104, "FileHash-SHA1": 81, "FileHash-SHA256": 2711, "CIDR": 5, "CVE": 6, "domain": 1489, "hostname": 3058, "email": 5 }, "indicator_count": 15813, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "777 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657092eb7c26b2cfaf15afb2", "name": "Twitter Cards", "description": "", "modified": "2023-12-06T15:27:39.330000", "created": "2023-12-06T15:27:39.330000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 672, "domain": 647, "hostname": 803, "URL": 2896, "CVE": 1 }, "indicator_count": 5019, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708cf911f044ba6f739580", "name": "Infections start here 91.195.240.226-as47846- SEDO-DE - aid www.bbb.org", "description": "", "modified": "2023-12-06T15:02:16.933000", "created": "2023-12-06T15:02:16.933000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 610, "URL": 1279, "email": 2, "hostname": 375, "domain": 172, "FileHash-MD5": 99, "FileHash-SHA1": 81, "CVE": 1 }, "indicator_count": 2619, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707faeb891d6de64d8e793", "name": "nytimes - cooking", "description": "", "modified": "2023-12-06T14:05:34.796000", "created": "2023-12-06T14:05:34.796000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 795, "hostname": 446, "domain": 231, "URL": 1324 }, "indicator_count": 2796, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fa9e514ca975b6db5ca", "name": "NYTIMES.COM", "description": "", "modified": "2023-12-06T14:05:29.348000", "created": "2023-12-06T14:05:29.348000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 936, "hostname": 1927, "URL": 4576, "domain": 989, "email": 2, "FileHash-MD5": 2, "FileHash-SHA1": 4 }, "indicator_count": 8437, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6341a53e0b5b54bf9de2b1a9", "name": "Twitter Cards", "description": "", "modified": "2022-11-07T16:01:58.911000", "created": "2022-10-08T16:28:46.313000", "tags": [ "whois record", "ssl certificate", "whois whois", "pe resource", "historical ssl", "siblings domain", "referrer", "parent domain", "resolutions", "contacted urls", "execution" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2896, "hostname": 803, "domain": 647, "FileHash-SHA256": 672, "CVE": 1 }, "indicator_count": 5019, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1259 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626c6f418117c4b20d0706e3", "name": "Infections start here 91.195.240.226-as47846- SEDO-DE - aid www.bbb.org", "description": "", "modified": "2022-05-29T00:01:17.829000", "created": "2022-04-29T23:05:37.269000", "tags": [ "91.195.240.226", "domain parks", "sedo", "chained malware", ".rel XML", "2013" ], "references": [ "https://hybrid-analysis.com/sample/bb17013c1d9f8e01d55b92a7cefaf20372d1c2a3483ed1d00cce091a2d30cea9/5f97708faf83fa51aa3b74de", "https://hybrid-analysis.com/sample/d6f4e7d29e7b460e67eb5eead3e07ace89682cb8f6c5c62172ec3f46b91f88c6/60e75be8ffad6735563f1a72" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1279, "FileHash-SHA256": 610, "domain": 172, "hostname": 375, "CVE": 1, "FileHash-MD5": 99, "FileHash-SHA1": 81, "email": 2 }, "indicator_count": 2619, "is_author": false, "is_subscribing": null, "subscriber_count": 397, "modified_text": "1421 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621e371e2a74a1182e30386b", "name": "NYTIMES.COM", "description": "", "modified": "2022-03-31T00:02:44.795000", "created": "2022-03-01T15:09:18.236000", "tags": [ "algorithm", "key identifier", "x509v3 subject", "v3 serial", "number", "issuer", "cncomodo rsa", "secure server", "ca cgb", "ca limited", "subject public", "key info", "key algorithm", "x509v3 key", "first", "server", "markmonitor", "date", "registrar abuse", "contact phone", "domain status", "registrar url", "registrar whois", "email", "registry domain", "code", "moves", "microsoft", "qianxin reddrip", "subdomains", "sophos news", "comodo valkyrie", "verdict mobile", "news popularity", "ranks rank", "value ingestion", "umbrella" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4576, "FileHash-SHA256": 936, "hostname": 1927, "domain": 989, "CVE": 1, "email": 2, "FileHash-MD5": 2, "FileHash-SHA1": 4 }, "indicator_count": 8437, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621e3e993f08849d931cfcee", "name": "nytimes - cooking", "description": "", "modified": "2022-03-31T00:02:44.795000", "created": "2022-03-01T15:41:13.781000", "tags": [ "ssl certificate", "whois", "whois record" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 446, "URL": 1324, "domain": 231, "FileHash-SHA256": 795 }, "indicator_count": 2796, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://hybrid-analysis.com/sample/d6f4e7d29e7b460e67eb5eead3e07ace89682cb8f6c5c62172ec3f46b91f88c6/60e75be8ffad6735563f1a72", "https://hybrid-analysis.com/sample/bb17013c1d9f8e01d55b92a7cefaf20372d1c2a3483ed1d00cce091a2d30cea9/5f97708faf83fa51aa3b74de" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [], "industries": [ "Media" ], "unique_indicators": 34321 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/iygawj.com", "whois": "http://whois.domaintools.com/iygawj.com", "domain": "iygawj.com", "hostname": "xia.iygawj.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 9, "pulses": [ { "id": "65bca8fcbe62297d71b47c33", "name": "Ragnar Locker", "description": "\u2022 FBI Flash CU-000163-MW: RagnarLocker Ransomware Indicators of Compromise\n\u2022 Found in https://www.Esurance.com\n 108.26.193.165\nAS 701 (UUNET)\n\u2022108.26.193.165 Postal Code: 02465 Reverse Domain Lookup: pool-108-26-193-165.bstnma.fios.verizon.net \n| Ragnar Locker is ransomware for Windows and Linux that exfiltrates information from a compromised machine, encrypts files using the Salsa20 encryption algorithm, and demands that victims pay a ransom to recover their data. The Ragnar Locker group is known to employ a double extortion tactic.", "modified": "2024-03-03T08:00:03.432000", "created": "2024-02-02T08:34:04.425000", "tags": [ "referrer", "contacted", "whois record", "ssl certificate", "whois whois", "contacted urls", "execution", "historical ssl", "red team", "gang breached", "agent tesla", "redline stealer", "metro", "android", "urls url", "files", "kgs0", "kls0", "orgtechhandle", "orgtechref", "orgabusehandle", "orgdnshandle", "orgdnsref", "whois lookup", "netrange", "nethandle", "net108", "net1080000", "communicating", "urls http", "ransomware gang", "breached", "team", "first", "utc submissions", "submitters", "gandi sas", "psiusa", "domain robot", "porkbun llc", "keysystems gmbh", "csc corporate", "domains", "domain name", "network pty", "tucows", "com laude", "dynadot inc" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 23, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 8354, "FileHash-MD5": 104, "FileHash-SHA1": 81, "FileHash-SHA256": 2711, "CIDR": 5, "CVE": 6, "domain": 1489, "hostname": 3058, "email": 5 }, "indicator_count": 15813, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "777 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657092eb7c26b2cfaf15afb2", "name": "Twitter Cards", "description": "", "modified": "2023-12-06T15:27:39.330000", "created": "2023-12-06T15:27:39.330000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 672, "domain": 647, "hostname": 803, "URL": 2896, "CVE": 1 }, "indicator_count": 5019, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65708cf911f044ba6f739580", "name": "Infections start here 91.195.240.226-as47846- SEDO-DE - aid www.bbb.org", "description": "", "modified": "2023-12-06T15:02:16.933000", "created": "2023-12-06T15:02:16.933000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 610, "URL": 1279, "email": 2, "hostname": 375, "domain": 172, "FileHash-MD5": 99, "FileHash-SHA1": 81, "CVE": 1 }, "indicator_count": 2619, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707faeb891d6de64d8e793", "name": "nytimes - cooking", "description": "", "modified": "2023-12-06T14:05:34.796000", "created": "2023-12-06T14:05:34.796000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 795, "hostname": 446, "domain": 231, "URL": 1324 }, "indicator_count": 2796, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707fa9e514ca975b6db5ca", "name": "NYTIMES.COM", "description": "", "modified": "2023-12-06T14:05:29.348000", "created": "2023-12-06T14:05:29.348000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 936, "hostname": 1927, "URL": 4576, "domain": 989, "email": 2, "FileHash-MD5": 2, "FileHash-SHA1": 4 }, "indicator_count": 8437, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6341a53e0b5b54bf9de2b1a9", "name": "Twitter Cards", "description": "", "modified": "2022-11-07T16:01:58.911000", "created": "2022-10-08T16:28:46.313000", "tags": [ "whois record", "ssl certificate", "whois whois", "pe resource", "historical ssl", "siblings domain", "referrer", "parent domain", "resolutions", "contacted urls", "execution" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 7, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 2896, "hostname": 803, "domain": 647, "FileHash-SHA256": 672, "CVE": 1 }, "indicator_count": 5019, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1259 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "626c6f418117c4b20d0706e3", "name": "Infections start here 91.195.240.226-as47846- SEDO-DE - aid www.bbb.org", "description": "", "modified": "2022-05-29T00:01:17.829000", "created": "2022-04-29T23:05:37.269000", "tags": [ "91.195.240.226", "domain parks", "sedo", "chained malware", ".rel XML", "2013" ], "references": [ "https://hybrid-analysis.com/sample/bb17013c1d9f8e01d55b92a7cefaf20372d1c2a3483ed1d00cce091a2d30cea9/5f97708faf83fa51aa3b74de", "https://hybrid-analysis.com/sample/d6f4e7d29e7b460e67eb5eead3e07ace89682cb8f6c5c62172ec3f46b91f88c6/60e75be8ffad6735563f1a72" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1279, "FileHash-SHA256": 610, "domain": 172, "hostname": 375, "CVE": 1, "FileHash-MD5": 99, "FileHash-SHA1": 81, "email": 2 }, "indicator_count": 2619, "is_author": false, "is_subscribing": null, "subscriber_count": 397, "modified_text": "1421 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621e371e2a74a1182e30386b", "name": "NYTIMES.COM", "description": "", "modified": "2022-03-31T00:02:44.795000", "created": "2022-03-01T15:09:18.236000", "tags": [ "algorithm", "key identifier", "x509v3 subject", "v3 serial", "number", "issuer", "cncomodo rsa", "secure server", "ca cgb", "ca limited", "subject public", "key info", "key algorithm", "x509v3 key", "first", "server", "markmonitor", "date", "registrar abuse", "contact phone", "domain status", "registrar url", "registrar whois", "email", "registry domain", "code", "moves", "microsoft", "qianxin reddrip", "subdomains", "sophos news", "comodo valkyrie", "verdict mobile", "news popularity", "ranks rank", "value ingestion", "umbrella" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 4576, "FileHash-SHA256": 936, "hostname": 1927, "domain": 989, "CVE": 1, "email": 2, "FileHash-MD5": 2, "FileHash-SHA1": 4 }, "indicator_count": 8437, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621e3e993f08849d931cfcee", "name": "nytimes - cooking", "description": "", "modified": "2022-03-31T00:02:44.795000", "created": "2022-03-01T15:41:13.781000", "tags": [ "ssl certificate", "whois", "whois record" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 446, "URL": 1324, "domain": 231, "FileHash-SHA256": 795 }, "indicator_count": 2796, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1480 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://xia.iygawj.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://xia.iygawj.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776642208.3007782 }