{
  "type": "Domain",
  "indicator": "i.read",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/i.read",
    "alexa": "http://www.alexa.com/siteinfo/i.read",
    "indicator": "i.read",
    "type": "domain",
    "type_title": "Domain",
    "validation": [
      {
        "source": "domain_tld",
        "message": "Whitelisted TLD: read",
        "name": "Whitelisted TLD"
      }
    ],
    "base_indicator": {
      "id": 2689694647,
      "indicator": "i.read",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "65709786808aed5d8ee43d19",
          "name": "auto_open_controller.js - all the things using this .js file ;-(",
          "description": "",
          "modified": "2023-12-06T15:47:18.949000",
          "created": "2023-12-06T15:47:18.949000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 380,
            "URL": 802,
            "domain": 245,
            "hostname": 231,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 1
          },
          "indicator_count": 1664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707fe17dfdfe16066d16de",
          "name": "Bexar.org",
          "description": "",
          "modified": "2023-12-06T14:06:25.800000",
          "created": "2023-12-06T14:06:25.800000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1735,
            "hostname": 1833,
            "domain": 1025,
            "URL": 4668,
            "email": 4,
            "FileHash-MD5": 133,
            "FileHash-SHA1": 6,
            "CIDR": 5
          },
          "indicator_count": 9409,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "63f619404ba8714b7e063140",
          "name": "auto_open_controller.js - all the things using this .js file ;-(",
          "description": "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609",
          "modified": "2023-02-22T13:31:44.806000",
          "created": "2023-02-22T13:31:44.806000",
          "tags": [
            "memoryfile scan",
            "null",
            "runtime data",
            "void",
            "unknown",
            "android",
            "magento",
            "desktop",
            "dark",
            "scroll",
            "addressbar",
            "trigger",
            "template",
            "fast",
            "burn",
            "homepage",
            "class",
            "critical",
            "iframe",
            "lick",
            "open",
            "trace",
            "sapphire",
            "screen",
            "small",
            "close",
            "click",
            "ransomware",
            "strings",
            "malicious",
            "contains",
            "xnnew weakmap",
            "fnnew weakmap",
            "auto_open_controller.js",
            "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609/63f3dde5af1db0386635b153",
            "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1010",
              "name": "Application Window Discovery",
              "display_name": "T1010 - Application Window Discovery"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 380,
            "URL": 802,
            "hostname": 231,
            "domain": 245,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 1
          },
          "indicator_count": 1664,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 90,
          "modified_text": "1194 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "624de05d2c58343224615255",
          "name": "\u542b\u7f9e\u8349\u7814\u7a76\u6240|Fi11.com",
          "description": "var a,b,c,d, f.substr(d),a=f, a.href, and a number of other elements:a.b.search.com.",
          "modified": "2022-05-06T18:05:54.002000",
          "created": "2022-04-06T18:47:57.704000",
          "tags": [
            "date",
            "cnzzdata",
            "czuuid",
            "umdistinctid",
            "toast",
            "android",
            "androidig",
            "linuxig",
            "iphoneipodiosig",
            "ipadig",
            "windows",
            "alert",
            "image",
            "object",
            "boolean",
            "error",
            "typeof t",
            "number",
            "67108863",
            "string",
            "typeerror",
            "array",
            "promise",
            "null",
            "this",
            "unknown",
            "write",
            "iframe",
            "window",
            "backspace",
            "body",
            "verify",
            "fullscreen",
            "copyright",
            "closure library",
            "pfunction",
            "contenttype",
            "zfunction",
            "bfunction",
            "mvoid",
            "ofunction"
          ],
          "references": [
            "xfe-IP-137.220.241.241-stix2-2.0-export.json",
            "https://h5.hxcpp100.com/?id=22929",
            "https://www.google-analytics.com/analytics.js",
            "https://h5.hxcpp100.com/js/linkChange.js",
            "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
            "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
            "http://push.zhanzhang.baidu.com/push.js",
            "https://js.users.51.la/21185805.js",
            "https://www.hxcpp100.com/js/linkChange.js",
            "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
            "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 981,
            "hostname": 279,
            "domain": 202,
            "FileHash-SHA256": 73,
            "CVE": 1
          },
          "indicator_count": 1536,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1486 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "624de0699b9516c5c53a4c60",
          "name": "\u542b\u7f9e\u8349\u7814\u7a76\u6240|Fi11.com",
          "description": "var a,b,c,d, f.substr(d),a=f, a.href, and a number of other elements:a.b.search.com.",
          "modified": "2022-05-06T18:05:54.002000",
          "created": "2022-04-06T18:48:09.891000",
          "tags": [
            "date",
            "cnzzdata",
            "czuuid",
            "umdistinctid",
            "toast",
            "android",
            "androidig",
            "linuxig",
            "iphoneipodiosig",
            "ipadig",
            "windows",
            "alert",
            "image",
            "object",
            "boolean",
            "error",
            "typeof t",
            "number",
            "67108863",
            "string",
            "typeerror",
            "array",
            "promise",
            "null",
            "this",
            "unknown",
            "write",
            "iframe",
            "window",
            "backspace",
            "body",
            "verify",
            "fullscreen",
            "copyright",
            "closure library",
            "pfunction",
            "contenttype",
            "zfunction",
            "bfunction",
            "mvoid",
            "ofunction"
          ],
          "references": [
            "xfe-IP-137.220.241.241-stix2-2.0-export.json",
            "https://h5.hxcpp100.com/?id=22929",
            "https://www.google-analytics.com/analytics.js",
            "https://h5.hxcpp100.com/js/linkChange.js",
            "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
            "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
            "http://push.zhanzhang.baidu.com/push.js",
            "https://js.users.51.la/21185805.js",
            "https://www.hxcpp100.com/js/linkChange.js",
            "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
            "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 981,
            "hostname": 279,
            "domain": 202,
            "FileHash-SHA256": 73,
            "CVE": 1
          },
          "indicator_count": 1536,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1486 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "624de06b6d7b6fb1caada56a",
          "name": "\u542b\u7f9e\u8349\u7814\u7a76\u6240|Fi11.com",
          "description": "var a,b,c,d, f.substr(d),a=f, a.href, and a number of other elements:a.b.search.com.",
          "modified": "2022-05-06T18:05:54.002000",
          "created": "2022-04-06T18:48:11.932000",
          "tags": [
            "date",
            "cnzzdata",
            "czuuid",
            "umdistinctid",
            "toast",
            "android",
            "androidig",
            "linuxig",
            "iphoneipodiosig",
            "ipadig",
            "windows",
            "alert",
            "image",
            "object",
            "boolean",
            "error",
            "typeof t",
            "number",
            "67108863",
            "string",
            "typeerror",
            "array",
            "promise",
            "null",
            "this",
            "unknown",
            "write",
            "iframe",
            "window",
            "backspace",
            "body",
            "verify",
            "fullscreen",
            "copyright",
            "closure library",
            "pfunction",
            "contenttype",
            "zfunction",
            "bfunction",
            "mvoid",
            "ofunction"
          ],
          "references": [
            "xfe-IP-137.220.241.241-stix2-2.0-export.json",
            "https://h5.hxcpp100.com/?id=22929",
            "https://www.google-analytics.com/analytics.js",
            "https://h5.hxcpp100.com/js/linkChange.js",
            "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
            "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
            "http://push.zhanzhang.baidu.com/push.js",
            "https://js.users.51.la/21185805.js",
            "https://www.hxcpp100.com/js/linkChange.js",
            "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
            "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 981,
            "hostname": 279,
            "domain": 202,
            "FileHash-SHA256": 73,
            "CVE": 1
          },
          "indicator_count": 1536,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1486 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6249330bfdce75b6a0667154",
          "name": "Malware cont..",
          "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.",
          "modified": "2022-04-03T05:39:23.816000",
          "created": "2022-04-03T05:39:23.816000",
          "tags": [
            "2000px",
            "120deg",
            "10px",
            "e9e7e7",
            "b2b2b2",
            "webkitkeyframes",
            "f8f8f8",
            "d3d4d3",
            "c9c5c5",
            "alpha",
            "web mit",
            "license http",
            "invalid",
            "activexobject",
            "msies",
            "msanimationend",
            "typeof e",
            "typeof f",
            "typeof y",
            "typeof define",
            "function",
            "null",
            "typeof t",
            "array",
            "value",
            "regexp",
            "textarea",
            "azaz",
            "typeof n",
            "this",
            "date",
            "infinity",
            "iframe",
            "error",
            "typeof b",
            "pseudo",
            "child",
            "width",
            "sufeffxa0",
            "class",
            "accept"
          ],
          "references": [
            "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js",
            "https://cdn.staticfile.org/vue/1.0.21/vue.min.js",
            "https://cdn.staticfile.org/layer/3.1.1/layer.js",
            "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 914,
            "FileHash-SHA256": 23,
            "hostname": 339,
            "domain": 126
          },
          "indicator_count": 1402,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "1519 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "621fff12d2c54f70fea90576",
          "name": "Bexar.org",
          "description": "",
          "modified": "2022-04-01T00:01:54.852000",
          "created": "2022-03-02T23:34:42.531000",
          "tags": [],
          "references": [
            "www.bexar.org - urlscan.io.pdf",
            "bexar api 4.pdf",
            "bexar api 8.pdf",
            "bexar 6.pdf",
            "bexar api 2.pdf",
            "bexar api 7.pdf",
            "bexar api 3.pdf",
            "bexar api 9.pdf",
            "bexar api 12.pdf",
            "bexar api 17.pdf",
            "bexar api 15.pdf",
            "bexar api 18.pdf",
            "bexar api 10.pdf",
            "bexar api 19.pdf",
            "bexar api 20.pdf",
            "bexar api 13.pdf",
            "bexar api 21.pdf",
            "bexar api 14.pdf",
            "bexar api 22.pdf",
            "bexar1.pdf",
            "bexar api5.pdf",
            "bexar2.pdf",
            "bexar3.pdf",
            "bexar.org 3.2.22.pdf",
            "bexar6.pdf",
            "bexar5.pdf",
            "bexar api_1.pdf",
            "bexar10.pdf",
            "bexar api.pdf",
            "bexar_v1df.pdf",
            "bexarv4df.pdf",
            "bexarv2df.pdf",
            "bexarv6df.pdf",
            "bexasv3df.pdf",
            "bexarv7df.pdf",
            "bear_v apidf.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1833,
            "URL": 4669,
            "domain": 1025,
            "FileHash-SHA256": 1735,
            "email": 4,
            "FileHash-MD5": 133,
            "FileHash-SHA1": 6,
            "CIDR": 5
          },
          "indicator_count": 9410,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1522 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "bexarv2df.pdf",
        "https://cdn.staticfile.org/layer/3.1.1/layer.js",
        "bexar1.pdf",
        "bexar api 17.pdf",
        "bexar api 21.pdf",
        "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609",
        "bexar api 18.pdf",
        "bexar api 3.pdf",
        "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953",
        "xfe-IP-137.220.241.241-stix2-2.0-export.json",
        "bexar6.pdf",
        "https://js.users.51.la/21185805.js",
        "bexar5.pdf",
        "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js",
        "bexar api 8.pdf",
        "bexar api 15.pdf",
        "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
        "bexarv6df.pdf",
        "https://cdn.staticfile.org/vue/1.0.21/vue.min.js",
        "http://push.zhanzhang.baidu.com/push.js",
        "bexar api 12.pdf",
        "bexar api 7.pdf",
        "bexar api 4.pdf",
        "bexar api 14.pdf",
        "www.bexar.org - urlscan.io.pdf",
        "bexarv4df.pdf",
        "https://www.google-analytics.com/analytics.js",
        "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
        "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1",
        "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
        "bexar api 13.pdf",
        "bexar api 22.pdf",
        "https://hybrid-analysis.com/sample/12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609/63f3dde5af1db0386635b153",
        "bexar api 20.pdf",
        "bexar2.pdf",
        "bexarv7df.pdf",
        "bexar api 10.pdf",
        "bexar api 9.pdf",
        "bexar api 2.pdf",
        "bexar api5.pdf",
        "https://www.hxcpp100.com/js/linkChange.js",
        "bexar10.pdf",
        "bexar api.pdf",
        "bexar_v1df.pdf",
        "bear_v apidf.pdf",
        "bexar api_1.pdf",
        "https://h5.hxcpp100.com/js/linkChange.js",
        "bexasv3df.pdf",
        "bexar api 19.pdf",
        "bexar 6.pdf",
        "bexar.org 3.2.22.pdf",
        "https://h5.hxcpp100.com/?id=22929",
        "bexar3.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Government"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "65709786808aed5d8ee43d19",
      "name": "auto_open_controller.js - all the things using this .js file ;-(",
      "description": "",
      "modified": "2023-12-06T15:47:18.949000",
      "created": "2023-12-06T15:47:18.949000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 380,
        "URL": 802,
        "domain": 245,
        "hostname": 231,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 1
      },
      "indicator_count": 1664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707fe17dfdfe16066d16de",
      "name": "Bexar.org",
      "description": "",
      "modified": "2023-12-06T14:06:25.800000",
      "created": "2023-12-06T14:06:25.800000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1735,
        "hostname": 1833,
        "domain": 1025,
        "URL": 4668,
        "email": 4,
        "FileHash-MD5": 133,
        "FileHash-SHA1": 6,
        "CIDR": 5
      },
      "indicator_count": 9409,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "63f619404ba8714b7e063140",
      "name": "auto_open_controller.js - all the things using this .js file ;-(",
      "description": "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609",
      "modified": "2023-02-22T13:31:44.806000",
      "created": "2023-02-22T13:31:44.806000",
      "tags": [
        "memoryfile scan",
        "null",
        "runtime data",
        "void",
        "unknown",
        "android",
        "magento",
        "desktop",
        "dark",
        "scroll",
        "addressbar",
        "trigger",
        "template",
        "fast",
        "burn",
        "homepage",
        "class",
        "critical",
        "iframe",
        "lick",
        "open",
        "trace",
        "sapphire",
        "screen",
        "small",
        "close",
        "click",
        "ransomware",
        "strings",
        "malicious",
        "contains",
        "xnnew weakmap",
        "fnnew weakmap",
        "auto_open_controller.js",
        "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609/63f3dde5af1db0386635b153",
        "12a26eb45e5e3bd90c4578f8f07944baf981e6c083145990015ebc7474dee609"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1010",
          "name": "Application Window Discovery",
          "display_name": "T1010 - Application Window Discovery"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 380,
        "URL": 802,
        "hostname": 231,
        "domain": 245,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 1
      },
      "indicator_count": 1664,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 90,
      "modified_text": "1194 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "624de05d2c58343224615255",
      "name": "\u542b\u7f9e\u8349\u7814\u7a76\u6240|Fi11.com",
      "description": "var a,b,c,d, f.substr(d),a=f, a.href, and a number of other elements:a.b.search.com.",
      "modified": "2022-05-06T18:05:54.002000",
      "created": "2022-04-06T18:47:57.704000",
      "tags": [
        "date",
        "cnzzdata",
        "czuuid",
        "umdistinctid",
        "toast",
        "android",
        "androidig",
        "linuxig",
        "iphoneipodiosig",
        "ipadig",
        "windows",
        "alert",
        "image",
        "object",
        "boolean",
        "error",
        "typeof t",
        "number",
        "67108863",
        "string",
        "typeerror",
        "array",
        "promise",
        "null",
        "this",
        "unknown",
        "write",
        "iframe",
        "window",
        "backspace",
        "body",
        "verify",
        "fullscreen",
        "copyright",
        "closure library",
        "pfunction",
        "contenttype",
        "zfunction",
        "bfunction",
        "mvoid",
        "ofunction"
      ],
      "references": [
        "xfe-IP-137.220.241.241-stix2-2.0-export.json",
        "https://h5.hxcpp100.com/?id=22929",
        "https://www.google-analytics.com/analytics.js",
        "https://h5.hxcpp100.com/js/linkChange.js",
        "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
        "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
        "http://push.zhanzhang.baidu.com/push.js",
        "https://js.users.51.la/21185805.js",
        "https://www.hxcpp100.com/js/linkChange.js",
        "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
        "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "adjadex1@gmail.com",
        "id": "187163",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 981,
        "hostname": 279,
        "domain": 202,
        "FileHash-SHA256": 73,
        "CVE": 1
      },
      "indicator_count": 1536,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "1486 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "624de0699b9516c5c53a4c60",
      "name": "\u542b\u7f9e\u8349\u7814\u7a76\u6240|Fi11.com",
      "description": "var a,b,c,d, f.substr(d),a=f, a.href, and a number of other elements:a.b.search.com.",
      "modified": "2022-05-06T18:05:54.002000",
      "created": "2022-04-06T18:48:09.891000",
      "tags": [
        "date",
        "cnzzdata",
        "czuuid",
        "umdistinctid",
        "toast",
        "android",
        "androidig",
        "linuxig",
        "iphoneipodiosig",
        "ipadig",
        "windows",
        "alert",
        "image",
        "object",
        "boolean",
        "error",
        "typeof t",
        "number",
        "67108863",
        "string",
        "typeerror",
        "array",
        "promise",
        "null",
        "this",
        "unknown",
        "write",
        "iframe",
        "window",
        "backspace",
        "body",
        "verify",
        "fullscreen",
        "copyright",
        "closure library",
        "pfunction",
        "contenttype",
        "zfunction",
        "bfunction",
        "mvoid",
        "ofunction"
      ],
      "references": [
        "xfe-IP-137.220.241.241-stix2-2.0-export.json",
        "https://h5.hxcpp100.com/?id=22929",
        "https://www.google-analytics.com/analytics.js",
        "https://h5.hxcpp100.com/js/linkChange.js",
        "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
        "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
        "http://push.zhanzhang.baidu.com/push.js",
        "https://js.users.51.la/21185805.js",
        "https://www.hxcpp100.com/js/linkChange.js",
        "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
        "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "adjadex1@gmail.com",
        "id": "187163",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 981,
        "hostname": 279,
        "domain": 202,
        "FileHash-SHA256": 73,
        "CVE": 1
      },
      "indicator_count": 1536,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "1486 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "624de06b6d7b6fb1caada56a",
      "name": "\u542b\u7f9e\u8349\u7814\u7a76\u6240|Fi11.com",
      "description": "var a,b,c,d, f.substr(d),a=f, a.href, and a number of other elements:a.b.search.com.",
      "modified": "2022-05-06T18:05:54.002000",
      "created": "2022-04-06T18:48:11.932000",
      "tags": [
        "date",
        "cnzzdata",
        "czuuid",
        "umdistinctid",
        "toast",
        "android",
        "androidig",
        "linuxig",
        "iphoneipodiosig",
        "ipadig",
        "windows",
        "alert",
        "image",
        "object",
        "boolean",
        "error",
        "typeof t",
        "number",
        "67108863",
        "string",
        "typeerror",
        "array",
        "promise",
        "null",
        "this",
        "unknown",
        "write",
        "iframe",
        "window",
        "backspace",
        "body",
        "verify",
        "fullscreen",
        "copyright",
        "closure library",
        "pfunction",
        "contenttype",
        "zfunction",
        "bfunction",
        "mvoid",
        "ofunction"
      ],
      "references": [
        "xfe-IP-137.220.241.241-stix2-2.0-export.json",
        "https://h5.hxcpp100.com/?id=22929",
        "https://www.google-analytics.com/analytics.js",
        "https://h5.hxcpp100.com/js/linkChange.js",
        "https://imgs.qgddmy.com/static_h5/js/manifest.2ae2e69a05c33dfc65f8.js",
        "https://imgs.qgddmy.com/static_h5/js/vendor.4071e145e4ea91fa5ab1.js",
        "http://push.zhanzhang.baidu.com/push.js",
        "https://js.users.51.la/21185805.js",
        "https://www.hxcpp100.com/js/linkChange.js",
        "https://c.cnzz.com/core.php?web_id=1280798474&t=z",
        "https://s9.cnzz.com/z_stat.php?id=1280743953&web_id=1280743953"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "adjadex1@gmail.com",
        "id": "187163",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 981,
        "hostname": 279,
        "domain": 202,
        "FileHash-SHA256": 73,
        "CVE": 1
      },
      "indicator_count": 1536,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "1486 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6249330bfdce75b6a0667154",
      "name": "Malware cont..",
      "description": "var d=b.dir,e=c&&\"parentNode\"===d,f=x, f=w, b.b, and d(b) for the first time.",
      "modified": "2022-04-03T05:39:23.816000",
      "created": "2022-04-03T05:39:23.816000",
      "tags": [
        "2000px",
        "120deg",
        "10px",
        "e9e7e7",
        "b2b2b2",
        "webkitkeyframes",
        "f8f8f8",
        "d3d4d3",
        "c9c5c5",
        "alpha",
        "web mit",
        "license http",
        "invalid",
        "activexobject",
        "msies",
        "msanimationend",
        "typeof e",
        "typeof f",
        "typeof y",
        "typeof define",
        "function",
        "null",
        "typeof t",
        "array",
        "value",
        "regexp",
        "textarea",
        "azaz",
        "typeof n",
        "this",
        "date",
        "infinity",
        "iframe",
        "error",
        "typeof b",
        "pseudo",
        "child",
        "width",
        "sufeffxa0",
        "class",
        "accept"
      ],
      "references": [
        "https://cdn.staticfile.org/jquery/2.1.4/jquery.min.js",
        "https://cdn.staticfile.org/vue/1.0.21/vue.min.js",
        "https://cdn.staticfile.org/layer/3.1.1/layer.js",
        "https://cdn.staticfile.org/layer/3.1.1/theme/default/layer.css?v=3.1.1"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "adjadex1@gmail.com",
        "id": "187163",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 914,
        "FileHash-SHA256": 23,
        "hostname": 339,
        "domain": 126
      },
      "indicator_count": 1402,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "1519 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "621fff12d2c54f70fea90576",
      "name": "Bexar.org",
      "description": "",
      "modified": "2022-04-01T00:01:54.852000",
      "created": "2022-03-02T23:34:42.531000",
      "tags": [],
      "references": [
        "www.bexar.org - urlscan.io.pdf",
        "bexar api 4.pdf",
        "bexar api 8.pdf",
        "bexar 6.pdf",
        "bexar api 2.pdf",
        "bexar api 7.pdf",
        "bexar api 3.pdf",
        "bexar api 9.pdf",
        "bexar api 12.pdf",
        "bexar api 17.pdf",
        "bexar api 15.pdf",
        "bexar api 18.pdf",
        "bexar api 10.pdf",
        "bexar api 19.pdf",
        "bexar api 20.pdf",
        "bexar api 13.pdf",
        "bexar api 21.pdf",
        "bexar api 14.pdf",
        "bexar api 22.pdf",
        "bexar1.pdf",
        "bexar api5.pdf",
        "bexar2.pdf",
        "bexar3.pdf",
        "bexar.org 3.2.22.pdf",
        "bexar6.pdf",
        "bexar5.pdf",
        "bexar api_1.pdf",
        "bexar10.pdf",
        "bexar api.pdf",
        "bexar_v1df.pdf",
        "bexarv4df.pdf",
        "bexarv2df.pdf",
        "bexarv6df.pdf",
        "bexasv3df.pdf",
        "bexarv7df.pdf",
        "bear_v apidf.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1833,
        "URL": 4669,
        "domain": 1025,
        "FileHash-SHA256": 1735,
        "email": 4,
        "FileHash-MD5": 133,
        "FileHash-SHA1": 6,
        "CIDR": 5
      },
      "indicator_count": 9410,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 406,
      "modified_text": "1522 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "i.read",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "i.read",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780289838.565079
}