{
  "type": "Domain",
  "indicator": "isatechnology.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/isatechnology.com",
    "alexa": "http://www.alexa.com/siteinfo/isatechnology.com",
    "indicator": "isatechnology.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2476795705,
      "indicator": "isatechnology.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "69a185462e3c17c346bcdf79",
          "name": "The Trans-Pacific Mesh & Starfield Pipeline Subversion",
          "description": "The September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirm an advanced architectural alignment targeting the Hillsboro \"Silicon Forest\" ring and the TallComponents (.NET) document pipeline. By nesting an unauthorized clientAuth extension within a legitimate Starfield (Mesh Digital) signature, the operative successfully bridged the gap between web traffic and hardware-level telematics.\nThis campaign weaponized the 159,942 Majestic Trust Flow to validate a Serial 1 SOA shadow zone, neutralizing filters while executing ASP.NET Core (Kestrel) request smuggling via the 13.32.205.51 node. This subversion is evidenced by the 60-second TTL oscillation of 3.169.202.x clusters, creating a detectable \"fast-flux\" latency at the HIO52 (Hillsboro) edge. Finally, the Mesh Digital registrant pivot to hex-encoded 34326... and 1f8f41... identifiers secures the Tallfield Pipeline\u2014a hijacked Azure-hosted backend for identity packaging of Amex and UGA credentials.",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T11:51:34.696000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 710,
            "URL": 355,
            "hostname": 252,
            "CVE": 4,
            "CIDR": 6,
            "FileHash-MD5": 615,
            "FileHash-SHA1": 585,
            "email": 21,
            "FileHash-SHA256": 4316,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 6866,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "60 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62cbdddd1fc2e2956bfacda5",
          "name": "vvvvv",
          "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.",
          "modified": "2022-08-10T00:00:07.214000",
          "created": "2022-07-11T08:22:53.511000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "leiwen15",
            "id": "157128",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3662,
            "URL": 250,
            "domain": 1592,
            "FileHash-MD5": 4,
            "email": 2
          },
          "indicator_count": 5510,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 41,
          "modified_text": "1390 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62cbdde0447b9617f24a8901",
          "name": "vvvvv",
          "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.",
          "modified": "2022-08-10T00:00:07.214000",
          "created": "2022-07-11T08:22:56.693000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "leiwen15",
            "id": "157128",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3662,
            "URL": 250,
            "domain": 1592,
            "FileHash-MD5": 4,
            "email": 2
          },
          "indicator_count": 5510,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 41,
          "modified_text": "1390 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62cbddf0c4709eb7b4d0fb94",
          "name": "data of hhh",
          "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.",
          "modified": "2022-08-10T00:00:07.214000",
          "created": "2022-07-11T08:23:12.624000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "leiwen15",
            "id": "157128",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 3662,
            "URL": 250,
            "domain": 1592,
            "FileHash-MD5": 4,
            "email": 2
          },
          "indicator_count": 5510,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 44,
          "modified_text": "1390 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "69a185462e3c17c346bcdf79",
      "name": "The Trans-Pacific Mesh & Starfield Pipeline Subversion",
      "description": "The September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirm an advanced architectural alignment targeting the Hillsboro \"Silicon Forest\" ring and the TallComponents (.NET) document pipeline. By nesting an unauthorized clientAuth extension within a legitimate Starfield (Mesh Digital) signature, the operative successfully bridged the gap between web traffic and hardware-level telematics.\nThis campaign weaponized the 159,942 Majestic Trust Flow to validate a Serial 1 SOA shadow zone, neutralizing filters while executing ASP.NET Core (Kestrel) request smuggling via the 13.32.205.51 node. This subversion is evidenced by the 60-second TTL oscillation of 3.169.202.x clusters, creating a detectable \"fast-flux\" latency at the HIO52 (Hillsboro) edge. Finally, the Mesh Digital registrant pivot to hex-encoded 34326... and 1f8f41... identifiers secures the Tallfield Pipeline\u2014a hijacked Azure-hosted backend for identity packaging of Amex and UGA credentials.",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-02-27T11:51:34.696000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 710,
        "URL": 355,
        "hostname": 252,
        "CVE": 4,
        "CIDR": 6,
        "FileHash-MD5": 615,
        "FileHash-SHA1": 585,
        "email": 21,
        "FileHash-SHA256": 4316,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 6866,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "60 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62cbdddd1fc2e2956bfacda5",
      "name": "vvvvv",
      "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.",
      "modified": "2022-08-10T00:00:07.214000",
      "created": "2022-07-11T08:22:53.511000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "leiwen15",
        "id": "157128",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3662,
        "URL": 250,
        "domain": 1592,
        "FileHash-MD5": 4,
        "email": 2
      },
      "indicator_count": 5510,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 41,
      "modified_text": "1390 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62cbdde0447b9617f24a8901",
      "name": "vvvvv",
      "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.",
      "modified": "2022-08-10T00:00:07.214000",
      "created": "2022-07-11T08:22:56.693000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "leiwen15",
        "id": "157128",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3662,
        "URL": 250,
        "domain": 1592,
        "FileHash-MD5": 4,
        "email": 2
      },
      "indicator_count": 5510,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 41,
      "modified_text": "1390 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62cbddf0c4709eb7b4d0fb94",
      "name": "data of hhh",
      "description": "The internet is full of people, but not everyone wants to see it, so here's a look at some of the more eye-catching snippets from the past few days:..com.",
      "modified": "2022-08-10T00:00:07.214000",
      "created": "2022-07-11T08:23:12.624000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "leiwen15",
        "id": "157128",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_157128/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 3662,
        "URL": 250,
        "domain": 1592,
        "FileHash-MD5": 4,
        "email": 2
      },
      "indicator_count": 5510,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 44,
      "modified_text": "1390 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "isatechnology.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "isatechnology.com",
    "found": true,
    "verdict": "malicious",
    "url_count": 3,
    "online_count": 0,
    "blacklists": {
      "spamhaus_dbl": "not listed",
      "surbl": "not listed"
    },
    "urls": [
      {
        "url": "http://isatechnology.com/print/y2e6c00661868226018wqx7geew06e/",
        "status": "offline",
        "threat": "malware_download",
        "date_added": "2020-08-14",
        "tags": [
          "doc",
          "emotet",
          "epoch2",
          "heodo"
        ]
      },
      {
        "url": "http://isatechnology.com/print/79117882563/",
        "status": "offline",
        "threat": "malware_download",
        "date_added": "2020-08-07",
        "tags": [
          "doc",
          "emotet",
          "epoch2",
          "heodo",
          "Quakbot"
        ]
      },
      {
        "url": "http://isatechnology.com/print/60ka4484819911634268909r5a94sk9qha44yu/",
        "status": "offline",
        "threat": "malware_download",
        "date_added": "2020-07-30",
        "tags": [
          "doc",
          "emotet",
          "epoch2",
          "heodo"
        ]
      }
    ],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780207047.2279565
}