{
  "type": "Domain",
  "indicator": "line-wff.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/line-wff.com",
    "alexa": "http://www.alexa.com/siteinfo/line-wff.com",
    "indicator": "line-wff.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3927847223,
      "indicator": "line-wff.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "687b5499d48de6e54f3bff11",
          "name": "213.174.130.70 - Spyware Install  | Emotet via Malware sites",
          "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets",
          "modified": "2025-08-18T08:00:43.712000",
          "created": "2025-07-19T08:17:29.443000",
          "tags": [
            "handle",
            "ripe ncc",
            "ripe network",
            "address range",
            "cidr",
            "allocation type",
            "assigned pa",
            "status",
            "whois server",
            "entity ah36ripe",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "cnsectigo rsa",
            "secure server",
            "ca validity",
            "date",
            "abuse contact",
            "orgid",
            "orgtechhandle",
            "address",
            "orgabuseref",
            "postalcode",
            "ripe",
            "seen",
            "update date",
            "tech email",
            "admin country",
            "expiration date",
            "dnssec",
            "admin id",
            "mi11255597wp",
            "msie",
            "chrome",
            "passive dns",
            "united",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "hosting",
            "open",
            "body",
            "extraction",
            "data upload",
            "failed",
            "include review",
            "anorexx",
            "video",
            "father sex",
            "ebony riding",
            "ebony",
            "roberta",
            "type win32",
            "exe size",
            "mb first",
            "file name",
            "sentinelone",
            "present jul",
            "present oct",
            "entries http",
            "memcommit",
            "t1055",
            "read c",
            "search",
            "entries",
            "show",
            "medium",
            "showing",
            "high process",
            "injection t1055",
            "copy",
            "write",
            "win32",
            "malware",
            "tsara brashears",
            "tsara",
            "pornhub",
            "porn videos",
            "watch tsara",
            "most relevant",
            "open threat",
            "exchange",
            "public",
            "https",
            "green",
            "daily",
            "brashears",
            "porn",
            "watch",
            "busty xxx",
            "filter tsara",
            "brashears porn",
            "url add",
            "pulse pulses",
            "http",
            "related pulses",
            "none related",
            "tags none",
            "file type",
            "md5 sha256",
            "google safe",
            "browsing",
            "dynamicloader",
            "dynamic",
            "read",
            "delete",
            "mtb apr",
            "trojan",
            "lowfi",
            "virtool",
            "icloader apr",
            "otx telemetry",
            "australia",
            "exploit",
            "cobalt strike",
            "hostile",
            "trojanspy",
            "msil",
            "win64",
            "pulse",
            "alerts",
            "yara rule",
            "named pipe",
            "xe7xf3xf2x14x9d",
            "high",
            "delphi",
            "local",
            "next",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "defense evasion",
            "adversaries",
            "spawns",
            "found",
            "process details",
            "flag",
            "contacted",
            "meta",
            "location united",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha256",
            "sha1",
            "size",
            "beginstring",
            "null",
            "type data",
            "error",
            "span",
            "hybrid",
            "general",
            "click",
            "strings",
            "refresh",
            "tools",
            "pattern match",
            "show technique",
            "mitre att",
            "ck matrix",
            "ascii text",
            "show process",
            "utf8",
            "crlf line",
            "network traffic",
            "path",
            "included",
            "review",
            "excludea",
            "sugges data",
            "typ url",
            "url url",
            "url hos",
            "hos hos",
            "extraction f",
            "enter so",
            "u extractio",
            "extra data",
            "included review",
            "ic excluded",
            "suggeste",
            "pulses",
            "md5 google",
            "safe browsing",
            "virustotal api",
            "comments",
            "ally s",
            "extraction data",
            "enter soudcfidi",
            "ad temdac",
            "cddad ad",
            "praw type",
            "extr",
            "include u",
            "creation date",
            "record value",
            "gmt content",
            "x adblock",
            "certificate",
            "domain",
            "encrypt",
            "sec ch",
            "ch ua",
            "unknown aaaa",
            "ua full",
            "ua platform",
            "present jun",
            "moved",
            "ip address",
            "doctype html",
            "lander script",
            "head",
            "method",
            "allowed date",
            "arizona",
            "scottsdale",
            "go daddy",
            "authority",
            "next associated",
            "extraction fail",
            "enter soupce",
            "udi ad",
            "trydda dada",
            "panca type",
            "ur extraction",
            "s data",
            "pr extract",
            "servers",
            "hostname",
            "files ip",
            "denmark unknown"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 4,
            "URL": 7528,
            "domain": 1822,
            "hostname": 2015,
            "email": 5,
            "FileHash-MD5": 373,
            "FileHash-SHA1": 363,
            "FileHash-SHA256": 1939
          },
          "indicator_count": 14049,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "288 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "667d131a14a61dd078e00ecc",
          "name": "UAlberta - Cisco Related Samples from U of A Infrastructure",
          "description": "Cisco AnyConnect Secure Client\nUAlberta - Cisco Related Samples from U of A Infrastructure",
          "modified": "2025-03-22T11:01:47.545000",
          "created": "2024-06-27T07:22:02.067000",
          "tags": [
            "please",
            "javascript",
            "entity",
            "onlink",
            "preferred",
            "encrypted",
            "dns suffix",
            "ipv6 address",
            "secure mobility",
            "control bytes",
            "control",
            "inbound",
            "outbound"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/summary",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/iocs",
            "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/graph"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 152,
            "CIDR": 42,
            "FileHash-MD5": 20,
            "FileHash-SHA1": 20,
            "URL": 321,
            "domain": 375,
            "hostname": 116
          },
          "indicator_count": 1046,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "437 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6647908c09468f42bc1249f1",
          "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
          "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
          "modified": "2025-03-01T04:59:57.222000",
          "created": "2024-05-17T17:14:52.317000",
          "tags": [
            "false",
            "true",
            "visible",
            "application",
            "microsoft teams",
            "microsoft azure",
            "office",
            "service",
            "dynamics",
            "hidden",
            "android",
            "explorer",
            "write",
            "connector",
            "test",
            "sharepoint",
            "live",
            "meister",
            "tools",
            "desktop",
            "spark",
            "front",
            "enterprise",
            "designer",
            "atlas",
            "premium",
            "assistant",
            "allow",
            "azureadmyorg",
            "game",
            "verify",
            "microsoft power",
            "channelsurfcli",
            "mtd1",
            "file transfer",
            "magnus",
            "microsoft crm",
            "youth"
          ],
          "references": [
            "All - EnterpriseAppsList.csv",
            "AppRegistrationList.csv",
            "https://tria.ge/240517-vc7c1shc62/behavioral1",
            "https://tria.ge/240517-vdwb5shc71/behavioral1",
            "https://tria.ge/240517-vqxezaaa33/behavioral1",
            "https://tria.ge/240517-t9pc2ahb2t",
            "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
            "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
            "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
            "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
            "Thor Scan: S-I9VvMTB6cZU",
            "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
            "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
            "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
            "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
            "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
            "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
            "https://tria.ge/240521-q4s79agb25/static1",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
            "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
            "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
            "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
            "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
            "https://www.hudsonrock.com/search?domain=ualberta.ca",
            "https://www.criminalip.io/domain/report?scan_id=13798622",
            "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
            "https://urlscan.io/search/#ualberta.ca",
            "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
            "https://sitereport.netcraft.com/?url=http://ualberta.ca",
            "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
            "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
            "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
            "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
            "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
            "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 7,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1703,
            "FileHash-SHA256": 90472,
            "URL": 99185,
            "domain": 82954,
            "hostname": 39041,
            "FileHash-SHA1": 1624,
            "email": 4658,
            "CVE": 12
          },
          "indicator_count": 319649,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "458 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "670ffc8487aaf80605755b62",
          "name": "vgt.pl (VGT.pl) or plix.pl (plix.net) 104.21.40.140 172.67.186.229",
          "description": "You can get help with your computer problems using the Help and Support section or via Skype or Telegram, if you want to get in touch with the support team or use the help of the UK's TalkTalk service.",
          "modified": "2024-12-30T17:38:55.943000",
          "created": "2024-10-16T17:48:52.704000",
          "tags": [
            "pe32",
            "intel",
            "ms windows",
            "plik",
            "trojandropper",
            "trojan",
            "win32",
            "msil",
            "sha1",
            "sha256",
            "imphasz",
            "tekst ascii",
            "dane obrazu",
            "crlf",
            "dokument html",
            "unicode",
            "z bom",
            "rgba",
            "z terminatorami",
            "z bardzo",
            "utf8 unicode",
            "sobota",
            "sie usertrust",
            "salford o",
            "comodo ca",
            "limited st",
            "salt lake",
            "city o",
            "wto cze",
            "worldsetup c",
            "il l",
            "error",
            "null",
            "mapa",
            "liczba",
            "string",
            "bigint",
            "obiekt",
            "prawa autorskie",
            "nieznanybd",
            "uint8array",
            "android",
            "void",
            "unknown",
            "false",
            "roboto",
            "body",
            "this",
            "infinity",
            "outside",
            "span",
            "as13335",
            "cloudflare",
            "datasheet",
            "arkusz",
            "wyszukiwarka",
            "control panel",
            "support",
            "email",
            "a letter",
            "help",
            "mail",
            "management",
            "jpeg",
            "jfif",
            "dane",
            "dpcm",
            "ascii z",
            "dane archiwalne",
            "windows"
          ],
          "references": [
            "https://www.plix.pl/system/companies/logos/000/000/526/original/gigainternet-logo.png",
            "http://plix.net",
            "http://www.plix.net",
            "https://www.plix.pl",
            "http://www.plix.pl"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 291,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 516,
            "hostname": 705,
            "URL": 1831,
            "FileHash-SHA256": 3315,
            "CIDR": 4,
            "IPv6": 4,
            "IPv4": 49,
            "FileHash-MD5": 794,
            "FileHash-SHA1": 572,
            "email": 1,
            "CVE": 14
          },
          "indicator_count": 7805,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 128,
          "modified_text": "519 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "All - EnterpriseAppsList.csv",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "http://www.plix.net",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/graph",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/iocs",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "https://www.plix.pl/system/companies/logos/000/000/526/original/gigainternet-logo.png",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "https://urlscan.io/search/#ualberta.ca",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://www.plix.pl",
        "https://tria.ge/240517-t9pc2ahb2t",
        "AppRegistrationList.csv",
        "http://www.plix.pl",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/summary",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "http://plix.net"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Healthcare",
            "Technology",
            "Telecommunications",
            "Education",
            "Government"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "687b5499d48de6e54f3bff11",
      "name": "213.174.130.70 - Spyware Install  | Emotet via Malware sites",
      "description": "Malicious IP address for multiple malware domains. Very malicious spyware, will hijack network and devices. \n\u2022 Best Targeted sites \nSpyware Install\n\u2022 Garveep POST CnC\nBeacon\n\u2022 Worm.Mydoom\nCheckin\n\n#endgame #emotet #mydoom #malware_domains #install_spyware #monitered_targets",
      "modified": "2025-08-18T08:00:43.712000",
      "created": "2025-07-19T08:17:29.443000",
      "tags": [
        "handle",
        "ripe ncc",
        "ripe network",
        "address range",
        "cidr",
        "allocation type",
        "assigned pa",
        "status",
        "whois server",
        "entity ah36ripe",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "cnsectigo rsa",
        "secure server",
        "ca validity",
        "date",
        "abuse contact",
        "orgid",
        "orgtechhandle",
        "address",
        "orgabuseref",
        "postalcode",
        "ripe",
        "seen",
        "update date",
        "tech email",
        "admin country",
        "expiration date",
        "dnssec",
        "admin id",
        "mi11255597wp",
        "msie",
        "chrome",
        "passive dns",
        "united",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "urls",
        "files",
        "hosting",
        "open",
        "body",
        "extraction",
        "data upload",
        "failed",
        "include review",
        "anorexx",
        "video",
        "father sex",
        "ebony riding",
        "ebony",
        "roberta",
        "type win32",
        "exe size",
        "mb first",
        "file name",
        "sentinelone",
        "present jul",
        "present oct",
        "entries http",
        "memcommit",
        "t1055",
        "read c",
        "search",
        "entries",
        "show",
        "medium",
        "showing",
        "high process",
        "injection t1055",
        "copy",
        "write",
        "win32",
        "malware",
        "tsara brashears",
        "tsara",
        "pornhub",
        "porn videos",
        "watch tsara",
        "most relevant",
        "open threat",
        "exchange",
        "public",
        "https",
        "green",
        "daily",
        "brashears",
        "porn",
        "watch",
        "busty xxx",
        "filter tsara",
        "brashears porn",
        "url add",
        "pulse pulses",
        "http",
        "related pulses",
        "none related",
        "tags none",
        "file type",
        "md5 sha256",
        "google safe",
        "browsing",
        "dynamicloader",
        "dynamic",
        "read",
        "delete",
        "mtb apr",
        "trojan",
        "lowfi",
        "virtool",
        "icloader apr",
        "otx telemetry",
        "australia",
        "exploit",
        "cobalt strike",
        "hostile",
        "trojanspy",
        "msil",
        "win64",
        "pulse",
        "alerts",
        "yara rule",
        "named pipe",
        "xe7xf3xf2x14x9d",
        "high",
        "delphi",
        "local",
        "next",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "defense evasion",
        "adversaries",
        "spawns",
        "found",
        "process details",
        "flag",
        "contacted",
        "meta",
        "location united",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha256",
        "sha1",
        "size",
        "beginstring",
        "null",
        "type data",
        "error",
        "span",
        "hybrid",
        "general",
        "click",
        "strings",
        "refresh",
        "tools",
        "pattern match",
        "show technique",
        "mitre att",
        "ck matrix",
        "ascii text",
        "show process",
        "utf8",
        "crlf line",
        "network traffic",
        "path",
        "included",
        "review",
        "excludea",
        "sugges data",
        "typ url",
        "url url",
        "url hos",
        "hos hos",
        "extraction f",
        "enter so",
        "u extractio",
        "extra data",
        "included review",
        "ic excluded",
        "suggeste",
        "pulses",
        "md5 google",
        "safe browsing",
        "virustotal api",
        "comments",
        "ally s",
        "extraction data",
        "enter soudcfidi",
        "ad temdac",
        "cddad ad",
        "praw type",
        "extr",
        "include u",
        "creation date",
        "record value",
        "gmt content",
        "x adblock",
        "certificate",
        "domain",
        "encrypt",
        "sec ch",
        "ch ua",
        "unknown aaaa",
        "ua full",
        "ua platform",
        "present jun",
        "moved",
        "ip address",
        "doctype html",
        "lander script",
        "head",
        "method",
        "allowed date",
        "arizona",
        "scottsdale",
        "go daddy",
        "authority",
        "next associated",
        "extraction fail",
        "enter soupce",
        "udi ad",
        "trydda dada",
        "panca type",
        "ur extraction",
        "s data",
        "pr extract",
        "servers",
        "hostname",
        "files ip",
        "denmark unknown"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 4,
        "URL": 7528,
        "domain": 1822,
        "hostname": 2015,
        "email": 5,
        "FileHash-MD5": 373,
        "FileHash-SHA1": 363,
        "FileHash-SHA256": 1939
      },
      "indicator_count": 14049,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "288 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "667d131a14a61dd078e00ecc",
      "name": "UAlberta - Cisco Related Samples from U of A Infrastructure",
      "description": "Cisco AnyConnect Secure Client\nUAlberta - Cisco Related Samples from U of A Infrastructure",
      "modified": "2025-03-22T11:01:47.545000",
      "created": "2024-06-27T07:22:02.067000",
      "tags": [
        "please",
        "javascript",
        "entity",
        "onlink",
        "preferred",
        "encrypted",
        "dns suffix",
        "ipv6 address",
        "secure mobility",
        "control bytes",
        "control",
        "inbound",
        "outbound"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/summary",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/iocs",
        "https://www.virustotal.com/gui/collection/bb0c0633dbe98b659fb06e07acd6e1f51ca43d3a1b4be09b4e9bfe8b3fde0cdb/graph"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 152,
        "CIDR": 42,
        "FileHash-MD5": 20,
        "FileHash-SHA1": 20,
        "URL": 321,
        "domain": 375,
        "hostname": 116
      },
      "indicator_count": 1046,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "437 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6647908c09468f42bc1249f1",
      "name": "University of Alberta Azure/Entra Compromised Tenant Compromized Institution",
      "description": "Update: Academic/Non-Academic Staff Unions, 3rd party org, & some profs/students/alumni tried raising concerns to Admins/President/IST & CISO => Maintaining position they will not be looking into reported problems re: Cybersecurity under any circumstances = more time more problems? Attempts to advocate -> Harrass./Discrim./De-humanizing responses from admins (representing all folks - recorded). \nTenant ID: 718b8a9b-44d8-441a-a344-4294ea842172 = This pulse is 1 example (small) of problems.\n\nPrimary domain\nualbertaca.onmicrosoft.com\nCustom Domain Names\nualberta.ca\nVerified\nualbertaca.onmicrosoft.com",
      "modified": "2025-03-01T04:59:57.222000",
      "created": "2024-05-17T17:14:52.317000",
      "tags": [
        "false",
        "true",
        "visible",
        "application",
        "microsoft teams",
        "microsoft azure",
        "office",
        "service",
        "dynamics",
        "hidden",
        "android",
        "explorer",
        "write",
        "connector",
        "test",
        "sharepoint",
        "live",
        "meister",
        "tools",
        "desktop",
        "spark",
        "front",
        "enterprise",
        "designer",
        "atlas",
        "premium",
        "assistant",
        "allow",
        "azureadmyorg",
        "game",
        "verify",
        "microsoft power",
        "channelsurfcli",
        "mtd1",
        "file transfer",
        "magnus",
        "microsoft crm",
        "youth"
      ],
      "references": [
        "All - EnterpriseAppsList.csv",
        "AppRegistrationList.csv",
        "https://tria.ge/240517-vc7c1shc62/behavioral1",
        "https://tria.ge/240517-vdwb5shc71/behavioral1",
        "https://tria.ge/240517-vqxezaaa33/behavioral1",
        "https://tria.ge/240517-t9pc2ahb2t",
        "https://www.virustotal.com/graph/embed/g9453a2f58a3340f18120987c2b4d710dbb44ded88c434abf8894458a98c7bd4b?theme=dark",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/iocs",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/graph",
        "https://www.virustotal.com/gui/collection/b84a19d60ec7cd6d546a3f145dff8987128d0f499161118b46de22718d4713cd/summary",
        "https://www.filescan.io/uploads/66479b483313f70f0afe3dbb",
        "https://www.filescan.io/uploads/664799c9d5c40bffee6106d7",
        "Thor Scan: S-I9VvMTB6cZU",
        "https://www.filescan.io/uploads/664ba368d5c40bffee63b1ee/reports/31817751-6b5d-45df-8813-472aa6c756a3/overview",
        "https://www.filescan.io/uploads/664ba8a20663ff3c2ec6428a/reports/09d3d82a-7ec1-4804-93e5-5ae691fbb7f2/overview",
        "https://imp0rtp3.wordpress.com/2021/08/12/tetris/",
        "https://www.filescan.io/uploads/664bb0cd7c9fb1468fc610c5/reports/00c78e4d-2156-4906-a106-ebf7e2723251/overview",
        "https://www.filescan.io/uploads/664bb40fbc04dffa92240ca2/reports/398074f2-c7b6-40e9-9b5c-4225cc990473/overview",
        "https://www.filescan.io/uploads/664bb683bc04dffa92241015/reports/92b70fd6-97d7-4386-8465-f3fd79043843/overview",
        "https://tria.ge/240521-q4s79agb25/static1",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906322f5af13cdfb50be",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/664f906222f5af13cdfb5093",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767/reports/dda2c8a1-96fd-4c00-9cbc-c64c4685a804/overview",
        "https://www.filescan.io/uploads/666d69ff6b8dba248b414767",
        "https://viz.greynoise.io/analysis/33e9b33b-b932-4c43-9be1-3e2d6f9cb4b3",
        "https://viz.greynoise.io/analysis/e51d9a15-d802-4d51-9a70-17803dc2693a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b",
        "Above Malcore Strings: All - EnterpriseAppsList, AppRegistration, EnterpriseAppslist, exportGroup, exportUsers, HiddenApps - EnterpriseAppsList****",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00975ea31558d54fceea",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cff1a5ea31558d54fcbf6",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d0107b44401771de9ebf2",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d00356dd8f43b723a915a",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667cffec5ea31558d54fcda2",
        "https://www.hudsonrock.com/search?domain=ualberta.ca",
        "https://www.criminalip.io/domain/report?scan_id=13798622",
        "https://viz.greynoise.io/analysis/9635144c-db8f-47ab-a83a-5785602244cf - 07.03.24",
        "https://urlscan.io/search/#ualberta.ca",
        "https://www.virustotal.com/gui/collection/0ca12fcdd125ec5a5055180ee828b98d47b8b2e920660be559c2b602266b6b1d/iocs",
        "https://sitereport.netcraft.com/?url=http://ualberta.ca",
        "https://www.wordfence.com/blog/2022/10/threat-advisory-monitoring-cve-2022-42889-text4shell-exploit-attempts/",
        "https://tenantresolution.pingcastle.com/Search - Tenant still active (07.19.24) - Good jobs ya'll",
        "https://www.virustotal.com/graph/embed/gf1d5aa209c7f4fd086e4cb17dcd0af52421ea4bae87d49fe9b4076b382612f0e?theme=dark",
        "https://viz.greynoise.io/query/AS36351%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS60068%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS8075%20classification:%22malicious%22",
        "https://viz.greynoise.io/query/AS15169%20classification:%22malicious%22",
        "https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b - https://app.malcore.io/share/652553f6aec33d70a1dbbd25/667d01d2b67682d81c00f37b = Hidden Apps - Enterprise Apps List"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Healthcare",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 7,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1703,
        "FileHash-SHA256": 90472,
        "URL": 99185,
        "domain": 82954,
        "hostname": 39041,
        "FileHash-SHA1": 1624,
        "email": 4658,
        "CVE": 12
      },
      "indicator_count": 319649,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "458 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "670ffc8487aaf80605755b62",
      "name": "vgt.pl (VGT.pl) or plix.pl (plix.net) 104.21.40.140 172.67.186.229",
      "description": "You can get help with your computer problems using the Help and Support section or via Skype or Telegram, if you want to get in touch with the support team or use the help of the UK's TalkTalk service.",
      "modified": "2024-12-30T17:38:55.943000",
      "created": "2024-10-16T17:48:52.704000",
      "tags": [
        "pe32",
        "intel",
        "ms windows",
        "plik",
        "trojandropper",
        "trojan",
        "win32",
        "msil",
        "sha1",
        "sha256",
        "imphasz",
        "tekst ascii",
        "dane obrazu",
        "crlf",
        "dokument html",
        "unicode",
        "z bom",
        "rgba",
        "z terminatorami",
        "z bardzo",
        "utf8 unicode",
        "sobota",
        "sie usertrust",
        "salford o",
        "comodo ca",
        "limited st",
        "salt lake",
        "city o",
        "wto cze",
        "worldsetup c",
        "il l",
        "error",
        "null",
        "mapa",
        "liczba",
        "string",
        "bigint",
        "obiekt",
        "prawa autorskie",
        "nieznanybd",
        "uint8array",
        "android",
        "void",
        "unknown",
        "false",
        "roboto",
        "body",
        "this",
        "infinity",
        "outside",
        "span",
        "as13335",
        "cloudflare",
        "datasheet",
        "arkusz",
        "wyszukiwarka",
        "control panel",
        "support",
        "email",
        "a letter",
        "help",
        "mail",
        "management",
        "jpeg",
        "jfif",
        "dane",
        "dpcm",
        "ascii z",
        "dane archiwalne",
        "windows"
      ],
      "references": [
        "https://www.plix.pl/system/companies/logos/000/000/526/original/gigainternet-logo.png",
        "http://plix.net",
        "http://www.plix.net",
        "https://www.plix.pl",
        "http://www.plix.pl"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 291,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 516,
        "hostname": 705,
        "URL": 1831,
        "FileHash-SHA256": 3315,
        "CIDR": 4,
        "IPv6": 4,
        "IPv4": 49,
        "FileHash-MD5": 794,
        "FileHash-SHA1": 572,
        "email": 1,
        "CVE": 14
      },
      "indicator_count": 7805,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 128,
      "modified_text": "519 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "line-wff.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "line-wff.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780447391.8816643
}