{
  "type": "Domain",
  "indicator": "list.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/list.com",
    "alexa": "http://www.alexa.com/siteinfo/list.com",
    "indicator": "list.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3520630490,
      "indicator": "list.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "692e068ff95076bb8e75bd9f",
          "name": "Telehealth Exploit",
          "description": "",
          "modified": "2025-12-31T21:02:25",
          "created": "2025-12-01T21:20:15.043000",
          "tags": [
            "passive dns",
            "urls",
            "http",
            "hostname",
            "files domain",
            "files related",
            "pulses none",
            "related tags",
            "none google",
            "safe browsing",
            "present dec",
            "status",
            "date",
            "united",
            "name servers",
            "netherlands",
            "unknown ns",
            "ip address",
            "search",
            "showing",
            "local",
            "data upload",
            "extraction",
            "flag",
            "bad traffic",
            "et hunting",
            "domain m2",
            "suspicious tls",
            "sni request",
            "windir",
            "openurl c",
            "dns requests",
            "et info",
            "tls handshake",
            "prefetch2",
            "analysis",
            "tor analysis",
            "domain address",
            "tlsv1",
            "jfif",
            "jpeg image",
            "ascii text",
            "entries",
            "as15169",
            "show",
            "read c",
            "write",
            "next",
            "persistence",
            "execution",
            "crash",
            "copy"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 260,
            "hostname": 555,
            "URL": 1803,
            "FileHash-SHA256": 1437,
            "FileHash-MD5": 113,
            "FileHash-SHA1": 13,
            "email": 4,
            "SSLCertFingerprint": 18,
            "CVE": 1
          },
          "indicator_count": 4204,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "152 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62d5dbe2b3fe8238f80b1fb5",
          "name": "Rogue Instagram Account photos and videos",
          "description": "Rogue Instagram account used to troll and phish.",
          "modified": "2022-08-17T00:02:07.076000",
          "created": "2022-07-18T22:17:06.045000",
          "tags": [
            "instagram"
          ],
          "references": [
            "https://www.instagram.com/melindaa.rivera_/?igshid=YmMyMTA2M2Y%3D",
            "report-668597.pdf",
            "https://linkin.click/melindaa.rivera_"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "v1gil0x",
            "id": "4651",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/v1gil0x/resized/80/vigilox_logo.jpg",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 142,
            "FileHash-SHA1": 84,
            "FileHash-SHA256": 84,
            "URL": 68,
            "domain": 45,
            "hostname": 25
          },
          "indicator_count": 448,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 77,
          "modified_text": "1385 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.instagram.com/melindaa.rivera_/?igshid=YmMyMTA2M2Y%3D",
        "https://linkin.click/melindaa.rivera_",
        "report-668597.pdf"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "692e068ff95076bb8e75bd9f",
      "name": "Telehealth Exploit",
      "description": "",
      "modified": "2025-12-31T21:02:25",
      "created": "2025-12-01T21:20:15.043000",
      "tags": [
        "passive dns",
        "urls",
        "http",
        "hostname",
        "files domain",
        "files related",
        "pulses none",
        "related tags",
        "none google",
        "safe browsing",
        "present dec",
        "status",
        "date",
        "united",
        "name servers",
        "netherlands",
        "unknown ns",
        "ip address",
        "search",
        "showing",
        "local",
        "data upload",
        "extraction",
        "flag",
        "bad traffic",
        "et hunting",
        "domain m2",
        "suspicious tls",
        "sni request",
        "windir",
        "openurl c",
        "dns requests",
        "et info",
        "tls handshake",
        "prefetch2",
        "analysis",
        "tor analysis",
        "domain address",
        "tlsv1",
        "jfif",
        "jpeg image",
        "ascii text",
        "entries",
        "as15169",
        "show",
        "read c",
        "write",
        "next",
        "persistence",
        "execution",
        "crash",
        "copy"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 260,
        "hostname": 555,
        "URL": 1803,
        "FileHash-SHA256": 1437,
        "FileHash-MD5": 113,
        "FileHash-SHA1": 13,
        "email": 4,
        "SSLCertFingerprint": 18,
        "CVE": 1
      },
      "indicator_count": 4204,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "152 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62d5dbe2b3fe8238f80b1fb5",
      "name": "Rogue Instagram Account photos and videos",
      "description": "Rogue Instagram account used to troll and phish.",
      "modified": "2022-08-17T00:02:07.076000",
      "created": "2022-07-18T22:17:06.045000",
      "tags": [
        "instagram"
      ],
      "references": [
        "https://www.instagram.com/melindaa.rivera_/?igshid=YmMyMTA2M2Y%3D",
        "report-668597.pdf",
        "https://linkin.click/melindaa.rivera_"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "v1gil0x",
        "id": "4651",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/v1gil0x/resized/80/vigilox_logo.jpg",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 142,
        "FileHash-SHA1": 84,
        "FileHash-SHA256": 84,
        "URL": 68,
        "domain": 45,
        "hostname": 25
      },
      "indicator_count": 448,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 77,
      "modified_text": "1385 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "list.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "list.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780421316.2745135
}