{
  "type": "Domain",
  "indicator": "nist.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/nist.com",
    "alexa": "http://www.alexa.com/siteinfo/nist.com",
    "indicator": "nist.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4227429004,
      "indicator": "nist.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "699bf39a4b96d1d4236cf91f",
          "name": "Suspicious PDF Analysis+Behavioral Summary",
          "description": "Analysis of network and process logs indicates an attempt to undermine the system\u2019s Root of Trust by manipulating certificate validation files. The attacker is likely using Man-in-the-Middle techniques to force the system to accept revoked or fraudulent certificates. Additionally, suspicious activity within Adobe processes suggests that software update mechanisms are being hijacked to execute malicious code. Immediate isolation is required to prevent the installation of unauthorized software or the interception of encrypted data.",
          "modified": "2026-05-15T17:51:27.499000",
          "created": "2026-02-23T06:28:42.282000",
          "tags": [
            ""
          ],
          "references": [
            "",
            "TLP: AMBER"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            ""
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": true,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 1892,
            "FileHash-SHA256": 9944,
            "FileHash-MD5": 1802,
            "URL": 225,
            "hostname": 445,
            "domain": 284,
            "CVE": 91,
            "SSLCertFingerprint": 2,
            "email": 14,
            "CIDR": 5
          },
          "indicator_count": 14704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 72,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a91445f5535f47dda9facf",
          "name": "URI\tData http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?16a1051449177920",
          "description": "URI\tData\nhttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?16a1051449177920",
          "modified": "2026-04-04T05:18:12.440000",
          "created": "2026-03-05T05:27:33.527000",
          "tags": [
            "uri data"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 12,
            "domain": 18,
            "hostname": 20,
            "FileHash-MD5": 68,
            "FileHash-SHA1": 66,
            "FileHash-SHA256": 196
          },
          "indicator_count": 380,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "59 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a1253b80afb273a203dc37",
          "name": "Unsigned \"Everything Installer\"",
          "description": "The full text of the Microsoft Visual C/C++ executable (EXE32) has been published on the website, and here is the full list of highlights::., as well as the following:",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T05:01:47.524000",
          "tags": [
            "compiler",
            "pe32",
            "intel",
            "ms windows",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "pe32 installer",
            "exe32"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 17,
            "FileHash-SHA1": 10,
            "FileHash-SHA256": 104,
            "hostname": 13,
            "domain": 26,
            "URL": 9,
            "CVE": 2,
            "email": 2
          },
          "indicator_count": 183,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a145ba89a2b4af5a0aa721",
          "name": "Credential Stuffing & C2 Config: AREK-BTC Variant (Zeppelin-Linked)",
          "description": "IoCs for 83hcm-eadaebdbd / BF_BIND_STUFF Campaign\n[CONFIG_START]\nVERSION: 4.2.1-NSV4\nSERVER_HOST: akamaihd.net/eum/results.txt\nAUTH_KEY: 83hcm-eadaebdbd\nTARGET_LIST: /nests/stuffed_cred_v4.db\nACTION: BF_BIND_STUFF\nRETRY_LIMIT: 400\nLOG_PATH: /tmp/results_log.txt\n[PAYLOAD_REDIRECTS]\nURL1: https://formsv.nycourts.gov...\nURL2: https://caneidhelp.miami.edu...\nURL3: https://www.americanexpress.com...\n[USER_AGENT_SPOOF]\nMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n[END_CONFIG]",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T07:20:26.222000",
          "tags": [
            "configstart",
            "version",
            "authkey",
            "url1",
            "useragentspoof",
            "windows nt",
            "win64",
            "endconfig"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 91,
            "domain": 33,
            "hostname": 29,
            "FileHash-SHA256": 91,
            "FileHash-MD5": 1,
            "FileHash-SHA1": 20,
            "CVE": 14,
            "email": 1
          },
          "indicator_count": 280,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a1535debec4128ab952040",
          "name": "I See You, Too. #.icu",
          "description": "The NSV4-ICU campaign exhibits a profound cryptographic and linguistic mismatch betokening a Western operator driving a foreign engine. While the tactical codebase utilizes GBK-encoded (Simplified Chinese) metadata, the binary logs reveal a definitive tradecraft failure: the presence of \u00ba\u00c3\u00b0\u00c9 (H\u01ceo ba), a conversational \"Alrighty.\" This is likely a failed attempt to utilize a foreign language on a Western-localized screen, resulting in \"Mojibake\" (garbage text) and the semantic error of identifying the developer as a \"Novelist\" (Zu\u00f2zh\u011b) rather than a \"Programmer.\"\nBy stripping Western UTF-8 telemetry through spoofed Nashville (BNA) and Apple/Google thumbprints, the operator confirms Local Root CA injection and a manual interception pipeline. The .icu (I See You) signature is ultimately undermined by the operator's own metadata\u2014effectively a Westerner shouting in a digital dialect they don't speak, creating a detectable encoding-latency signature that peels back the \"invisible typhoon\" mask.",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T08:18:37.071000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 294,
            "CVE": 22,
            "URL": 278,
            "FileHash-MD5": 234,
            "FileHash-SHA1": 240,
            "FileHash-SHA256": 1663,
            "hostname": 142,
            "YARA": 1,
            "email": 13,
            "CIDR": 2
          },
          "indicator_count": 2889,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69a1702ccff0b6afd6c01180",
          "name": "Strategic Intel Brief: The \"Shadow Corridor\" Persistence",
          "description": "The forensic convergence of the September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirms a high-fidelity infrastructure alignment targeting the Port of Portland\u2019s aviation assets. By embedding an unauthorized clientAuth extension within a legitimate Amazon RSA signature, the adversary bridged the gap between web traffic and hardware-level telematics, facilitating a sophisticated identity packaging campaign. This operation leveraged the 159,942 Majestic Trust Rank to validate a Serial 1 SOA shadow zone, utilizing ASP.NET Core request smuggling via the 13.32.205.51 node to maintain a low-noise presence across the PDX-HIO-TTD corridor. This alignment is evidenced by the 60-second TTL rotation of 3.169.202.x collection nodes, while the Network Solutions registrant shift to the hex-encoded 3432650ec... ID provides the final administrative anchor for the 2031 lease.",
          "modified": "2026-04-01T00:44:45.494000",
          "created": "2026-02-27T10:21:32.721000",
          "tags": [
            "a div",
            "div div",
            "click",
            "span",
            "class",
            "travelers span",
            "div language",
            "cultureen",
            "english",
            "culturees",
            "title",
            "main"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 15,
            "FileHash-SHA1": 20,
            "URL": 225,
            "domain": 375,
            "hostname": 315,
            "email": 20,
            "FileHash-SHA256": 122,
            "CVE": 18
          },
          "indicator_count": 1110,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "63 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "TLP: AMBER"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            ""
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "699bf39a4b96d1d4236cf91f",
      "name": "Suspicious PDF Analysis+Behavioral Summary",
      "description": "Analysis of network and process logs indicates an attempt to undermine the system\u2019s Root of Trust by manipulating certificate validation files. The attacker is likely using Man-in-the-Middle techniques to force the system to accept revoked or fraudulent certificates. Additionally, suspicious activity within Adobe processes suggests that software update mechanisms are being hijacked to execute malicious code. Immediate isolation is required to prevent the installation of unauthorized software or the interception of encrypted data.",
      "modified": "2026-05-15T17:51:27.499000",
      "created": "2026-02-23T06:28:42.282000",
      "tags": [
        ""
      ],
      "references": [
        "",
        "TLP: AMBER"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        ""
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": true,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 1892,
        "FileHash-SHA256": 9944,
        "FileHash-MD5": 1802,
        "URL": 225,
        "hostname": 445,
        "domain": 284,
        "CVE": 91,
        "SSLCertFingerprint": 2,
        "email": 14,
        "CIDR": 5
      },
      "indicator_count": 14704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 72,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a91445f5535f47dda9facf",
      "name": "URI\tData http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?16a1051449177920",
      "description": "URI\tData\nhttp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?16a1051449177920",
      "modified": "2026-04-04T05:18:12.440000",
      "created": "2026-03-05T05:27:33.527000",
      "tags": [
        "uri data"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 12,
        "domain": 18,
        "hostname": 20,
        "FileHash-MD5": 68,
        "FileHash-SHA1": 66,
        "FileHash-SHA256": 196
      },
      "indicator_count": 380,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "59 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a1253b80afb273a203dc37",
      "name": "Unsigned \"Everything Installer\"",
      "description": "The full text of the Microsoft Visual C/C++ executable (EXE32) has been published on the website, and here is the full list of highlights::., as well as the following:",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-02-27T05:01:47.524000",
      "tags": [
        "compiler",
        "pe32",
        "intel",
        "ms windows",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "pe32 installer",
        "exe32"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 17,
        "FileHash-SHA1": 10,
        "FileHash-SHA256": 104,
        "hostname": 13,
        "domain": 26,
        "URL": 9,
        "CVE": 2,
        "email": 2
      },
      "indicator_count": 183,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a145ba89a2b4af5a0aa721",
      "name": "Credential Stuffing & C2 Config: AREK-BTC Variant (Zeppelin-Linked)",
      "description": "IoCs for 83hcm-eadaebdbd / BF_BIND_STUFF Campaign\n[CONFIG_START]\nVERSION: 4.2.1-NSV4\nSERVER_HOST: akamaihd.net/eum/results.txt\nAUTH_KEY: 83hcm-eadaebdbd\nTARGET_LIST: /nests/stuffed_cred_v4.db\nACTION: BF_BIND_STUFF\nRETRY_LIMIT: 400\nLOG_PATH: /tmp/results_log.txt\n[PAYLOAD_REDIRECTS]\nURL1: https://formsv.nycourts.gov...\nURL2: https://caneidhelp.miami.edu...\nURL3: https://www.americanexpress.com...\n[USER_AGENT_SPOOF]\nMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\n[END_CONFIG]",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-02-27T07:20:26.222000",
      "tags": [
        "configstart",
        "version",
        "authkey",
        "url1",
        "useragentspoof",
        "windows nt",
        "win64",
        "endconfig"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 91,
        "domain": 33,
        "hostname": 29,
        "FileHash-SHA256": 91,
        "FileHash-MD5": 1,
        "FileHash-SHA1": 20,
        "CVE": 14,
        "email": 1
      },
      "indicator_count": 280,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 70,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a1535debec4128ab952040",
      "name": "I See You, Too. #.icu",
      "description": "The NSV4-ICU campaign exhibits a profound cryptographic and linguistic mismatch betokening a Western operator driving a foreign engine. While the tactical codebase utilizes GBK-encoded (Simplified Chinese) metadata, the binary logs reveal a definitive tradecraft failure: the presence of \u00ba\u00c3\u00b0\u00c9 (H\u01ceo ba), a conversational \"Alrighty.\" This is likely a failed attempt to utilize a foreign language on a Western-localized screen, resulting in \"Mojibake\" (garbage text) and the semantic error of identifying the developer as a \"Novelist\" (Zu\u00f2zh\u011b) rather than a \"Programmer.\"\nBy stripping Western UTF-8 telemetry through spoofed Nashville (BNA) and Apple/Google thumbprints, the operator confirms Local Root CA injection and a manual interception pipeline. The .icu (I See You) signature is ultimately undermined by the operator's own metadata\u2014effectively a Westerner shouting in a digital dialect they don't speak, creating a detectable encoding-latency signature that peels back the \"invisible typhoon\" mask.",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-02-27T08:18:37.071000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 294,
        "CVE": 22,
        "URL": 278,
        "FileHash-MD5": 234,
        "FileHash-SHA1": 240,
        "FileHash-SHA256": 1663,
        "hostname": 142,
        "YARA": 1,
        "email": 13,
        "CIDR": 2
      },
      "indicator_count": 2889,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69a1702ccff0b6afd6c01180",
      "name": "Strategic Intel Brief: The \"Shadow Corridor\" Persistence",
      "description": "The forensic convergence of the September 26, 2025, shadow renewal and the May 2, 2025, certificate issuance (925a10) confirms a high-fidelity infrastructure alignment targeting the Port of Portland\u2019s aviation assets. By embedding an unauthorized clientAuth extension within a legitimate Amazon RSA signature, the adversary bridged the gap between web traffic and hardware-level telematics, facilitating a sophisticated identity packaging campaign. This operation leveraged the 159,942 Majestic Trust Rank to validate a Serial 1 SOA shadow zone, utilizing ASP.NET Core request smuggling via the 13.32.205.51 node to maintain a low-noise presence across the PDX-HIO-TTD corridor. This alignment is evidenced by the 60-second TTL rotation of 3.169.202.x collection nodes, while the Network Solutions registrant shift to the hex-encoded 3432650ec... ID provides the final administrative anchor for the 2031 lease.",
      "modified": "2026-04-01T00:44:45.494000",
      "created": "2026-02-27T10:21:32.721000",
      "tags": [
        "a div",
        "div div",
        "click",
        "span",
        "class",
        "travelers span",
        "div language",
        "cultureen",
        "english",
        "culturees",
        "title",
        "main"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 15,
        "FileHash-SHA1": 20,
        "URL": 225,
        "domain": 375,
        "hostname": 315,
        "email": 20,
        "FileHash-SHA256": 122,
        "CVE": 18
      },
      "indicator_count": 1110,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "63 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "nist.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "nist.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780458650.7290628
}