{
  "type": "Domain",
  "indicator": "omeda.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/omeda.com",
    "alexa": "http://www.alexa.com/siteinfo/omeda.com",
    "indicator": "omeda.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 315724231,
      "indicator": "omeda.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 16,
      "pulses": [
        {
          "id": "69228447b9c71795633314df",
          "name": "Keep Corrupt - University of Alberta Incidents continue to escalate - 04.24.26",
          "description": "Recovered accounts that have been used & abused - courtesy of decisions by non-technical leadership = accounts for UAlberta students -> PW manager made inaccessible (tied to UAlberta account) during a Data-Breach.\nWhen PW manager & Accounts returned, was populated by these (many = fraudulent; some appear to be abuse of legitimate services, while others do not, yet don't know function or origin)\n\nNot representative of OG PW manager. Many (most) accts. used/abused (on-going). \n\nDon't have a backup of original = hard to compare. Don't quite know what the majority of these companies etc. are for and/or do exactly. Putting them together as they roll-in.\nCan't turn them off in most cases - I don't have access to the U of A accounts these originate from and/or original recovery methods. \n\n2 more batches to add to this pulse (Need to add into VT) 02.16.26\n\nCountries listed are where 2 victims (UAlberta Graduates) have citizenship or some tie with.",
          "modified": "2026-05-24T21:18:51.782000",
          "created": "2025-11-23T03:49:27.649000",
          "tags": [
            "geoip",
            "as54113",
            "fastly",
            "as20940",
            "as15169",
            "google",
            "as214401",
            "maincubesas",
            "gmbh",
            "apache geoip",
            "facebook",
            "UAlberta",
            "AHS",
            "Treaty 8",
            "GoA",
            "Alberta",
            "Edmonton",
            "YEG"
          ],
          "references": [
            "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a",
            "URLscanio, FSio, vT",
            "03.11.14: https://www.virustotal.com/graph/embed/ge2e309eb8bd34fcca56398089b2291058dfe1fca69dc4e5aa66db0365caf735b?theme=dark",
            "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/summary",
            "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/iocs",
            "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a (11.22.25)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Cura\u00e7ao",
            "Guatemala",
            "Sint Maarten (Dutch part)",
            "Tanzania, United Republic of",
            "Barbados",
            "United States of America",
            "Bahamas",
            "Anguilla",
            "Canada",
            "Saint Vincent and the Grenadines",
            "United Kingdom of Great Britain and Northern Ireland",
            "Kenya",
            "France",
            "Aruba",
            "Mexico",
            "Poland",
            "Costa Rica",
            "Ireland",
            "Trinidad and Tobago",
            "Netherlands",
            "Slovakia",
            "Spain",
            "Philippines"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Technology",
            "Telecommunications",
            "Education",
            "Healthcare",
            "Finance",
            "Retail",
            "Hospitality",
            "Transportation"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 3,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 47,
            "FileHash-MD5": 53,
            "FileHash-SHA1": 16,
            "FileHash-SHA256": 1059,
            "URL": 6374,
            "domain": 3314,
            "email": 1395,
            "hostname": 3740,
            "CVE": 1
          },
          "indicator_count": 15999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 136,
          "modified_text": "7 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "695089cbedad5c86f39b1363",
          "name": "Tracking Domains 03.03.26 (Updated Test)",
          "description": "Privacy Badger - Update on 01.09.26\nTracking domains on a hybrid (mobile laptop) clone of an AHS/Covenant Health, UAlberta (University of Alberta), and Government of Alberta Laptop.\nHealthcare: No Cybersecurity, EDU: No Cybersecurity / Remote only, GoA = Informed & don't quite know what to do or to whom this should be brought up with.",
          "modified": "2026-04-05T06:35:43.679000",
          "created": "2025-12-28T01:37:15.993000",
          "tags": [
            "privacy badger",
            "sites general",
            "settings widget",
            "domains manage",
            "data privacy",
            "badger",
            "hide"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
            "https://yaraify.abuse.ch/scan/results/32bfc760-1757-11f1-b47f-42010aa4000b",
            "https://polyswarm.network/scan/results/file/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
            "https://app.threat.zone/submission/c8b0b1e4-0c9b-4210-b5ce-1dc2303445df/overview",
            "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs",
            "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/summary",
            "https://www.virustotal.com/graph/embed/g6d4bce6162064ac09cd20411c1947e69d7d5a1d475f0447da023ac933d338fce?theme=dark",
            "https://viz.greynoise.io/ip/analysis/6356f330-63a7-4ce3-91fa-7ab355a1dc1a"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Healthcare",
            "Government",
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 50404,
            "hostname": 10879,
            "URL": 715,
            "FileHash-MD5": 1
          },
          "indicator_count": 61999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 132,
          "modified_text": "57 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "691b61e16cea7624a6606a69",
          "name": "For Later",
          "description": "***",
          "modified": "2025-11-17T18:46:19.094000",
          "created": "2025-11-17T17:56:49.875000",
          "tags": [
            "wormhole",
            "want",
            "sign",
            "submit send",
            "copy",
            "share show",
            "report delete",
            "faq roadmap",
            "security legal",
            "twitter discord",
            "protected"
          ],
          "references": [
            "https://wormhole.app/Pp5DdP#3EpzsqLhw5lJdQ0Xe_mRQA",
            "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 72127,
            "hostname": 16700,
            "URL": 50
          },
          "indicator_count": 88877,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 131,
          "modified_text": "195 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66e9c8e63a72c7cb531a58ba",
          "name": "08.09.24 URLscanio 2 weeks.csv",
          "description": "",
          "modified": "2025-10-25T02:09:23.619000",
          "created": "2024-09-17T18:22:30.731000",
          "tags": [],
          "references": [
            "https://x.com/NorrisN60014/status/1836092481978486802",
            "https://x.com/NorrisN60014/status/1836092481978486802",
            "https://www.hybrid-analysis.com/sample/a4f03d9a35524a7c0596777ea2b1fe5d98161b2462435e6056e4e39eb869396d/66e9ae1eb806d5b3300b842f",
            "https://viz.greynoise.io/analysis/79a3ab55-982c-4fb7-9952-abde6f1219c2",
            "https://www.filescan.io/uploads/66e9b5494a48170ff00c8102/reports",
            "https://report.netcraft.com/submission/9R7KbGQKOvzU9GBdraRBpUJ4C",
            "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcn"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-MD5": 6,
            "URL": 1074,
            "domain": 1530,
            "email": 2,
            "hostname": 2849
          },
          "indicator_count": 5464,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 189,
          "modified_text": "219 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "68bbf3e40e3ce8a74aa89545",
          "name": "HCPF \u2022 The intricate relationships between the FIN7 group and members of the Conti gang",
          "description": "",
          "modified": "2025-10-06T08:03:23.285000",
          "created": "2025-09-06T08:42:12.787000",
          "tags": [
            "present feb",
            "united",
            "a domains",
            "present dec",
            "passive dns",
            "moved",
            "script domains",
            "script urls",
            "search",
            "title",
            "date",
            "http traffic",
            "http get",
            "match info",
            "downloads",
            "info",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "protocol t1095",
            "get http",
            "dns resolutions",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cnamazon rsa",
            "m03 oamazon",
            "thumbprint",
            "msie",
            "windows nt",
            "wow64",
            "slcc2",
            "media center",
            "tlsv1",
            "ascii text",
            "ogoogle trust",
            "cngts ca",
            "execution",
            "next",
            "dock",
            "write",
            "capture",
            "persistence",
            "malware",
            "roboto",
            "android",
            "known exploited",
            "google",
            "salesloft drift",
            "sap s4hana",
            "cve202542957",
            "cisa",
            "sitecore",
            "linux",
            "france",
            "meta",
            "rokrat",
            "lizar",
            "project nemesis",
            "carbanak",
            "cobalt strike",
            "domino",
            "yara detections",
            "contacted",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "malicious ids",
            "detections tls",
            "indicator role",
            "title added",
            "active related",
            "entries",
            "role title",
            "added active",
            "filehashmd5",
            "ipv4"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lizar",
              "display_name": "Lizar",
              "target": null
            },
            {
              "id": "Project Nemesis",
              "display_name": "Project Nemesis",
              "target": null
            },
            {
              "id": "Carbanak",
              "display_name": "Carbanak",
              "target": null
            },
            {
              "id": "Cobalt Strike",
              "display_name": "Cobalt Strike",
              "target": null
            },
            {
              "id": "Domino",
              "display_name": "Domino",
              "target": null
            },
            {
              "id": "RokRAT",
              "display_name": "RokRAT",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1571",
              "name": "Non-Standard Port",
              "display_name": "T1571 - Non-Standard Port"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            }
          ],
          "industries": [
            "Hospitality",
            "Financial"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 539,
            "FileHash-SHA1": 389,
            "FileHash-SHA256": 3386,
            "domain": 862,
            "hostname": 1155,
            "URL": 4091,
            "CVE": 3,
            "SSLCertFingerprint": 5
          },
          "indicator_count": 10430,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 144,
          "modified_text": "238 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "688716977e80a4274f2eafa9",
          "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
          "description": "Found in Bot joining Pulse.",
          "modified": "2025-08-27T06:03:05.020000",
          "created": "2025-07-28T06:20:07.660000",
          "tags": [
            "present jul",
            "united",
            "entries",
            "search",
            "moved",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "body",
            "meta",
            "passive dns",
            "next associated",
            "win32spigot apr",
            "title error",
            "ipv4 add",
            "pulse pulses",
            "urls",
            "files",
            "adaptivebee",
            "worm",
            "win32",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results jul",
            "location united",
            "asn asnone",
            "nameservers",
            "less whois",
            "registrar",
            "csc corporate",
            "status",
            "servers",
            "name servers",
            "hostname",
            "hostname add",
            "a domains",
            "script urls",
            "unknown aaaa",
            "technology one",
            "script script",
            "certificate",
            "null",
            "trojan",
            "twitter",
            "domain",
            "files ip",
            "address domain",
            "ip related",
            "pulses otx",
            "virtool",
            "http",
            "present jun",
            "present may",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "australia asn",
            "as55532 squiz",
            "dns resolutions",
            "overview ip",
            "address",
            "ipv4",
            "iocs",
            "data upload",
            "extraction",
            "ided iocs",
            "failed",
            "shaw",
            "ail tvnas",
            "rl irl",
            "domain add",
            "ostname add",
            "verdict",
            "show",
            "types",
            "type",
            "indicator data",
            "searc type",
            "a indicator",
            "data",
            "select across",
            "all pages",
            "domain domain",
            "checked url",
            "hostname server",
            "response ip",
            "address google",
            "safe browsing",
            "msie",
            "chrome",
            "present dec",
            "base",
            "read c",
            "port",
            "destination",
            "delete",
            "copy",
            "write",
            "memcommit",
            "cryptexportkey",
            "invalid pointer",
            "writeconsolea",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "signing defense",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "sha1",
            "sha256",
            "pattern match",
            "size",
            "ascii text",
            "crlf line",
            "mitre att",
            "error",
            "click",
            "hybrid",
            "local",
            "path",
            "starfield",
            "strings",
            "refresh",
            "tools",
            "onload",
            "span",
            "form",
            "adversaries",
            "windows nt",
            "generic http",
            "exe upload",
            "inbound",
            "outbound",
            "yara detections",
            "malware",
            "expiration date",
            "whois show",
            "name andrew",
            "bauer name",
            "div id",
            "beginstring",
            "beginerror",
            "script",
            "general",
            "cloud",
            "find",
            "footer",
            "ninite feb",
            "telper",
            "ninite mar",
            "ninite apr",
            "trojandropper",
            "mtb mar",
            "url https",
            "general full",
            "security tls",
            "software",
            "resource hash",
            "protocol h2",
            "frankfurt",
            "main",
            "germany",
            "input",
            "skype",
            "opciones",
            "july",
            "es form",
            "dom name",
            "post https",
            "imagen",
            "microsoft",
            "iniciar sesin",
            "value",
            "variables",
            "config",
            "debug",
            "loader",
            "geturl",
            "b function",
            "addlistener",
            "proof",
            "amazon02",
            "dk summary",
            "amazon rsa",
            "september",
            "browsing",
            "resource",
            "asn16509",
            "name value",
            "queueprogress",
            "timestamp input",
            "status actions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 487,
            "FileHash-SHA1": 461,
            "URL": 10732,
            "domain": 1672,
            "email": 6,
            "hostname": 3039,
            "FileHash-SHA256": 2569,
            "SSLCertFingerprint": 7
          },
          "indicator_count": 18973,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "278 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66f235b9a7a94a6a61acd651",
          "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
          "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
          "modified": "2025-03-07T08:38:08.584000",
          "created": "2024-09-24T03:44:57.902000",
          "tags": [
            "geoip",
            "public url",
            "as16509",
            "amazon02",
            "as20940",
            "akamaiasn1",
            "as8075",
            "as15169",
            "google",
            "akamaias",
            "facebook",
            "telecom",
            "twitter",
            "media",
            "win64",
            "level3",
            "mini",
            "ukraine",
            "proton",
            "ghost",
            "win32",
            "cuba",
            "mexico",
            "indonesia",
            "seznam",
            "as3359",
            "as852"
          ],
          "references": [
            "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
            "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
            "https://n0paste.eu/UH6n5pD/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada",
            "Anguilla",
            "Poland",
            "Aruba",
            "Australia",
            "Barbados",
            "Costa Rica",
            "Guatemala",
            "Philippines",
            "Panama",
            "Sint Maarten (Dutch part)",
            "Saint Martin (French part)",
            "Cayman Islands",
            "Cura\u00e7ao",
            "Mexico",
            "Saint Vincent and the Grenadines",
            "Saint Kitts and Nevis",
            "Tanzania, United Republic of",
            "Netherlands",
            "Ukraine",
            "Trinidad and Tobago",
            "Japan",
            "Bahamas",
            "United Kingdom of Great Britain and Northern Ireland",
            "Georgia"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government",
            "Telecommunications",
            "Healthcare"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1,
            "CIDR": 1186,
            "CVE": 4,
            "FileHash-MD5": 29,
            "FileHash-SHA1": 3,
            "URL": 25493,
            "domain": 5396,
            "email": 10,
            "hostname": 10770
          },
          "indicator_count": 42892,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 149,
          "modified_text": "451 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66b0fa3624bf0384e427f2e7",
          "name": "Tracking Domains 4.2 - 08.19.24",
          "description": "Tracking Domains detected by Privacy Badger Ext. on Microsoft Edge Browser (W11 Device) using Telus ISP (ASN852)\n*Not-Enriched (08.05.24): ~50,000 suggests IOCs by AlienVault\nFrom VT: 2 IPs hosted by 45090 (Shenzhen Tencent Computer Systems Company Limited) & 4611 (CNNIC member) seem to be the problem here 118[.]89.204.198, 118[.]89.0.0/16 & 202[.]123.107.15, 202[.]123.107.0/24 (Respectively)",
          "modified": "2024-09-04T15:01:01.432000",
          "created": "2024-08-05T16:13:42.563000",
          "tags": [],
          "references": [
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
            "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
            "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
            "https://viz.greynoise.io/query/AS4611",
            "https://urlscan.io/asn/AS4611",
            "https://urlscan.io/search/#asn:%22AS4611%22",
            "https://urlscan.io/asn/AS45090",
            "https://urlscan.io/search/#asn%3A%22AS45090%22",
            "https://viz.greynoise.io/query/AS45090",
            "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
            "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
            "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
            "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 6180,
            "FileHash-MD5": 1,
            "domain": 24921,
            "URL": 10854
          },
          "indicator_count": 41956,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "635 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66269b1f33258a8e26033b17",
          "name": "Tracking Domains - Part 4.1",
          "description": "More Tracking Domains",
          "modified": "2024-08-30T13:02:28.335000",
          "created": "2024-04-22T17:15:11.398000",
          "tags": [
            "Tracking Domains"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
            "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark",
            "https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 94496,
            "FileHash-MD5": 63,
            "domain": 112327,
            "URL": 166918,
            "FileHash-SHA1": 33,
            "FileHash-SHA256": 103,
            "CIDR": 216
          },
          "indicator_count": 374156,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "640 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66269b204ecfba63974dc1d8",
          "name": "Tracking Domains - Part 4",
          "description": "More Tracking Domains",
          "modified": "2024-05-22T17:04:45.215000",
          "created": "2024-04-22T17:15:12.353000",
          "tags": [
            "Tracking Domains"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
            "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 792,
            "FileHash-MD5": 1,
            "domain": 5803,
            "URL": 2
          },
          "indicator_count": 6598,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 136,
          "modified_text": "739 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65831c52eceb4090b5d49d21",
          "name": "Critical (GC)",
          "description": "",
          "modified": "2024-01-19T15:01:02.500000",
          "created": "2023-12-20T16:54:42.626000",
          "tags": [
            "ssl certificate",
            "threat roundup",
            "referrer",
            "historical",
            "historical ssl",
            "colors",
            "pattern match",
            "windir",
            "openurl c",
            "logo",
            "december",
            "default browser",
            "guest system",
            "professional",
            "service pack",
            "click",
            "strings",
            "report",
            "command_and_control",
            "file",
            "ascii text",
            "done adding",
            "catalog file",
            "appdata",
            "united",
            "windows nt",
            "indicator",
            "mitre att",
            "date",
            "unknown",
            "error",
            "general",
            "local",
            "facebook",
            "class",
            "generator",
            "critical",
            "span",
            "gc",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "httponly",
            "secure",
            "dynamic expires",
            "blacklist",
            "site",
            "cisco umbrella",
            "worm",
            "malware-as_a_service"
          ],
          "references": [
            "https://neca.omeclk.com/portal/wts/uc^cn^ejkaejsaBeyk7-^Oa",
            "https://www.hybrid-analysis.com/sample/f7cb7c256e840ab93e6991462cedf6eac928c12f4102798986e2c5d27d1abc7f"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Gc",
              "display_name": "Gc",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 57,
            "FileHash-SHA1": 59,
            "FileHash-SHA256": 1358,
            "URL": 1430,
            "domain": 245,
            "hostname": 676
          },
          "indicator_count": 3825,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "864 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65574cb4447c8d87ad85fa75",
          "name": "Masquerading",
          "description": "",
          "modified": "2023-12-17T11:03:45.376000",
          "created": "2023-11-17T11:21:24.343000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "filehashmd5",
            "iocs",
            "url http",
            "expiration",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "create new",
            "blacklist http",
            "laplasclipper",
            "malicious url",
            "cisco umbrella",
            "site",
            "alexa top",
            "blacklist",
            "safe site",
            "malware site",
            "phishing site",
            "malicious site",
            "malware",
            "china unknown",
            "united",
            "unknown",
            "as54994 quantil",
            "cname",
            "nxdomain",
            "as8068",
            "as4134 chinanet",
            "passive dns",
            "domain",
            "next",
            "filehashsha1",
            "service company",
            "servers",
            "ndicator role",
            "title added",
            "active related",
            "pulses url",
            "showing",
            "entries",
            "pulses http",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "report spam",
            "author avatar",
            "created",
            "hour ago",
            "trojanspy",
            "redline",
            "pulses hostname",
            "blacklist https",
            "indicator role",
            "bidid",
            "adid",
            "v4us",
            "v51845481",
            "hostname",
            "http",
            "cisco",
            "umbrella rank",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de summary",
            "frankfurt",
            "main",
            "reverse dns",
            "general full",
            "asn16509",
            "amazon02",
            "resource",
            "protocol h2",
            "security tls",
            "hash",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "postitem",
            "variables",
            "parameters",
            "systemid object",
            "def function",
            "login",
            "get h2",
            "secrets llc",
            "agreement",
            "the site",
            "content",
            "policy",
            "this site",
            "claims",
            "florida",
            "please",
            "premium",
            "service",
            "restrict",
            "express",
            "media",
            "facebook",
            "twitter",
            "final",
            "first",
            "cloudflarenet",
            "gts ca",
            "software",
            "million",
            "hours ago",
            "chameleon",
            "heur",
            "phishing",
            "riskware",
            "agent",
            "unsafe",
            "opencandy",
            "exploit",
            "mimikatz",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "download",
            "beach research",
            "germany",
            "asn20940",
            "akamaiasn1",
            "threat report",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "alexa",
            "maltiverse",
            "google",
            "qtsas",
            "name value",
            "no data",
            "tag count",
            "count blacklist",
            "pbiptbmvd0k4",
            "glelexoputyh",
            "suppobox",
            "team",
            "bambernek",
            "internet storm",
            "phishtank",
            "phish",
            "trickbot",
            "telecom",
            "bank",
            "ipv4",
            "octoseek report",
            "spam https",
            "tsara brashears",
            "malvertizing",
            "tracking",
            "tagging",
            "spyder",
            "cybercrime",
            "email collection",
            "apple data collection",
            "win32 exe",
            "ms word",
            "document",
            "type name",
            "javascript",
            "network capture",
            "files",
            "detections type",
            "name",
            "ssl certificate",
            "whois whois",
            "tsara brashears",
            "whois record",
            "asn owner",
            "highly targeted",
            "kgs0",
            "kls0",
            "relacionada",
            "family",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "ursnif",
            "remcos",
            "core",
            "redline stealer",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "execution",
            "network",
            "communicating",
            "referrer",
            "parent",
            "historical ssl",
            "siblings",
            "resolutions",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "error",
            "file",
            "indicator",
            "script",
            "typeof e",
            "ascii text",
            "appdata",
            "date",
            "windir",
            "span",
            "body",
            "meta",
            "class",
            "generator",
            "info",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "form",
            "footer",
            "html",
            "union",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "crack",
            "webtoolbar",
            "threat roundup",
            "contacted",
            "june",
            "july",
            "october",
            "august"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [
            "Health",
            "Nutritional",
            "Medical",
            "Medicine"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 103,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 400,
            "FileHash-SHA1": 240,
            "FileHash-SHA256": 6459,
            "hostname": 4845,
            "URL": 11514,
            "CVE": 15,
            "domain": 3179,
            "email": 31
          },
          "indicator_count": 26683,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "897 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65574cbe6bdbe24ecb170b24",
          "name": "Masquerading",
          "description": "",
          "modified": "2023-12-17T11:03:45.376000",
          "created": "2023-11-17T11:21:34.083000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "filehashmd5",
            "iocs",
            "url http",
            "expiration",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "create new",
            "blacklist http",
            "laplasclipper",
            "malicious url",
            "cisco umbrella",
            "site",
            "alexa top",
            "blacklist",
            "safe site",
            "malware site",
            "phishing site",
            "malicious site",
            "malware",
            "china unknown",
            "united",
            "unknown",
            "as54994 quantil",
            "cname",
            "nxdomain",
            "as8068",
            "as4134 chinanet",
            "passive dns",
            "domain",
            "next",
            "filehashsha1",
            "service company",
            "servers",
            "ndicator role",
            "title added",
            "active related",
            "pulses url",
            "showing",
            "entries",
            "pulses http",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "report spam",
            "author avatar",
            "created",
            "hour ago",
            "trojanspy",
            "redline",
            "pulses hostname",
            "blacklist https",
            "indicator role",
            "bidid",
            "adid",
            "v4us",
            "v51845481",
            "hostname",
            "http",
            "cisco",
            "umbrella rank",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de summary",
            "frankfurt",
            "main",
            "reverse dns",
            "general full",
            "asn16509",
            "amazon02",
            "resource",
            "protocol h2",
            "security tls",
            "hash",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "postitem",
            "variables",
            "parameters",
            "systemid object",
            "def function",
            "login",
            "get h2",
            "secrets llc",
            "agreement",
            "the site",
            "content",
            "policy",
            "this site",
            "claims",
            "florida",
            "please",
            "premium",
            "service",
            "restrict",
            "express",
            "media",
            "facebook",
            "twitter",
            "final",
            "first",
            "cloudflarenet",
            "gts ca",
            "software",
            "million",
            "hours ago",
            "chameleon",
            "heur",
            "phishing",
            "riskware",
            "agent",
            "unsafe",
            "opencandy",
            "exploit",
            "mimikatz",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "download",
            "beach research",
            "germany",
            "asn20940",
            "akamaiasn1",
            "threat report",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "alexa",
            "maltiverse",
            "google",
            "qtsas",
            "name value",
            "no data",
            "tag count",
            "count blacklist",
            "pbiptbmvd0k4",
            "glelexoputyh",
            "suppobox",
            "team",
            "bambernek",
            "internet storm",
            "phishtank",
            "phish",
            "trickbot",
            "telecom",
            "bank",
            "ipv4",
            "octoseek report",
            "spam https",
            "tsara brashears",
            "malvertizing",
            "tracking",
            "tagging",
            "spyder",
            "cybercrime",
            "email collection",
            "apple data collection",
            "win32 exe",
            "ms word",
            "document",
            "type name",
            "javascript",
            "network capture",
            "files",
            "detections type",
            "name",
            "ssl certificate",
            "whois whois",
            "tsara brashears",
            "whois record",
            "asn owner",
            "highly targeted",
            "kgs0",
            "kls0",
            "relacionada",
            "family",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "ursnif",
            "remcos",
            "core",
            "redline stealer",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "execution",
            "network",
            "communicating",
            "referrer",
            "parent",
            "historical ssl",
            "siblings",
            "resolutions",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "error",
            "file",
            "indicator",
            "script",
            "typeof e",
            "ascii text",
            "appdata",
            "date",
            "windir",
            "span",
            "body",
            "meta",
            "class",
            "generator",
            "info",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "form",
            "footer",
            "html",
            "union",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "crack",
            "webtoolbar",
            "threat roundup",
            "contacted",
            "june",
            "july",
            "october",
            "august"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [
            "Health",
            "Nutritional",
            "Medical",
            "Medicine"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 102,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 400,
            "FileHash-SHA1": 240,
            "FileHash-SHA256": 6459,
            "hostname": 4845,
            "URL": 11514,
            "CVE": 15,
            "domain": 3179,
            "email": 31
          },
          "indicator_count": 26683,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "897 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65580c1516990d69644fb3d0",
          "name": "Masquerading",
          "description": "",
          "modified": "2023-12-17T11:03:45.376000",
          "created": "2023-11-18T00:57:57.372000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "filehashmd5",
            "iocs",
            "url http",
            "expiration",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "create new",
            "blacklist http",
            "laplasclipper",
            "malicious url",
            "cisco umbrella",
            "site",
            "alexa top",
            "blacklist",
            "safe site",
            "malware site",
            "phishing site",
            "malicious site",
            "malware",
            "china unknown",
            "united",
            "unknown",
            "as54994 quantil",
            "cname",
            "nxdomain",
            "as8068",
            "as4134 chinanet",
            "passive dns",
            "domain",
            "next",
            "filehashsha1",
            "service company",
            "servers",
            "ndicator role",
            "title added",
            "active related",
            "pulses url",
            "showing",
            "entries",
            "pulses http",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "report spam",
            "author avatar",
            "created",
            "hour ago",
            "trojanspy",
            "redline",
            "pulses hostname",
            "blacklist https",
            "indicator role",
            "bidid",
            "adid",
            "v4us",
            "v51845481",
            "hostname",
            "http",
            "cisco",
            "umbrella rank",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de summary",
            "frankfurt",
            "main",
            "reverse dns",
            "general full",
            "asn16509",
            "amazon02",
            "resource",
            "protocol h2",
            "security tls",
            "hash",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "postitem",
            "variables",
            "parameters",
            "systemid object",
            "def function",
            "login",
            "get h2",
            "secrets llc",
            "agreement",
            "the site",
            "content",
            "policy",
            "this site",
            "claims",
            "florida",
            "please",
            "premium",
            "service",
            "restrict",
            "express",
            "media",
            "facebook",
            "twitter",
            "final",
            "first",
            "cloudflarenet",
            "gts ca",
            "software",
            "million",
            "hours ago",
            "chameleon",
            "heur",
            "phishing",
            "riskware",
            "agent",
            "unsafe",
            "opencandy",
            "exploit",
            "mimikatz",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "download",
            "beach research",
            "germany",
            "asn20940",
            "akamaiasn1",
            "threat report",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "alexa",
            "maltiverse",
            "google",
            "qtsas",
            "name value",
            "no data",
            "tag count",
            "count blacklist",
            "pbiptbmvd0k4",
            "glelexoputyh",
            "suppobox",
            "team",
            "bambernek",
            "internet storm",
            "phishtank",
            "phish",
            "trickbot",
            "telecom",
            "bank",
            "ipv4",
            "octoseek report",
            "spam https",
            "tsara brashears",
            "malvertizing",
            "tracking",
            "tagging",
            "spyder",
            "cybercrime",
            "email collection",
            "apple data collection",
            "win32 exe",
            "ms word",
            "document",
            "type name",
            "javascript",
            "network capture",
            "files",
            "detections type",
            "name",
            "ssl certificate",
            "whois whois",
            "tsara brashears",
            "whois record",
            "asn owner",
            "highly targeted",
            "kgs0",
            "kls0",
            "relacionada",
            "family",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "ursnif",
            "remcos",
            "core",
            "redline stealer",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "execution",
            "network",
            "communicating",
            "referrer",
            "parent",
            "historical ssl",
            "siblings",
            "resolutions",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "error",
            "file",
            "indicator",
            "script",
            "typeof e",
            "ascii text",
            "appdata",
            "date",
            "windir",
            "span",
            "body",
            "meta",
            "class",
            "generator",
            "info",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "form",
            "footer",
            "html",
            "union",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "crack",
            "webtoolbar",
            "threat roundup",
            "contacted",
            "june",
            "july",
            "october",
            "august"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [
            "Health",
            "Nutritional",
            "Medical",
            "Medicine"
          ],
          "TLP": "white",
          "cloned_from": "65574cb4447c8d87ad85fa75",
          "export_count": 100,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 400,
            "FileHash-SHA1": 240,
            "FileHash-SHA256": 6459,
            "hostname": 4845,
            "URL": 11514,
            "CVE": 15,
            "domain": 3179,
            "email": 31
          },
          "indicator_count": 26683,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "897 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65580c17e69371b34a573f72",
          "name": "Masquerading",
          "description": "",
          "modified": "2023-12-17T11:03:45.376000",
          "created": "2023-11-18T00:57:59.619000",
          "tags": [
            "no expiration",
            "filehashsha256",
            "filehashmd5",
            "iocs",
            "url http",
            "expiration",
            "scan endpoints",
            "all search",
            "otx octoseek",
            "create new",
            "blacklist http",
            "laplasclipper",
            "malicious url",
            "cisco umbrella",
            "site",
            "alexa top",
            "blacklist",
            "safe site",
            "malware site",
            "phishing site",
            "malicious site",
            "malware",
            "china unknown",
            "united",
            "unknown",
            "as54994 quantil",
            "cname",
            "nxdomain",
            "as8068",
            "as4134 chinanet",
            "passive dns",
            "domain",
            "next",
            "filehashsha1",
            "service company",
            "servers",
            "ndicator role",
            "title added",
            "active related",
            "pulses url",
            "showing",
            "entries",
            "pulses http",
            "url https",
            "type indicator",
            "role title",
            "added active",
            "related pulses",
            "report spam",
            "author avatar",
            "created",
            "hour ago",
            "trojanspy",
            "redline",
            "pulses hostname",
            "blacklist https",
            "indicator role",
            "bidid",
            "adid",
            "v4us",
            "v51845481",
            "hostname",
            "http",
            "cisco",
            "umbrella rank",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de summary",
            "frankfurt",
            "main",
            "reverse dns",
            "general full",
            "asn16509",
            "amazon02",
            "resource",
            "protocol h2",
            "security tls",
            "hash",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "postitem",
            "variables",
            "parameters",
            "systemid object",
            "def function",
            "login",
            "get h2",
            "secrets llc",
            "agreement",
            "the site",
            "content",
            "policy",
            "this site",
            "claims",
            "florida",
            "please",
            "premium",
            "service",
            "restrict",
            "express",
            "media",
            "facebook",
            "twitter",
            "final",
            "first",
            "cloudflarenet",
            "gts ca",
            "software",
            "million",
            "hours ago",
            "chameleon",
            "heur",
            "phishing",
            "riskware",
            "agent",
            "unsafe",
            "opencandy",
            "exploit",
            "mimikatz",
            "iframe",
            "downldr",
            "presenoker",
            "artemis",
            "download",
            "beach research",
            "germany",
            "asn20940",
            "akamaiasn1",
            "threat report",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "alexa",
            "maltiverse",
            "google",
            "qtsas",
            "name value",
            "no data",
            "tag count",
            "count blacklist",
            "pbiptbmvd0k4",
            "glelexoputyh",
            "suppobox",
            "team",
            "bambernek",
            "internet storm",
            "phishtank",
            "phish",
            "trickbot",
            "telecom",
            "bank",
            "ipv4",
            "octoseek report",
            "spam https",
            "tsara brashears",
            "malvertizing",
            "tracking",
            "tagging",
            "spyder",
            "cybercrime",
            "email collection",
            "apple data collection",
            "win32 exe",
            "ms word",
            "document",
            "type name",
            "javascript",
            "network capture",
            "files",
            "detections type",
            "name",
            "ssl certificate",
            "whois whois",
            "tsara brashears",
            "whois record",
            "asn owner",
            "highly targeted",
            "kgs0",
            "kls0",
            "relacionada",
            "family",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "ursnif",
            "remcos",
            "core",
            "redline stealer",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "execution",
            "network",
            "communicating",
            "referrer",
            "parent",
            "historical ssl",
            "siblings",
            "resolutions",
            "name verdict",
            "falcon sandbox",
            "pattern match",
            "error",
            "file",
            "indicator",
            "script",
            "typeof e",
            "ascii text",
            "appdata",
            "date",
            "windir",
            "span",
            "body",
            "meta",
            "class",
            "generator",
            "info",
            "null",
            "refresh",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "tools",
            "look",
            "verify",
            "restart",
            "form",
            "footer",
            "html",
            "union",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "installcore",
            "webshell",
            "crack",
            "webtoolbar",
            "threat roundup",
            "contacted",
            "june",
            "july",
            "october",
            "august"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1199",
              "name": "Trusted Relationship",
              "display_name": "T1199 - Trusted Relationship"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            }
          ],
          "industries": [
            "Health",
            "Nutritional",
            "Medical",
            "Medicine"
          ],
          "TLP": "white",
          "cloned_from": "65574cb4447c8d87ad85fa75",
          "export_count": 103,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 400,
            "FileHash-SHA1": 240,
            "FileHash-SHA256": 6459,
            "hostname": 4845,
            "URL": 11514,
            "CVE": 15,
            "domain": 3179,
            "email": 31
          },
          "indicator_count": 26683,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "897 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653eb87c9e4d74a97585f1d1",
          "name": "https://developer.paypal.com/docs/classic/paypal-payments-standard/integration-guide/encryptedwebpayments/",
          "description": "",
          "modified": "2023-11-28T20:03:34.441000",
          "created": "2023-10-29T19:54:36.146000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1747,
            "domain": 552,
            "hostname": 623,
            "FileHash-SHA256": 303,
            "FileHash-MD5": 135,
            "FileHash-SHA1": 49
          },
          "indicator_count": 3409,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 82,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://wormhole.app/Pp5DdP#3EpzsqLhw5lJdQ0Xe_mRQA",
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a (11.22.25)",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
        "https://urlscan.io/search/#asn:%22AS4611%22",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/summary",
        "https://x.com/NorrisN60014/status/1836092481978486802",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
        "https://app.threat.zone/submission/c8b0b1e4-0c9b-4210-b5ce-1dc2303445df/overview",
        "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be",
        "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
        "https://hybrid-analysis.com/sample/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://viz.greynoise.io/analysis/79a3ab55-982c-4fb7-9952-abde6f1219c2",
        "https://report.netcraft.com/submission/9R7KbGQKOvzU9GBdraRBpUJ4C",
        "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs",
        "03.11.14: https://www.virustotal.com/graph/embed/ge2e309eb8bd34fcca56398089b2291058dfe1fca69dc4e5aa66db0365caf735b?theme=dark",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/summary",
        "https://viz.greynoise.io/ip/analysis/6356f330-63a7-4ce3-91fa-7ab355a1dc1a",
        "https://viz.greynoise.io/query/AS4611",
        "https://yaraify.abuse.ch/scan/results/32bfc760-1757-11f1-b47f-42010aa4000b",
        "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcn",
        "https://www.hybrid-analysis.com/sample/f7cb7c256e840ab93e6991462cedf6eac928c12f4102798986e2c5d27d1abc7f",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
        "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
        "https://www.filescan.io/uploads/66e9b5494a48170ff00c8102/reports",
        "https://polyswarm.network/scan/results/file/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
        "https://urlscan.io/asn/AS4611",
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark",
        "https://www.hybrid-analysis.com/sample/a4f03d9a35524a7c0596777ea2b1fe5d98161b2462435e6056e4e39eb869396d/66e9ae1eb806d5b3300b842f",
        "https://urlscan.io/asn/AS45090",
        "https://www.virustotal.com/graph/embed/g6d4bce6162064ac09cd20411c1947e69d7d5a1d475f0447da023ac933d338fce?theme=dark",
        "https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551",
        "URLscanio, FSio, vT",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/iocs",
        "https://urlscan.io/search/#asn%3A%22AS45090%22",
        "https://viz.greynoise.io/query/AS45090",
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
        "https://n0paste.eu/UH6n5pD/",
        "https://neca.omeclk.com/portal/wts/uc^cn^ejkaejsaBeyk7-^Oa"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Cobalt strike",
            "Project nemesis",
            "Carbanak",
            "Gc",
            "Malware",
            "Domino",
            "Maltiverse",
            "Rokrat",
            "Beach research",
            "Lizar",
            "Webtoolbar"
          ],
          "industries": [
            "Government",
            "Nutritional",
            "Telecommunications",
            "Financial",
            "Medical",
            "Healthcare",
            "Medicine",
            "Education",
            "Finance",
            "Health",
            "Transportation",
            "Retail",
            "Hospitality",
            "Technology"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 16,
  "pulses": [
    {
      "id": "69228447b9c71795633314df",
      "name": "Keep Corrupt - University of Alberta Incidents continue to escalate - 04.24.26",
      "description": "Recovered accounts that have been used & abused - courtesy of decisions by non-technical leadership = accounts for UAlberta students -> PW manager made inaccessible (tied to UAlberta account) during a Data-Breach.\nWhen PW manager & Accounts returned, was populated by these (many = fraudulent; some appear to be abuse of legitimate services, while others do not, yet don't know function or origin)\n\nNot representative of OG PW manager. Many (most) accts. used/abused (on-going). \n\nDon't have a backup of original = hard to compare. Don't quite know what the majority of these companies etc. are for and/or do exactly. Putting them together as they roll-in.\nCan't turn them off in most cases - I don't have access to the U of A accounts these originate from and/or original recovery methods. \n\n2 more batches to add to this pulse (Need to add into VT) 02.16.26\n\nCountries listed are where 2 victims (UAlberta Graduates) have citizenship or some tie with.",
      "modified": "2026-05-24T21:18:51.782000",
      "created": "2025-11-23T03:49:27.649000",
      "tags": [
        "geoip",
        "as54113",
        "fastly",
        "as20940",
        "as15169",
        "google",
        "as214401",
        "maincubesas",
        "gmbh",
        "apache geoip",
        "facebook",
        "UAlberta",
        "AHS",
        "Treaty 8",
        "GoA",
        "Alberta",
        "Edmonton",
        "YEG"
      ],
      "references": [
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a",
        "URLscanio, FSio, vT",
        "03.11.14: https://www.virustotal.com/graph/embed/ge2e309eb8bd34fcca56398089b2291058dfe1fca69dc4e5aa66db0365caf735b?theme=dark",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/summary",
        "https://www.virustotal.com/gui/collection/6a41ae1cf2d3d51fedd2393d893c3b26ed0352dde2e0851d03f0bae9aaa69ae1/iocs",
        "https://viz.greynoise.io/ip/analysis/3cf1334a-df9d-448f-8145-d5fe67637c1a (11.22.25)"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Cura\u00e7ao",
        "Guatemala",
        "Sint Maarten (Dutch part)",
        "Tanzania, United Republic of",
        "Barbados",
        "United States of America",
        "Bahamas",
        "Anguilla",
        "Canada",
        "Saint Vincent and the Grenadines",
        "United Kingdom of Great Britain and Northern Ireland",
        "Kenya",
        "France",
        "Aruba",
        "Mexico",
        "Poland",
        "Costa Rica",
        "Ireland",
        "Trinidad and Tobago",
        "Netherlands",
        "Slovakia",
        "Spain",
        "Philippines"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Technology",
        "Telecommunications",
        "Education",
        "Healthcare",
        "Finance",
        "Retail",
        "Hospitality",
        "Transportation"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 3,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 47,
        "FileHash-MD5": 53,
        "FileHash-SHA1": 16,
        "FileHash-SHA256": 1059,
        "URL": 6374,
        "domain": 3314,
        "email": 1395,
        "hostname": 3740,
        "CVE": 1
      },
      "indicator_count": 15999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 136,
      "modified_text": "7 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "695089cbedad5c86f39b1363",
      "name": "Tracking Domains 03.03.26 (Updated Test)",
      "description": "Privacy Badger - Update on 01.09.26\nTracking domains on a hybrid (mobile laptop) clone of an AHS/Covenant Health, UAlberta (University of Alberta), and Government of Alberta Laptop.\nHealthcare: No Cybersecurity, EDU: No Cybersecurity / Remote only, GoA = Informed & don't quite know what to do or to whom this should be brought up with.",
      "modified": "2026-04-05T06:35:43.679000",
      "created": "2025-12-28T01:37:15.993000",
      "tags": [
        "privacy badger",
        "sites general",
        "settings widget",
        "domains manage",
        "data privacy",
        "badger",
        "hide"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://yaraify.abuse.ch/scan/results/32bfc760-1757-11f1-b47f-42010aa4000b",
        "https://polyswarm.network/scan/results/file/6a8efb46a1811fab955b629b37b5c483a812cc66519436acd726ff2a854f7a86",
        "https://app.threat.zone/submission/c8b0b1e4-0c9b-4210-b5ce-1dc2303445df/overview",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/summary",
        "https://www.virustotal.com/graph/embed/g6d4bce6162064ac09cd20411c1947e69d7d5a1d475f0447da023ac933d338fce?theme=dark",
        "https://viz.greynoise.io/ip/analysis/6356f330-63a7-4ce3-91fa-7ab355a1dc1a"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Healthcare",
        "Government",
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 50404,
        "hostname": 10879,
        "URL": 715,
        "FileHash-MD5": 1
      },
      "indicator_count": 61999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 132,
      "modified_text": "57 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "691b61e16cea7624a6606a69",
      "name": "For Later",
      "description": "***",
      "modified": "2025-11-17T18:46:19.094000",
      "created": "2025-11-17T17:56:49.875000",
      "tags": [
        "wormhole",
        "want",
        "sign",
        "submit send",
        "copy",
        "share show",
        "report delete",
        "faq roadmap",
        "security legal",
        "twitter discord",
        "protected"
      ],
      "references": [
        "https://wormhole.app/Pp5DdP#3EpzsqLhw5lJdQ0Xe_mRQA",
        "https://www.virustotal.com/gui/collection/18b52f4087178dedfee577ab7e53c5a86e84c2a7f901fa796240247f4be76f32/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 72127,
        "hostname": 16700,
        "URL": 50
      },
      "indicator_count": 88877,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 131,
      "modified_text": "195 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66e9c8e63a72c7cb531a58ba",
      "name": "08.09.24 URLscanio 2 weeks.csv",
      "description": "",
      "modified": "2025-10-25T02:09:23.619000",
      "created": "2024-09-17T18:22:30.731000",
      "tags": [],
      "references": [
        "https://x.com/NorrisN60014/status/1836092481978486802",
        "https://x.com/NorrisN60014/status/1836092481978486802",
        "https://www.hybrid-analysis.com/sample/a4f03d9a35524a7c0596777ea2b1fe5d98161b2462435e6056e4e39eb869396d/66e9ae1eb806d5b3300b842f",
        "https://viz.greynoise.io/analysis/79a3ab55-982c-4fb7-9952-abde6f1219c2",
        "https://www.filescan.io/uploads/66e9b5494a48170ff00c8102/reports",
        "https://report.netcraft.com/submission/9R7KbGQKOvzU9GBdraRBpUJ4C",
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcn"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-MD5": 6,
        "URL": 1074,
        "domain": 1530,
        "email": 2,
        "hostname": 2849
      },
      "indicator_count": 5464,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 189,
      "modified_text": "219 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "68bbf3e40e3ce8a74aa89545",
      "name": "HCPF \u2022 The intricate relationships between the FIN7 group and members of the Conti gang",
      "description": "",
      "modified": "2025-10-06T08:03:23.285000",
      "created": "2025-09-06T08:42:12.787000",
      "tags": [
        "present feb",
        "united",
        "a domains",
        "present dec",
        "passive dns",
        "moved",
        "script domains",
        "script urls",
        "search",
        "title",
        "date",
        "http traffic",
        "http get",
        "match info",
        "downloads",
        "info",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "protocol t1095",
        "get http",
        "dns resolutions",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cnamazon rsa",
        "m03 oamazon",
        "thumbprint",
        "msie",
        "windows nt",
        "wow64",
        "slcc2",
        "media center",
        "tlsv1",
        "ascii text",
        "ogoogle trust",
        "cngts ca",
        "execution",
        "next",
        "dock",
        "write",
        "capture",
        "persistence",
        "malware",
        "roboto",
        "android",
        "known exploited",
        "google",
        "salesloft drift",
        "sap s4hana",
        "cve202542957",
        "cisa",
        "sitecore",
        "linux",
        "france",
        "meta",
        "rokrat",
        "lizar",
        "project nemesis",
        "carbanak",
        "cobalt strike",
        "domino",
        "yara detections",
        "contacted",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "malicious ids",
        "detections tls",
        "indicator role",
        "title added",
        "active related",
        "entries",
        "role title",
        "added active",
        "filehashmd5",
        "ipv4"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lizar",
          "display_name": "Lizar",
          "target": null
        },
        {
          "id": "Project Nemesis",
          "display_name": "Project Nemesis",
          "target": null
        },
        {
          "id": "Carbanak",
          "display_name": "Carbanak",
          "target": null
        },
        {
          "id": "Cobalt Strike",
          "display_name": "Cobalt Strike",
          "target": null
        },
        {
          "id": "Domino",
          "display_name": "Domino",
          "target": null
        },
        {
          "id": "RokRAT",
          "display_name": "RokRAT",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1571",
          "name": "Non-Standard Port",
          "display_name": "T1571 - Non-Standard Port"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        }
      ],
      "industries": [
        "Hospitality",
        "Financial"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 539,
        "FileHash-SHA1": 389,
        "FileHash-SHA256": 3386,
        "domain": 862,
        "hostname": 1155,
        "URL": 4091,
        "CVE": 3,
        "SSLCertFingerprint": 5
      },
      "indicator_count": 10430,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 144,
      "modified_text": "238 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "688716977e80a4274f2eafa9",
      "name": "LeadIQ  | The Smart B2B Prospecting Platform | Malware Packed | Agent Tesla & more",
      "description": "Found in Bot joining Pulse.",
      "modified": "2025-08-27T06:03:05.020000",
      "created": "2025-07-28T06:20:07.660000",
      "tags": [
        "present jul",
        "united",
        "entries",
        "search",
        "moved",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "body",
        "meta",
        "passive dns",
        "next associated",
        "win32spigot apr",
        "title error",
        "ipv4 add",
        "pulse pulses",
        "urls",
        "files",
        "adaptivebee",
        "worm",
        "win32",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results jul",
        "location united",
        "asn asnone",
        "nameservers",
        "less whois",
        "registrar",
        "csc corporate",
        "status",
        "servers",
        "name servers",
        "hostname",
        "hostname add",
        "a domains",
        "script urls",
        "unknown aaaa",
        "technology one",
        "script script",
        "certificate",
        "null",
        "trojan",
        "twitter",
        "domain",
        "files ip",
        "address domain",
        "ip related",
        "pulses otx",
        "virtool",
        "http",
        "present jun",
        "present may",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "australia asn",
        "as55532 squiz",
        "dns resolutions",
        "overview ip",
        "address",
        "ipv4",
        "iocs",
        "data upload",
        "extraction",
        "ided iocs",
        "failed",
        "shaw",
        "ail tvnas",
        "rl irl",
        "domain add",
        "ostname add",
        "verdict",
        "show",
        "types",
        "type",
        "indicator data",
        "searc type",
        "a indicator",
        "data",
        "select across",
        "all pages",
        "domain domain",
        "checked url",
        "hostname server",
        "response ip",
        "address google",
        "safe browsing",
        "msie",
        "chrome",
        "present dec",
        "base",
        "read c",
        "port",
        "destination",
        "delete",
        "copy",
        "write",
        "memcommit",
        "cryptexportkey",
        "invalid pointer",
        "writeconsolea",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "signing defense",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "sha1",
        "sha256",
        "pattern match",
        "size",
        "ascii text",
        "crlf line",
        "mitre att",
        "error",
        "click",
        "hybrid",
        "local",
        "path",
        "starfield",
        "strings",
        "refresh",
        "tools",
        "onload",
        "span",
        "form",
        "adversaries",
        "windows nt",
        "generic http",
        "exe upload",
        "inbound",
        "outbound",
        "yara detections",
        "malware",
        "expiration date",
        "whois show",
        "name andrew",
        "bauer name",
        "div id",
        "beginstring",
        "beginerror",
        "script",
        "general",
        "cloud",
        "find",
        "footer",
        "ninite feb",
        "telper",
        "ninite mar",
        "ninite apr",
        "trojandropper",
        "mtb mar",
        "url https",
        "general full",
        "security tls",
        "software",
        "resource hash",
        "protocol h2",
        "frankfurt",
        "main",
        "germany",
        "input",
        "skype",
        "opciones",
        "july",
        "es form",
        "dom name",
        "post https",
        "imagen",
        "microsoft",
        "iniciar sesin",
        "value",
        "variables",
        "config",
        "debug",
        "loader",
        "geturl",
        "b function",
        "addlistener",
        "proof",
        "amazon02",
        "dk summary",
        "amazon rsa",
        "september",
        "browsing",
        "resource",
        "asn16509",
        "name value",
        "queueprogress",
        "timestamp input",
        "status actions"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 487,
        "FileHash-SHA1": 461,
        "URL": 10732,
        "domain": 1672,
        "email": 6,
        "hostname": 3039,
        "FileHash-SHA256": 2569,
        "SSLCertFingerprint": 7
      },
      "indicator_count": 18973,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "278 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66f235b9a7a94a6a61acd651",
      "name": "n0paste - Show paste: \\\"No Problems\\\" - dos meses del URLscan",
      "description": "This pulse represents a 'scattered sample' of data extracted from 'submissions of interest' made to virustotal, filescan_itsec, HybridAnalysis, anyrun_app, DynamiteLab, and triage (over a period of two months) which were submitted to urlscanio & subsequently GreyNoiseIO (which I've come across both from live samples and also those from offlined data). I don't particularly anticipate this will correlate w. anything specific - but at least will be put in one more place for further analysis & increased visibility.",
      "modified": "2025-03-07T08:38:08.584000",
      "created": "2024-09-24T03:44:57.902000",
      "tags": [
        "geoip",
        "public url",
        "as16509",
        "amazon02",
        "as20940",
        "akamaiasn1",
        "as8075",
        "as15169",
        "google",
        "akamaias",
        "facebook",
        "telecom",
        "twitter",
        "media",
        "win64",
        "level3",
        "mini",
        "ukraine",
        "proton",
        "ghost",
        "win32",
        "cuba",
        "mexico",
        "indonesia",
        "seznam",
        "as3359",
        "as852"
      ],
      "references": [
        "https://metadefender.com/results/file/bzI1MDMwMVFWaXRDS0hpWElYcnV0QllCYlB1",
        "https://mwdb.cert.pl/file/efb45096e24a61b488eb809bd8edf874d15bb498dd75ced8b888b020c87e5c6c",
        "https://n0paste.eu/UH6n5pD/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada",
        "Anguilla",
        "Poland",
        "Aruba",
        "Australia",
        "Barbados",
        "Costa Rica",
        "Guatemala",
        "Philippines",
        "Panama",
        "Sint Maarten (Dutch part)",
        "Saint Martin (French part)",
        "Cayman Islands",
        "Cura\u00e7ao",
        "Mexico",
        "Saint Vincent and the Grenadines",
        "Saint Kitts and Nevis",
        "Tanzania, United Republic of",
        "Netherlands",
        "Ukraine",
        "Trinidad and Tobago",
        "Japan",
        "Bahamas",
        "United Kingdom of Great Britain and Northern Ireland",
        "Georgia"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government",
        "Telecommunications",
        "Healthcare"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1,
        "CIDR": 1186,
        "CVE": 4,
        "FileHash-MD5": 29,
        "FileHash-SHA1": 3,
        "URL": 25493,
        "domain": 5396,
        "email": 10,
        "hostname": 10770
      },
      "indicator_count": 42892,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 149,
      "modified_text": "451 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66b0fa3624bf0384e427f2e7",
      "name": "Tracking Domains 4.2 - 08.19.24",
      "description": "Tracking Domains detected by Privacy Badger Ext. on Microsoft Edge Browser (W11 Device) using Telus ISP (ASN852)\n*Not-Enriched (08.05.24): ~50,000 suggests IOCs by AlienVault\nFrom VT: 2 IPs hosted by 45090 (Shenzhen Tencent Computer Systems Company Limited) & 4611 (CNNIC member) seem to be the problem here 118[.]89.204.198, 118[.]89.0.0/16 & 202[.]123.107.15, 202[.]123.107.0/24 (Respectively)",
      "modified": "2024-09-04T15:01:01.432000",
      "created": "2024-08-05T16:13:42.563000",
      "tags": [],
      "references": [
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/iocs",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/summary",
        "https://www.virustotal.com/gui/collection/21cbd369ea901f41d51b666439aa41070c76eafb66dbbc6e56c86e0923b1569f/graph",
        "https://www.virustotal.com/graph/embed/ge839428bb3e24a98aae8cbcc242ae4d8febdc0c46e49411ebb09d155e22b4bbc?theme=dark",
        "https://viz.greynoise.io/query/AS4611",
        "https://urlscan.io/asn/AS4611",
        "https://urlscan.io/search/#asn:%22AS4611%22",
        "https://urlscan.io/asn/AS45090",
        "https://urlscan.io/search/#asn%3A%22AS45090%22",
        "https://viz.greynoise.io/query/AS45090",
        "https://urlscan.io/result/aeb42615-79b7-465d-924e-c9bdde3eefd1/#transactions",
        "https://urlscan.io/result/d4bf08e4-88dc-4bf8-be34-6b352576882e/#behaviour",
        "Filescan[.]io report: bc47c757-0a4d-4659-98d4-5d0c86406462 (08.23.24)",
        "https://krebsonsecurity.com/2024/07/dont-let-your-domain-name-be"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 6180,
        "FileHash-MD5": 1,
        "domain": 24921,
        "URL": 10854
      },
      "indicator_count": 41956,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "635 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66269b1f33258a8e26033b17",
      "name": "Tracking Domains - Part 4.1",
      "description": "More Tracking Domains",
      "modified": "2024-08-30T13:02:28.335000",
      "created": "2024-04-22T17:15:11.398000",
      "tags": [
        "Tracking Domains"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
        "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark",
        "https://viz.greynoise.io/analysis/02a64dd4-d7e0-451c-8384-13cf23298551"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 94496,
        "FileHash-MD5": 63,
        "domain": 112327,
        "URL": 166918,
        "FileHash-SHA1": 33,
        "FileHash-SHA256": 103,
        "CIDR": 216
      },
      "indicator_count": 374156,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "640 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66269b204ecfba63974dc1d8",
      "name": "Tracking Domains - Part 4",
      "description": "More Tracking Domains",
      "modified": "2024-05-22T17:04:45.215000",
      "created": "2024-04-22T17:15:12.353000",
      "tags": [
        "Tracking Domains"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/ee0928d5289165511398be0144460ff4c8663292be0a99a05ac955de2728a078/iocs",
        "https://www.virustotal.com/graph/embed/g0844b0f8d48c4bfab3ae40a376456055e267e54952fe40e0a79f63cc17550863?theme=dark"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 792,
        "FileHash-MD5": 1,
        "domain": 5803,
        "URL": 2
      },
      "indicator_count": 6598,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 136,
      "modified_text": "739 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "omeda.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "omeda.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780332738.2395432
}