{
  "type": "Domain",
  "indicator": "opensis.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/opensis.com",
    "alexa": "http://www.alexa.com/siteinfo/opensis.com",
    "indicator": "opensis.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3772665148,
      "indicator": "opensis.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "69aeda93ec05fb8653adca6d",
          "name": "clone of my pulse. this dmv kit pdfkit.net used the same off logo kit it was one of the few i found in their fcc application   . rpi&macids look for",
          "description": "",
          "modified": "2026-04-08T00:00:45.252000",
          "created": "2026-03-09T14:34:59.072000",
          "tags": [
            "pfft.net"
          ],
          "references": [
            ""
          ],
          "public": 1,
          "adversary": "pi, pdfkit.net",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "698c75717175e2cc7ff33df2",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 551,
            "domain": 638,
            "CVE": 114,
            "hostname": 449,
            "email": 28,
            "FileHash-MD5": 145,
            "FileHash-SHA1": 188,
            "FileHash-SHA256": 132,
            "Mutex": 1
          },
          "indicator_count": 2246,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 72,
          "modified_text": "56 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "698c3273517158869e0ba780",
          "name": "Reputation Shielded C2 Pivot; High-Churn Wix Infrastructure with iCloud Exfil Adjacency",
          "description": "Researcher Note (Feb 11, 2026) IPv4 185.230.61.96 (AS58182 \u2013 Wix.com Ltd.), resolving to unalocated.61.wixsite.com, demonstrates indicators consistent with structured abuse of shared SaaS hosting for command-and-control operations. Passive DNS telemetry reflects 500+ historical domain bindings across 52 TLDs, suggesting deliberate namespace dispersion and rotational overlay management rather than static tenancy. Network detections include repeated FormBook HTTP GET check-ins, Pushdo loader beacon cadence, and Windows Network Diagnostics user-agent spoofing, collectively aligning with controlled tasking infrastructure. Associated artifacts (11/50 AV detections) cluster around credential-stealer and loader families, including FormBook and GandCrab lineage components. The behavioral profile supports assessment of reputation parasitism\u2014leveraging trusted hosting to inherit platform trust and evade domain-based enforcement controls. Confidence: Moderate-High. MITRE: T1071.001, T1105, T1036.",
          "modified": "2026-03-29T00:29:26.398000",
          "created": "2026-02-11T07:40:32.757000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "Tier-1 SaaS Reputation Parasitism Leveraging Wix Infrastructure",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 265,
            "domain": 294,
            "URL": 331,
            "email": 12,
            "CVE": 61,
            "FileHash-MD5": 73,
            "FileHash-SHA1": 64,
            "FileHash-SHA256": 74
          },
          "indicator_count": 1174,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 76,
          "modified_text": "66 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "698904c316bc7710b967d01d",
          "name": "Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode",
          "description": "Researcher Note (Feb 08, 2026):\nThis artifact represents a sophisticated Cross-Protocol Mesh. Observations confirm that the Cymt/Nemucod wrapper is being utilized as a delivery vehicle for a Firmware-resident ELF binary (Mirai variant).\nThe persistence is notable for its ability to survive Full DFU Restores and Faraday-isolated states, likely due to JTAG-level interaction with the Power Management IC (Chip 4799). This is not a standard opportunistic infection; it is a targeted provisioning event leveraging IDMSA (Identity Management) bridges and Verizon/Akamai Edge infrastructure.\nThe integration with CalendarKit and Maps for geofenced execution suggests a highly coordinated surveillance objective. Forensic analysts should pay specific attention to the sizeofrawdata_antidbg anomalies, which indicate a focus on bypassing Apple Lockdown Mode and Secure Enclave. \nresearcher credit: msudoSOS",
          "modified": "2026-03-27T09:05:26.285000",
          "created": "2026-02-08T21:48:49.147000",
          "tags": [
            "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 909,
            "URL": 1779,
            "CVE": 126,
            "domain": 659,
            "email": 23,
            "JA3": 1,
            "FileHash-MD5": 230,
            "FileHash-SHA1": 227,
            "FileHash-SHA256": 934,
            "CIDR": 13
          },
          "indicator_count": 4901,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 76,
          "modified_text": "68 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "698c75717175e2cc7ff33df2",
          "name": "103.203.175.90 - Document and Domain Research Intersect, PDFKIT.NET DMV",
          "description": "http://103.203.175.90:81/fdScript/RootOfEBooks/E%20Book%20collection%20-%202024%20-%20D/CSE%20%20IT%20AIDS%20ML/Raspberry%20Pi%20linux-@Computer_IT_Engineering.pdf\n103.203.175.90",
          "modified": "2026-03-27T00:30:39.055000",
          "created": "2026-02-11T12:26:20.490000",
          "tags": [
            "pfft.net"
          ],
          "references": [
            ""
          ],
          "public": 1,
          "adversary": "pi, pdfkit.net",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 550,
            "domain": 638,
            "CVE": 113,
            "hostname": 445,
            "email": 28,
            "FileHash-MD5": 145,
            "FileHash-SHA1": 136,
            "FileHash-SHA256": 132,
            "Mutex": 1
          },
          "indicator_count": 2188,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 73,
          "modified_text": "68 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "67c6bb5aa601e91b1314ff44",
          "name": "SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)",
          "description": "Thor Lite Linux 64 - Sample Lab Device 2 - incomplete\nhttps://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d\nSCANID: S-KhOoOrXsco8",
          "modified": "2025-04-22T06:02:28.535000",
          "created": "2025-03-04T08:35:38.390000",
          "tags": [
            "misc",
            "filename ioc",
            "scanid",
            "sigtype1",
            "reasonscount",
            "sg2backup drive",
            "thu feb",
            "log entry",
            "exists1",
            "matched1",
            "warp",
            "trash",
            "rooter",
            "service",
            "puppet",
            "apache",
            "ruby",
            "execution",
            "android",
            "glasses",
            "agent",
            "hermes",
            "atlas",
            "score",
            "open",
            "orion",
            "entity",
            "download",
            "enterprise",
            "nexus",
            "beyond",
            "patch",
            "rest",
            "bsod",
            "bind",
            "june",
            "upgrade",
            "project",
            "surtr",
            "path",
            "mandrake",
            "accept",
            "openssl",
            "null",
            "responder",
            "shell",
            "servu",
            "cargo",
            "bypass",
            "green",
            "python",
            "iframe",
            "webex",
            "blink",
            "code",
            "netty",
            "fall",
            "grab",
            "metasploit",
            "webdav",
            "postscript",
            "middle",
            "assistant",
            "energy",
            "august",
            "diego",
            "february",
            "hold",
            "write",
            "extras",
            "fusion",
            "trace",
            "click",
            "rust",
            "anna",
            "virustotal",
            "rootkit",
            "timestomp",
            "doublepulsar",
            "logger",
            "teamviewer",
            "obfus",
            "probe",
            "win32",
            "snoopy",
            "vuln",
            "april",
            "format",
            "flash",
            "domino",
            "calendar",
            "cryptocat",
            "orca",
            "hello",
            "stream",
            "confi",
            "sharepoint",
            "launcher",
            "hypervisor",
            "malicious",
            "lame",
            "attack",
            "prior",
            "simple",
            "hpack",
            "homepage",
            "easy",
            "live",
            "cookie",
            "explorer",
            "config",
            "rush",
            "spark",
            "chat",
            "media",
            "webview",
            "trigger",
            "northstar",
            "monitoring",
            "false",
            "impact",
            "dino",
            "example",
            "splash",
            "macos",
            "notifier",
            "error",
            "spring",
            "this",
            "neutrino",
            "tools",
            "template",
            "crow",
            "magento",
            "zimbra",
            "drop",
            "stack",
            "linear",
            "blocker",
            "deleter",
            "main",
            "face",
            "arch",
            "hosts",
            "bifrost",
            "recursive",
            "cobaltstrike",
            "luckycat",
            "brain",
            "apt",
            "php",
            "rat",
            "hacktool",
            "worm",
            "meterpreter",
            "obfuscated",
            "evasive",
            "exaramel",
            "anti-vm"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
            "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
            "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
            "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
            "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
            "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
            "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
            "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1505",
              "name": "Server Software Component",
              "display_name": "T1505 - Server Software Component"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1550",
              "name": "Use Alternate Authentication Material",
              "display_name": "T1550 - Use Alternate Authentication Material"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1595",
              "name": "Active Scanning",
              "display_name": "T1595 - Active Scanning"
            }
          ],
          "industries": [
            "Education",
            "Healthcare",
            "Government",
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 45,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 14071,
            "FileHash-MD5": 979,
            "FileHash-SHA1": 2568,
            "FileHash-SHA256": 636,
            "URL": 43905,
            "domain": 2031,
            "email": 31,
            "hostname": 3621
          },
          "indicator_count": 67842,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 133,
          "modified_text": "407 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "664cc3c1938ed0b9abf026a2",
          "name": "Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files",
          "description": "Joe-MBA_thor_2024-05-18_1025\nUbuntu 22.04.4 LTS\nScan ID \tS-I9VvMTB6cZU\nhmmm...I can't tell if this is 'way too much' or 'probably fairly accurate'",
          "modified": "2024-06-20T15:04:34.338000",
          "created": "2024-05-21T15:54:41.886000",
          "tags": [
            "filename ioc",
            "misc",
            "scanid",
            "sigtype1",
            "log entry",
            "reasonscount",
            "exists1",
            "matched1",
            "data",
            "upload",
            "critical",
            "service",
            "bind",
            "score",
            "apache",
            "ruby",
            "puppet",
            "android",
            "execution",
            "agent",
            "hermes",
            "open",
            "null",
            "entity",
            "mandrake",
            "nexus",
            "bsod",
            "lazarus",
            "enterprise",
            "rest",
            "orion",
            "grab",
            "patch",
            "blink",
            "moonbounce",
            "probe",
            "april",
            "august",
            "core",
            "confuserex",
            "accept",
            "june",
            "python",
            "extras",
            "upgrade",
            "code",
            "green",
            "explorer",
            "responder",
            "shell",
            "jackson",
            "servu",
            "download",
            "iframe",
            "webex",
            "netty",
            "project",
            "trace",
            "february",
            "bypass",
            "lsass",
            "webdav",
            "flash",
            "vuln",
            "attack",
            "domino",
            "postscript",
            "middle",
            "assistant",
            "energy",
            "diego",
            "hold",
            "installer",
            "write",
            "chat",
            "media",
            "northstar",
            "fusion",
            "splash",
            "click",
            "macos",
            "cargo",
            "hive",
            "eternalblue",
            "info",
            "express",
            "error",
            "stack",
            "nomad",
            "rootkit",
            "timestomp",
            "doublepulsar",
            "logger",
            "teamviewer",
            "virustotal",
            "win32",
            "snoopy",
            "format",
            "calendar",
            "cryptocat",
            "hello",
            "stream",
            "confi",
            "sharepoint",
            "launcher",
            "hypervisor",
            "malicious",
            "lame",
            "prior",
            "simple",
            "terminal",
            "desktop",
            "hpack",
            "homepage",
            "easy",
            "live",
            "cookie",
            "config",
            "rush",
            "spark",
            "defender",
            "play",
            "bundler",
            "webview",
            "trigger",
            "monitoring",
            "false",
            "impact",
            "insert",
            "dino",
            "example",
            "path",
            "rust",
            "trojan",
            "metasploit",
            "arch",
            "hosts",
            "bifrost",
            "recursive",
            "cluster",
            "notifier",
            "spring",
            "this",
            "neutrino",
            "tools",
            "death",
            "template",
            "crow",
            "magento",
            "zimbra",
            "drop",
            "linear",
            "blocker",
            "mini",
            "deleter"
          ],
          "references": [
            ""
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1110",
              "name": "Brute Force",
              "display_name": "T1110 - Brute Force"
            },
            {
              "id": "T1203",
              "name": "Exploitation for Client Execution",
              "display_name": "T1203 - Exploitation for Client Execution"
            },
            {
              "id": "T1505",
              "name": "Server Software Component",
              "display_name": "T1505 - Server Software Component"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [
            "Education",
            "Technology",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6108,
            "FileHash-MD5": 164,
            "FileHash-SHA1": 625,
            "FileHash-SHA256": 148,
            "URL": 2267,
            "domain": 426,
            "email": 9,
            "hostname": 400
          },
          "indicator_count": 10147,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 133,
          "modified_text": "713 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a991f3da4c6e739e4d63",
          "name": "CVE-2019-11043",
          "description": "",
          "modified": "2023-12-06T17:04:17.634000",
          "created": "2023-12-06T17:04:17.634000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 214,
            "domain": 44,
            "URL": 53,
            "hostname": 85,
            "FileHash-SHA256": 1048,
            "email": 4,
            "FileHash-SHA1": 203,
            "CVE": 1
          },
          "indicator_count": 1652,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "910 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653d7d56a781ee979d979119",
          "name": "Best crypto exchange to buy cryptocurrency in Singapore | Coinhako",
          "description": "",
          "modified": "2023-11-27T21:01:16.697000",
          "created": "2023-10-28T21:29:58.671000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 384,
            "domain": 167,
            "hostname": 237,
            "FileHash-SHA256": 4091,
            "FileHash-MD5": 802,
            "FileHash-SHA1": 802
          },
          "indicator_count": 6483,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 83,
          "modified_text": "918 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "653369ac240a6105413d3f21",
          "name": "CVE:CVE-1999-0095",
          "description": "An attack on the Sendmail server is being investigated by researchers at the University of California, Los Angeles, as part of the Openwall security project, which aims to identify and prevent cyber-attacks.",
          "modified": "2023-11-21T01:02:17.904000",
          "created": "2023-10-21T06:03:24.907000",
          "tags": [
            "mlist",
            "scan endpoints",
            "all search",
            "otx ellenmmm",
            "cve cve19990095",
            "files",
            "exploits",
            "targeted",
            "cve overview",
            "sendmail"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 2,
            "URL": 1495,
            "domain": 1310,
            "hostname": 1211,
            "FileHash-SHA256": 10288,
            "FileHash-MD5": 2101,
            "FileHash-SHA1": 2074,
            "email": 31,
            "JA3": 1
          },
          "indicator_count": 18513,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 84,
          "modified_text": "925 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "652cc745d93d44d6203fc394",
          "name": "CVE-2019-11043",
          "description": "A security vulnerability in PHP has been identified and identified by researchers at the Institute for Strategic Studies (ISTS) and the Security Research Centre (SSR) in Washington DC, and is being investigated by the US government.",
          "modified": "2023-11-15T05:04:43.647000",
          "created": "2023-10-16T05:16:53.197000",
          "tags": [
            "confirm https",
            "security update",
            "remote code",
            "execution",
            "metasploit",
            "metasploit php",
            "targeted",
            "epss",
            "impact",
            "remote phpfpm",
            "catalina",
            "nextcry"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "ellenmmm",
            "id": "233693",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "URL": 53,
            "domain": 52,
            "email": 4,
            "hostname": 90,
            "FileHash-MD5": 215,
            "FileHash-SHA1": 204,
            "FileHash-SHA256": 1078
          },
          "indicator_count": 1697,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 81,
          "modified_text": "931 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
        "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
        "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
        "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
        "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
        "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "pi, pdfkit.net",
            "Tier-1 SaaS Reputation Parasitism Leveraging Wix Infrastructure"
          ],
          "malware_families": [],
          "industries": [
            "Healthcare",
            "Telecommunications",
            "Technology",
            "Education",
            "Government"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "69aeda93ec05fb8653adca6d",
      "name": "clone of my pulse. this dmv kit pdfkit.net used the same off logo kit it was one of the few i found in their fcc application   . rpi&macids look for",
      "description": "",
      "modified": "2026-04-08T00:00:45.252000",
      "created": "2026-03-09T14:34:59.072000",
      "tags": [
        "pfft.net"
      ],
      "references": [
        ""
      ],
      "public": 1,
      "adversary": "pi, pdfkit.net",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": "698c75717175e2cc7ff33df2",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 551,
        "domain": 638,
        "CVE": 114,
        "hostname": 449,
        "email": 28,
        "FileHash-MD5": 145,
        "FileHash-SHA1": 188,
        "FileHash-SHA256": 132,
        "Mutex": 1
      },
      "indicator_count": 2246,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 72,
      "modified_text": "56 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "698c3273517158869e0ba780",
      "name": "Reputation Shielded C2 Pivot; High-Churn Wix Infrastructure with iCloud Exfil Adjacency",
      "description": "Researcher Note (Feb 11, 2026) IPv4 185.230.61.96 (AS58182 \u2013 Wix.com Ltd.), resolving to unalocated.61.wixsite.com, demonstrates indicators consistent with structured abuse of shared SaaS hosting for command-and-control operations. Passive DNS telemetry reflects 500+ historical domain bindings across 52 TLDs, suggesting deliberate namespace dispersion and rotational overlay management rather than static tenancy. Network detections include repeated FormBook HTTP GET check-ins, Pushdo loader beacon cadence, and Windows Network Diagnostics user-agent spoofing, collectively aligning with controlled tasking infrastructure. Associated artifacts (11/50 AV detections) cluster around credential-stealer and loader families, including FormBook and GandCrab lineage components. The behavioral profile supports assessment of reputation parasitism\u2014leveraging trusted hosting to inherit platform trust and evade domain-based enforcement controls. Confidence: Moderate-High. MITRE: T1071.001, T1105, T1036.",
      "modified": "2026-03-29T00:29:26.398000",
      "created": "2026-02-11T07:40:32.757000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "Tier-1 SaaS Reputation Parasitism Leveraging Wix Infrastructure",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 265,
        "domain": 294,
        "URL": 331,
        "email": 12,
        "CVE": 61,
        "FileHash-MD5": 73,
        "FileHash-SHA1": 64,
        "FileHash-SHA256": 74
      },
      "indicator_count": 1174,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 76,
      "modified_text": "66 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "698904c316bc7710b967d01d",
      "name": "Rare Tier 1 Persistence - Critical \"Patched\", Non Patched Vulnerabilities Remain bypassing Lockdown Mode",
      "description": "Researcher Note (Feb 08, 2026):\nThis artifact represents a sophisticated Cross-Protocol Mesh. Observations confirm that the Cymt/Nemucod wrapper is being utilized as a delivery vehicle for a Firmware-resident ELF binary (Mirai variant).\nThe persistence is notable for its ability to survive Full DFU Restores and Faraday-isolated states, likely due to JTAG-level interaction with the Power Management IC (Chip 4799). This is not a standard opportunistic infection; it is a targeted provisioning event leveraging IDMSA (Identity Management) bridges and Verizon/Akamai Edge infrastructure.\nThe integration with CalendarKit and Maps for geofenced execution suggests a highly coordinated surveillance objective. Forensic analysts should pay specific attention to the sizeofrawdata_antidbg anomalies, which indicate a focus on bypassing Apple Lockdown Mode and Secure Enclave. \nresearcher credit: msudoSOS",
      "modified": "2026-03-27T09:05:26.285000",
      "created": "2026-02-08T21:48:49.147000",
      "tags": [
        "#supportsitewebsiteabuse #rootcertificatefailure #cryptographicf"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 909,
        "URL": 1779,
        "CVE": 126,
        "domain": 659,
        "email": 23,
        "JA3": 1,
        "FileHash-MD5": 230,
        "FileHash-SHA1": 227,
        "FileHash-SHA256": 934,
        "CIDR": 13
      },
      "indicator_count": 4901,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 76,
      "modified_text": "68 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "698c75717175e2cc7ff33df2",
      "name": "103.203.175.90 - Document and Domain Research Intersect, PDFKIT.NET DMV",
      "description": "http://103.203.175.90:81/fdScript/RootOfEBooks/E%20Book%20collection%20-%202024%20-%20D/CSE%20%20IT%20AIDS%20ML/Raspberry%20Pi%20linux-@Computer_IT_Engineering.pdf\n103.203.175.90",
      "modified": "2026-03-27T00:30:39.055000",
      "created": "2026-02-11T12:26:20.490000",
      "tags": [
        "pfft.net"
      ],
      "references": [
        ""
      ],
      "public": 1,
      "adversary": "pi, pdfkit.net",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 550,
        "domain": 638,
        "CVE": 113,
        "hostname": 445,
        "email": 28,
        "FileHash-MD5": 145,
        "FileHash-SHA1": 136,
        "FileHash-SHA256": 132,
        "Mutex": 1
      },
      "indicator_count": 2188,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 73,
      "modified_text": "68 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "67c6bb5aa601e91b1314ff44",
      "name": "SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)",
      "description": "Thor Lite Linux 64 - Sample Lab Device 2 - incomplete\nhttps://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d\nSCANID: S-KhOoOrXsco8",
      "modified": "2025-04-22T06:02:28.535000",
      "created": "2025-03-04T08:35:38.390000",
      "tags": [
        "misc",
        "filename ioc",
        "scanid",
        "sigtype1",
        "reasonscount",
        "sg2backup drive",
        "thu feb",
        "log entry",
        "exists1",
        "matched1",
        "warp",
        "trash",
        "rooter",
        "service",
        "puppet",
        "apache",
        "ruby",
        "execution",
        "android",
        "glasses",
        "agent",
        "hermes",
        "atlas",
        "score",
        "open",
        "orion",
        "entity",
        "download",
        "enterprise",
        "nexus",
        "beyond",
        "patch",
        "rest",
        "bsod",
        "bind",
        "june",
        "upgrade",
        "project",
        "surtr",
        "path",
        "mandrake",
        "accept",
        "openssl",
        "null",
        "responder",
        "shell",
        "servu",
        "cargo",
        "bypass",
        "green",
        "python",
        "iframe",
        "webex",
        "blink",
        "code",
        "netty",
        "fall",
        "grab",
        "metasploit",
        "webdav",
        "postscript",
        "middle",
        "assistant",
        "energy",
        "august",
        "diego",
        "february",
        "hold",
        "write",
        "extras",
        "fusion",
        "trace",
        "click",
        "rust",
        "anna",
        "virustotal",
        "rootkit",
        "timestomp",
        "doublepulsar",
        "logger",
        "teamviewer",
        "obfus",
        "probe",
        "win32",
        "snoopy",
        "vuln",
        "april",
        "format",
        "flash",
        "domino",
        "calendar",
        "cryptocat",
        "orca",
        "hello",
        "stream",
        "confi",
        "sharepoint",
        "launcher",
        "hypervisor",
        "malicious",
        "lame",
        "attack",
        "prior",
        "simple",
        "hpack",
        "homepage",
        "easy",
        "live",
        "cookie",
        "explorer",
        "config",
        "rush",
        "spark",
        "chat",
        "media",
        "webview",
        "trigger",
        "northstar",
        "monitoring",
        "false",
        "impact",
        "dino",
        "example",
        "splash",
        "macos",
        "notifier",
        "error",
        "spring",
        "this",
        "neutrino",
        "tools",
        "template",
        "crow",
        "magento",
        "zimbra",
        "drop",
        "stack",
        "linear",
        "blocker",
        "deleter",
        "main",
        "face",
        "arch",
        "hosts",
        "bifrost",
        "recursive",
        "cobaltstrike",
        "luckycat",
        "brain",
        "apt",
        "php",
        "rat",
        "hacktool",
        "worm",
        "meterpreter",
        "obfuscated",
        "evasive",
        "exaramel",
        "anti-vm"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/iocs",
        "https://www.virustotal.com/gui/collection/9c02b7b214c51b2fa7b6f2f38943a83ada3fff5ab9cbb9cf52e320bd702c9cd0/summary",
        "https://www.virustotal.com/graph/embed/ga8f86f452d6d4819b2dedf4c1981843304472a457d9b4b339f35679f4693ce9c?theme=dark",
        "https://tip.neiki.dev/file/09de67f8d3ce9a276e9665dc2e0013577b38d60b0518ffe7961bdc7f8755a52d",
        "https://cyber-fortress.com/docs/result/index.php?id=67c6bb9cc8d04e92a4bed8fc",
        "https://www.filescan.io/uploads/67c6bd19e95d0f9029e3804f/reports/834b740f-9bcb-42d9-b6a1-a0a8dbd07b07/overview",
        "https://www.filescan.io/uploads/67df8585fae452b82c2115b7/reports/65f03ad1-b5bc-41a8-ae82-21970a18efcb/ioc",
        "https://hybrid-analysis.com/sample/a6b9deae18604003aa3963d5d83775f5c66bfbe93ea4608fe8a69e6af3722f45/67df874be4fc8d105e0230d1"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1505",
          "name": "Server Software Component",
          "display_name": "T1505 - Server Software Component"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1550",
          "name": "Use Alternate Authentication Material",
          "display_name": "T1550 - Use Alternate Authentication Material"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1595",
          "name": "Active Scanning",
          "display_name": "T1595 - Active Scanning"
        }
      ],
      "industries": [
        "Education",
        "Healthcare",
        "Government",
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 45,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 14071,
        "FileHash-MD5": 979,
        "FileHash-SHA1": 2568,
        "FileHash-SHA256": 636,
        "URL": 43905,
        "domain": 2031,
        "email": 31,
        "hostname": 3621
      },
      "indicator_count": 67842,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 133,
      "modified_text": "407 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "664cc3c1938ed0b9abf026a2",
      "name": "Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files",
      "description": "Joe-MBA_thor_2024-05-18_1025\nUbuntu 22.04.4 LTS\nScan ID \tS-I9VvMTB6cZU\nhmmm...I can't tell if this is 'way too much' or 'probably fairly accurate'",
      "modified": "2024-06-20T15:04:34.338000",
      "created": "2024-05-21T15:54:41.886000",
      "tags": [
        "filename ioc",
        "misc",
        "scanid",
        "sigtype1",
        "log entry",
        "reasonscount",
        "exists1",
        "matched1",
        "data",
        "upload",
        "critical",
        "service",
        "bind",
        "score",
        "apache",
        "ruby",
        "puppet",
        "android",
        "execution",
        "agent",
        "hermes",
        "open",
        "null",
        "entity",
        "mandrake",
        "nexus",
        "bsod",
        "lazarus",
        "enterprise",
        "rest",
        "orion",
        "grab",
        "patch",
        "blink",
        "moonbounce",
        "probe",
        "april",
        "august",
        "core",
        "confuserex",
        "accept",
        "june",
        "python",
        "extras",
        "upgrade",
        "code",
        "green",
        "explorer",
        "responder",
        "shell",
        "jackson",
        "servu",
        "download",
        "iframe",
        "webex",
        "netty",
        "project",
        "trace",
        "february",
        "bypass",
        "lsass",
        "webdav",
        "flash",
        "vuln",
        "attack",
        "domino",
        "postscript",
        "middle",
        "assistant",
        "energy",
        "diego",
        "hold",
        "installer",
        "write",
        "chat",
        "media",
        "northstar",
        "fusion",
        "splash",
        "click",
        "macos",
        "cargo",
        "hive",
        "eternalblue",
        "info",
        "express",
        "error",
        "stack",
        "nomad",
        "rootkit",
        "timestomp",
        "doublepulsar",
        "logger",
        "teamviewer",
        "virustotal",
        "win32",
        "snoopy",
        "format",
        "calendar",
        "cryptocat",
        "hello",
        "stream",
        "confi",
        "sharepoint",
        "launcher",
        "hypervisor",
        "malicious",
        "lame",
        "prior",
        "simple",
        "terminal",
        "desktop",
        "hpack",
        "homepage",
        "easy",
        "live",
        "cookie",
        "config",
        "rush",
        "spark",
        "defender",
        "play",
        "bundler",
        "webview",
        "trigger",
        "monitoring",
        "false",
        "impact",
        "insert",
        "dino",
        "example",
        "path",
        "rust",
        "trojan",
        "metasploit",
        "arch",
        "hosts",
        "bifrost",
        "recursive",
        "cluster",
        "notifier",
        "spring",
        "this",
        "neutrino",
        "tools",
        "death",
        "template",
        "crow",
        "magento",
        "zimbra",
        "drop",
        "linear",
        "blocker",
        "mini",
        "deleter"
      ],
      "references": [
        ""
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1110",
          "name": "Brute Force",
          "display_name": "T1110 - Brute Force"
        },
        {
          "id": "T1203",
          "name": "Exploitation for Client Execution",
          "display_name": "T1203 - Exploitation for Client Execution"
        },
        {
          "id": "T1505",
          "name": "Server Software Component",
          "display_name": "T1505 - Server Software Component"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [
        "Education",
        "Technology",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6108,
        "FileHash-MD5": 164,
        "FileHash-SHA1": 625,
        "FileHash-SHA256": 148,
        "URL": 2267,
        "domain": 426,
        "email": 9,
        "hostname": 400
      },
      "indicator_count": 10147,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 133,
      "modified_text": "713 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a991f3da4c6e739e4d63",
      "name": "CVE-2019-11043",
      "description": "",
      "modified": "2023-12-06T17:04:17.634000",
      "created": "2023-12-06T17:04:17.634000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 214,
        "domain": 44,
        "URL": 53,
        "hostname": 85,
        "FileHash-SHA256": 1048,
        "email": 4,
        "FileHash-SHA1": 203,
        "CVE": 1
      },
      "indicator_count": 1652,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "910 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "653d7d56a781ee979d979119",
      "name": "Best crypto exchange to buy cryptocurrency in Singapore | Coinhako",
      "description": "",
      "modified": "2023-11-27T21:01:16.697000",
      "created": "2023-10-28T21:29:58.671000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ellenmmm",
        "id": "233693",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 384,
        "domain": 167,
        "hostname": 237,
        "FileHash-SHA256": 4091,
        "FileHash-MD5": 802,
        "FileHash-SHA1": 802
      },
      "indicator_count": 6483,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 83,
      "modified_text": "918 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "653369ac240a6105413d3f21",
      "name": "CVE:CVE-1999-0095",
      "description": "An attack on the Sendmail server is being investigated by researchers at the University of California, Los Angeles, as part of the Openwall security project, which aims to identify and prevent cyber-attacks.",
      "modified": "2023-11-21T01:02:17.904000",
      "created": "2023-10-21T06:03:24.907000",
      "tags": [
        "mlist",
        "scan endpoints",
        "all search",
        "otx ellenmmm",
        "cve cve19990095",
        "files",
        "exploits",
        "targeted",
        "cve overview",
        "sendmail"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ellenmmm",
        "id": "233693",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 2,
        "URL": 1495,
        "domain": 1310,
        "hostname": 1211,
        "FileHash-SHA256": 10288,
        "FileHash-MD5": 2101,
        "FileHash-SHA1": 2074,
        "email": 31,
        "JA3": 1
      },
      "indicator_count": 18513,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 84,
      "modified_text": "925 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "652cc745d93d44d6203fc394",
      "name": "CVE-2019-11043",
      "description": "A security vulnerability in PHP has been identified and identified by researchers at the Institute for Strategic Studies (ISTS) and the Security Research Centre (SSR) in Washington DC, and is being investigated by the US government.",
      "modified": "2023-11-15T05:04:43.647000",
      "created": "2023-10-16T05:16:53.197000",
      "tags": [
        "confirm https",
        "security update",
        "remote code",
        "execution",
        "metasploit",
        "metasploit php",
        "targeted",
        "epss",
        "impact",
        "remote phpfpm",
        "catalina",
        "nextcry"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "ellenmmm",
        "id": "233693",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "URL": 53,
        "domain": 52,
        "email": 4,
        "hostname": 90,
        "FileHash-MD5": 215,
        "FileHash-SHA1": 204,
        "FileHash-SHA256": 1078
      },
      "indicator_count": 1697,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 81,
      "modified_text": "931 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "opensis.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "opensis.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780516551.5427449
}