{
  "type": "Domain",
  "indicator": "pfcloud.io",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/pfcloud.io",
    "alexa": "http://www.alexa.com/siteinfo/pfcloud.io",
    "indicator": "pfcloud.io",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3740688428,
      "indicator": "pfcloud.io",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "69cd44f15d660f597a2596b4",
          "name": "EbeeMar2026 Pt5",
          "description": "Multiple APT/threat actors, Malware and Campaigns",
          "modified": "2026-05-01T16:15:36.188000",
          "created": "2026-04-01T16:16:49.921000",
          "tags": [],
          "references": [
            "IOCs.2026.pdf"
          ],
          "public": 1,
          "adversary": "DTO malware, GoPix banking Trojan, SERPENTINE#CLOUD, FAUX#ELEVATE, Katana",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "IMEBEEIMFINE",
            "id": "343873",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 84,
            "CIDR": 1,
            "CVE": 9,
            "FileHash-MD5": 178,
            "FileHash-SHA1": 146,
            "FileHash-SHA256": 274,
            "domain": 106,
            "email": 2,
            "hostname": 103
          },
          "indicator_count": 903,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 38,
          "modified_text": "29 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bd11a976e0d0b8abdb2df8",
          "name": "Katana: a Mirai variant that compiles its own rootkit on Android TV set-top boxes",
          "description": "The Katana botnet, identified as a variant of the Mirai malware, specifically targets Android TV set-top boxes that are typically low-cost and lack robust security measures like Google Play Protect. Katana exploits ADB (Android Debug Bridge) vulnerabilities, facilitating unauthorized access through residential proxy services. This technique has enabled mass exploitation of Android-based devices without needing sophisticated exploits\u2014operators merely require a subscription for these proxies to gain access to millions of vulnerable devices.",
          "modified": "2026-04-19T09:39:09.842000",
          "created": "2026-03-20T09:21:45.626000",
          "tags": [
            "katana",
            "android tv",
            "mirai",
            "android",
            "putty",
            "chrome",
            "aosp",
            "kimwolf",
            "adb port",
            "mirai variant",
            "protect",
            "service",
            "first",
            "pandora",
            "asyncrat",
            "xworm",
            "remcos",
            "cobalt strike",
            "rhadamanthys",
            "locker",
            "tencent",
            "attack",
            "stop",
            "kill",
            "openssl",
            "refresh",
            "syscall",
            "arch",
            "pandora.2",
            "adb",
            "rc4",
            "threatfox id",
            "c2 protocol",
            "table slot",
            "threatfox",
            "parent domain",
            "katana bot",
            "rootkit loader",
            "tinycc compiler",
            "1102717",
            "apk wrapper",
            "adb staging",
            "as215925",
            "as51396",
            "as202412",
            "omegatech ltd",
            "as39900",
            "sia good",
            "arm7 elf",
            "apk delivery",
            "elf delivery",
            "singlebyte xor",
            "xor key"
          ],
          "references": [
            "https://github.com/deepfield/public-research/blob/main/katana/report.md"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036.005",
              "name": "Match Legitimate Name or Location",
              "display_name": "T1036.005 - Match Legitimate Name or Location"
            },
            {
              "id": "T1037.004",
              "name": "RC Scripts",
              "display_name": "T1037.004 - RC Scripts"
            },
            {
              "id": "T1046",
              "name": "Network Service Scanning",
              "display_name": "T1046 - Network Service Scanning"
            },
            {
              "id": "T1053.003",
              "name": "Cron",
              "display_name": "T1053.003 - Cron"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059.004",
              "name": "Unix Shell",
              "display_name": "T1059.004 - Unix Shell"
            },
            {
              "id": "T1070.004",
              "name": "File Deletion",
              "display_name": "T1070.004 - File Deletion"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            }
          ],
          "industries": [
            "IoT",
            "Transportation",
            "Finance",
            "Telecommunications",
            "Media"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "PetrP.73",
            "id": "154605",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CIDR": 1,
            "URL": 3,
            "domain": 11,
            "hostname": 1,
            "FileHash-MD5": 4,
            "FileHash-SHA1": 3,
            "FileHash-SHA256": 11
          },
          "indicator_count": 34,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 541,
          "modified_text": "42 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65e90846f1d5b32e21d53d6c",
          "name": "Twitter Feed - banthisguy9349 - 06-03-2024",
          "description": "",
          "modified": "2024-04-06T00:05:19.883000",
          "created": "2024-03-07T00:20:22.925000",
          "tags": [
            "opendir",
            "AsyncRAT"
          ],
          "references": [
            "https://twitter.com/banthisguy9349/status/1765313212981870942",
            "https://twitter.com/banthisguy9349/status/1765313410227405115",
            "https://twitter.com/banthisguy9349/status/1765329790993637581",
            "https://twitter.com/banthisguy9349/status/1765346863169900941",
            "https://twitter.com/banthisguy9349/status/1765348861776744943",
            "https://twitter.com/banthisguy9349/status/1765351243830951969",
            "https://twitter.com/banthisguy9349/status/1765358444544995583",
            "https://twitter.com/banthisguy9349/status/1765361402103894197",
            "https://twitter.com/banthisguy9349/status/1765362836065141045",
            "https://twitter.com/banthisguy9349/status/1765365349711581323",
            "https://twitter.com/banthisguy9349/status/1765367587397943555",
            "https://twitter.com/banthisguy9349/status/1765381166733926625",
            "https://twitter.com/banthisguy9349/status/1765390224958292449",
            "https://twitter.com/banthisguy9349/status/1765444273959309644"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 35,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8,
            "domain": 3,
            "FileHash-SHA256": 8
          },
          "indicator_count": 19,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1621,
          "modified_text": "785 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65e3c2b38f8c72649d763f5c",
          "name": "Twitter Feed - banthisguy9349 - 02-03-2024",
          "description": "",
          "modified": "2024-03-03T00:22:11.948000",
          "created": "2024-03-03T00:22:11.948000",
          "tags": [],
          "references": [
            "https://twitter.com/banthisguy9349/status/1763860900916670595"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1
          },
          "indicator_count": 1,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1621,
          "modified_text": "819 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bae2505da92b2d83c29735",
          "name": "InQuest - 31-01-2024",
          "description": "",
          "modified": "2024-03-02T00:00:05.957000",
          "created": "2024-02-01T00:14:08.840000",
          "tags": [],
          "references": [
            "https://labs.inquest.net/iocdb"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 13,
            "domain": 43,
            "URL": 361,
            "hostname": 78,
            "FileHash-SHA1": 11,
            "FileHash-MD5": 149
          },
          "indicator_count": 655,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1622,
          "modified_text": "820 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b83f50485b55a20b8a3669",
          "name": "Twitter Feed - banthisguy9349 - 29-01-2024",
          "description": "",
          "modified": "2024-02-29T00:00:46.495000",
          "created": "2024-01-30T00:14:08.085000",
          "tags": [],
          "references": [
            "https://twitter.com/banthisguy9349/status/1751890518361899506",
            "https://twitter.com/banthisguy9349/status/1751896339720384917",
            "https://twitter.com/banthisguy9349/status/1751897970738389074",
            "https://twitter.com/banthisguy9349/status/1751916767729922426",
            "https://twitter.com/banthisguy9349/status/1751918287640781143",
            "https://twitter.com/banthisguy9349/status/1751939317528674370",
            "https://twitter.com/banthisguy9349/status/1751974932077060226"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "CyberHunterAutoFeed",
            "id": "182496",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 7,
            "URL": 15
          },
          "indicator_count": 22,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 1621,
          "modified_text": "822 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": false,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://twitter.com/banthisguy9349/status/1765361402103894197",
        "https://twitter.com/banthisguy9349/status/1763860900916670595",
        "https://twitter.com/banthisguy9349/status/1751896339720384917",
        "https://twitter.com/banthisguy9349/status/1765362836065141045",
        "https://labs.inquest.net/iocdb",
        "https://twitter.com/banthisguy9349/status/1765348861776744943",
        "https://twitter.com/banthisguy9349/status/1751918287640781143",
        "IOCs.2026.pdf",
        "https://twitter.com/banthisguy9349/status/1751897970738389074",
        "https://twitter.com/banthisguy9349/status/1765329790993637581",
        "https://github.com/deepfield/public-research/blob/main/katana/report.md",
        "https://twitter.com/banthisguy9349/status/1751916767729922426",
        "https://twitter.com/banthisguy9349/status/1765313212981870942",
        "https://twitter.com/banthisguy9349/status/1765358444544995583",
        "https://twitter.com/banthisguy9349/status/1751890518361899506",
        "https://twitter.com/banthisguy9349/status/1765390224958292449",
        "https://twitter.com/banthisguy9349/status/1765444273959309644",
        "https://twitter.com/banthisguy9349/status/1751939317528674370",
        "https://twitter.com/banthisguy9349/status/1765346863169900941",
        "https://twitter.com/banthisguy9349/status/1765381166733926625",
        "https://twitter.com/banthisguy9349/status/1765367587397943555",
        "https://twitter.com/banthisguy9349/status/1765365349711581323",
        "https://twitter.com/banthisguy9349/status/1751974932077060226",
        "https://twitter.com/banthisguy9349/status/1765313410227405115",
        "https://twitter.com/banthisguy9349/status/1765351243830951969"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "DTO malware, GoPix banking Trojan, SERPENTINE#CLOUD, FAUX#ELEVATE, Katana"
          ],
          "malware_families": [],
          "industries": [
            "Telecommunications",
            "Iot",
            "Transportation",
            "Finance",
            "Media"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "69cd44f15d660f597a2596b4",
      "name": "EbeeMar2026 Pt5",
      "description": "Multiple APT/threat actors, Malware and Campaigns",
      "modified": "2026-05-01T16:15:36.188000",
      "created": "2026-04-01T16:16:49.921000",
      "tags": [],
      "references": [
        "IOCs.2026.pdf"
      ],
      "public": 1,
      "adversary": "DTO malware, GoPix banking Trojan, SERPENTINE#CLOUD, FAUX#ELEVATE, Katana",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "IMEBEEIMFINE",
        "id": "343873",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 84,
        "CIDR": 1,
        "CVE": 9,
        "FileHash-MD5": 178,
        "FileHash-SHA1": 146,
        "FileHash-SHA256": 274,
        "domain": 106,
        "email": 2,
        "hostname": 103
      },
      "indicator_count": 903,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 38,
      "modified_text": "29 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bd11a976e0d0b8abdb2df8",
      "name": "Katana: a Mirai variant that compiles its own rootkit on Android TV set-top boxes",
      "description": "The Katana botnet, identified as a variant of the Mirai malware, specifically targets Android TV set-top boxes that are typically low-cost and lack robust security measures like Google Play Protect. Katana exploits ADB (Android Debug Bridge) vulnerabilities, facilitating unauthorized access through residential proxy services. This technique has enabled mass exploitation of Android-based devices without needing sophisticated exploits\u2014operators merely require a subscription for these proxies to gain access to millions of vulnerable devices.",
      "modified": "2026-04-19T09:39:09.842000",
      "created": "2026-03-20T09:21:45.626000",
      "tags": [
        "katana",
        "android tv",
        "mirai",
        "android",
        "putty",
        "chrome",
        "aosp",
        "kimwolf",
        "adb port",
        "mirai variant",
        "protect",
        "service",
        "first",
        "pandora",
        "asyncrat",
        "xworm",
        "remcos",
        "cobalt strike",
        "rhadamanthys",
        "locker",
        "tencent",
        "attack",
        "stop",
        "kill",
        "openssl",
        "refresh",
        "syscall",
        "arch",
        "pandora.2",
        "adb",
        "rc4",
        "threatfox id",
        "c2 protocol",
        "table slot",
        "threatfox",
        "parent domain",
        "katana bot",
        "rootkit loader",
        "tinycc compiler",
        "1102717",
        "apk wrapper",
        "adb staging",
        "as215925",
        "as51396",
        "as202412",
        "omegatech ltd",
        "as39900",
        "sia good",
        "arm7 elf",
        "apk delivery",
        "elf delivery",
        "singlebyte xor",
        "xor key"
      ],
      "references": [
        "https://github.com/deepfield/public-research/blob/main/katana/report.md"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036.005",
          "name": "Match Legitimate Name or Location",
          "display_name": "T1036.005 - Match Legitimate Name or Location"
        },
        {
          "id": "T1037.004",
          "name": "RC Scripts",
          "display_name": "T1037.004 - RC Scripts"
        },
        {
          "id": "T1046",
          "name": "Network Service Scanning",
          "display_name": "T1046 - Network Service Scanning"
        },
        {
          "id": "T1053.003",
          "name": "Cron",
          "display_name": "T1053.003 - Cron"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059.004",
          "name": "Unix Shell",
          "display_name": "T1059.004 - Unix Shell"
        },
        {
          "id": "T1070.004",
          "name": "File Deletion",
          "display_name": "T1070.004 - File Deletion"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        }
      ],
      "industries": [
        "IoT",
        "Transportation",
        "Finance",
        "Telecommunications",
        "Media"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "PetrP.73",
        "id": "154605",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CIDR": 1,
        "URL": 3,
        "domain": 11,
        "hostname": 1,
        "FileHash-MD5": 4,
        "FileHash-SHA1": 3,
        "FileHash-SHA256": 11
      },
      "indicator_count": 34,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 541,
      "modified_text": "42 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65e90846f1d5b32e21d53d6c",
      "name": "Twitter Feed - banthisguy9349 - 06-03-2024",
      "description": "",
      "modified": "2024-04-06T00:05:19.883000",
      "created": "2024-03-07T00:20:22.925000",
      "tags": [
        "opendir",
        "AsyncRAT"
      ],
      "references": [
        "https://twitter.com/banthisguy9349/status/1765313212981870942",
        "https://twitter.com/banthisguy9349/status/1765313410227405115",
        "https://twitter.com/banthisguy9349/status/1765329790993637581",
        "https://twitter.com/banthisguy9349/status/1765346863169900941",
        "https://twitter.com/banthisguy9349/status/1765348861776744943",
        "https://twitter.com/banthisguy9349/status/1765351243830951969",
        "https://twitter.com/banthisguy9349/status/1765358444544995583",
        "https://twitter.com/banthisguy9349/status/1765361402103894197",
        "https://twitter.com/banthisguy9349/status/1765362836065141045",
        "https://twitter.com/banthisguy9349/status/1765365349711581323",
        "https://twitter.com/banthisguy9349/status/1765367587397943555",
        "https://twitter.com/banthisguy9349/status/1765381166733926625",
        "https://twitter.com/banthisguy9349/status/1765390224958292449",
        "https://twitter.com/banthisguy9349/status/1765444273959309644"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 35,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8,
        "domain": 3,
        "FileHash-SHA256": 8
      },
      "indicator_count": 19,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1621,
      "modified_text": "785 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65e3c2b38f8c72649d763f5c",
      "name": "Twitter Feed - banthisguy9349 - 02-03-2024",
      "description": "",
      "modified": "2024-03-03T00:22:11.948000",
      "created": "2024-03-03T00:22:11.948000",
      "tags": [],
      "references": [
        "https://twitter.com/banthisguy9349/status/1763860900916670595"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1
      },
      "indicator_count": 1,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1621,
      "modified_text": "819 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bae2505da92b2d83c29735",
      "name": "InQuest - 31-01-2024",
      "description": "",
      "modified": "2024-03-02T00:00:05.957000",
      "created": "2024-02-01T00:14:08.840000",
      "tags": [],
      "references": [
        "https://labs.inquest.net/iocdb"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 13,
        "domain": 43,
        "URL": 361,
        "hostname": 78,
        "FileHash-SHA1": 11,
        "FileHash-MD5": 149
      },
      "indicator_count": 655,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1622,
      "modified_text": "820 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b83f50485b55a20b8a3669",
      "name": "Twitter Feed - banthisguy9349 - 29-01-2024",
      "description": "",
      "modified": "2024-02-29T00:00:46.495000",
      "created": "2024-01-30T00:14:08.085000",
      "tags": [],
      "references": [
        "https://twitter.com/banthisguy9349/status/1751890518361899506",
        "https://twitter.com/banthisguy9349/status/1751896339720384917",
        "https://twitter.com/banthisguy9349/status/1751897970738389074",
        "https://twitter.com/banthisguy9349/status/1751916767729922426",
        "https://twitter.com/banthisguy9349/status/1751918287640781143",
        "https://twitter.com/banthisguy9349/status/1751939317528674370",
        "https://twitter.com/banthisguy9349/status/1751974932077060226"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "CyberHunterAutoFeed",
        "id": "182496",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_182496/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 7,
        "URL": 15
      },
      "indicator_count": 22,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 1621,
      "modified_text": "822 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": false,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "pfcloud.io",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "pfcloud.io",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780235631.5219007
}