{
  "type": "Domain",
  "indicator": "policy.py",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/policy.py",
    "alexa": "http://www.alexa.com/siteinfo/policy.py",
    "indicator": "policy.py",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4019958829,
      "indicator": "policy.py",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "6a0eac9ae62f3f9f50ca0d18",
          "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
          "description": "May 12,2025",
          "modified": "2026-05-21T07:00:40.184000",
          "created": "2026-05-21T06:56:26.458000",
          "tags": [
            "file type",
            "ascii"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1406",
              "name": "Obfuscated Files or Information",
              "display_name": "T1406 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1064",
              "name": "Scripting",
              "display_name": "T1064 - Scripting"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 4,
            "FileHash-MD5": 101,
            "FileHash-SHA1": 99,
            "FileHash-SHA256": 799,
            "domain": 187,
            "URL": 142,
            "hostname": 24
          },
          "indicator_count": 1356,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 65,
          "modified_text": "10 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0eac9bd286b53466d6e28f",
          "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
          "description": "May 12,2025",
          "modified": "2026-05-21T06:56:27.437000",
          "created": "2026-05-21T06:56:27.437000",
          "tags": [
            "file type",
            "ascii"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1406",
              "name": "Obfuscated Files or Information",
              "display_name": "T1406 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1064",
              "name": "Scripting",
              "display_name": "T1064 - Scripting"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 4,
            "FileHash-MD5": 38,
            "FileHash-SHA1": 37,
            "FileHash-SHA256": 741,
            "domain": 187,
            "URL": 142,
            "hostname": 24
          },
          "indicator_count": 1173,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 65,
          "modified_text": "10 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0e9725b323ae1350c36488",
          "name": "no comment",
          "description": "",
          "modified": "2026-05-21T06:52:08.577000",
          "created": "2026-05-21T05:24:53.947000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 366,
            "FileHash-SHA1": 366,
            "FileHash-SHA256": 5078,
            "IPv4": 44,
            "URL": 2414,
            "domain": 1305,
            "hostname": 366,
            "CIDR": 1,
            "email": 2,
            "Mutex": 1
          },
          "indicator_count": 9943,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "10 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "695de6e443ac6f9615325882",
          "name": "UAlberta Computer Lab Issues - From U of A Labs",
          "description": "A Malware file has been found on the back of a UAlberta computer lab's back-up drive, which is being tested by researchers at the University of Alberta in Alberta. and the BBC\nThor query UAlberta Computer Lab Issues - From U of A Labs",
          "modified": "2026-02-06T04:06:27.529000",
          "created": "2026-01-07T04:53:56.209000",
          "tags": [
            "drive",
            "problems1",
            "data",
            "no problems",
            "upload",
            "ccid",
            "vmware horizons",
            "lab issuesfrom",
            "a labssome",
            "programs",
            "look",
            "june",
            "dllinject",
            "alphabet",
            "accept",
            "confuserex",
            "local",
            "restrict",
            "malware",
            "friday",
            "open",
            "delphi",
            "first",
            "stream",
            "rooter",
            "mon mar",
            "scanid",
            "wed may",
            "info",
            "whirlpool",
            "sun sep",
            "archivetype",
            "powershell",
            "UAlberta",
            "Alberta"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/44c7e214790e1e5a819dd93dd1b6fb82cf95b5e383ff773b275d0874fab10163/iocs"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            }
          ],
          "industries": [
            "Education"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1225,
            "FileHash-SHA1": 953,
            "FileHash-SHA256": 872,
            "URL": 12,
            "domain": 61,
            "hostname": 9,
            "email": 1
          },
          "indicator_count": 3133,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 129,
          "modified_text": "114 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/44c7e214790e1e5a819dd93dd1b6fb82cf95b5e383ff773b275d0874fab10163/iocs"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Education"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "6a0eac9ae62f3f9f50ca0d18",
      "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
      "description": "May 12,2025",
      "modified": "2026-05-21T07:00:40.184000",
      "created": "2026-05-21T06:56:26.458000",
      "tags": [
        "file type",
        "ascii"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1406",
          "name": "Obfuscated Files or Information",
          "display_name": "T1406 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1064",
          "name": "Scripting",
          "display_name": "T1064 - Scripting"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 4,
        "FileHash-MD5": 101,
        "FileHash-SHA1": 99,
        "FileHash-SHA256": 799,
        "domain": 187,
        "URL": 142,
        "hostname": 24
      },
      "indicator_count": 1356,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 65,
      "modified_text": "10 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0eac9bd286b53466d6e28f",
      "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
      "description": "May 12,2025",
      "modified": "2026-05-21T06:56:27.437000",
      "created": "2026-05-21T06:56:27.437000",
      "tags": [
        "file type",
        "ascii"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1406",
          "name": "Obfuscated Files or Information",
          "display_name": "T1406 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1064",
          "name": "Scripting",
          "display_name": "T1064 - Scripting"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 4,
        "FileHash-MD5": 38,
        "FileHash-SHA1": 37,
        "FileHash-SHA256": 741,
        "domain": 187,
        "URL": 142,
        "hostname": 24
      },
      "indicator_count": 1173,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 65,
      "modified_text": "10 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0e9725b323ae1350c36488",
      "name": "no comment",
      "description": "",
      "modified": "2026-05-21T06:52:08.577000",
      "created": "2026-05-21T05:24:53.947000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 366,
        "FileHash-SHA1": 366,
        "FileHash-SHA256": 5078,
        "IPv4": 44,
        "URL": 2414,
        "domain": 1305,
        "hostname": 366,
        "CIDR": 1,
        "email": 2,
        "Mutex": 1
      },
      "indicator_count": 9943,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "10 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "695de6e443ac6f9615325882",
      "name": "UAlberta Computer Lab Issues - From U of A Labs",
      "description": "A Malware file has been found on the back of a UAlberta computer lab's back-up drive, which is being tested by researchers at the University of Alberta in Alberta. and the BBC\nThor query UAlberta Computer Lab Issues - From U of A Labs",
      "modified": "2026-02-06T04:06:27.529000",
      "created": "2026-01-07T04:53:56.209000",
      "tags": [
        "drive",
        "problems1",
        "data",
        "no problems",
        "upload",
        "ccid",
        "vmware horizons",
        "lab issuesfrom",
        "a labssome",
        "programs",
        "look",
        "june",
        "dllinject",
        "alphabet",
        "accept",
        "confuserex",
        "local",
        "restrict",
        "malware",
        "friday",
        "open",
        "delphi",
        "first",
        "stream",
        "rooter",
        "mon mar",
        "scanid",
        "wed may",
        "info",
        "whirlpool",
        "sun sep",
        "archivetype",
        "powershell",
        "UAlberta",
        "Alberta"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/44c7e214790e1e5a819dd93dd1b6fb82cf95b5e383ff773b275d0874fab10163/iocs"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        }
      ],
      "industries": [
        "Education"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1225,
        "FileHash-SHA1": 953,
        "FileHash-SHA256": 872,
        "URL": 12,
        "domain": 61,
        "hostname": 9,
        "email": 1
      },
      "indicator_count": 3133,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 129,
      "modified_text": "114 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "policy.py",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "policy.py",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780231891.4770162
}