{ "type": "Domain", "indicator": "test.name", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/test.name", "alexa": "http://www.alexa.com/siteinfo/test.name", "indicator": "test.name", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 4106918190, "indicator": "test.name", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "6a0b06f047e3346072f0498c", "name": "beta | research", "description": "date research", "modified": "2026-05-20T08:57:00.942000", "created": "2026-05-18T12:32:48.538000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 157, "hostname": 227, "URL": 341, "FileHash-SHA256": 987, "IPv4": 113, "FileHash-SHA1": 41, "FileHash-MD5": 48, "email": 3 }, "indicator_count": 1917, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "11 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688865644a38fd5eef407891", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.869000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68886564cdc44059c7b2ef08", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.770000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "6a0b06f047e3346072f0498c", "name": "beta | research", "description": "date research", "modified": "2026-05-20T08:57:00.942000", "created": "2026-05-18T12:32:48.538000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 157, "hostname": 227, "URL": 341, "FileHash-SHA256": 987, "IPv4": 113, "FileHash-SHA1": 41, "FileHash-MD5": 48, "email": 3 }, "indicator_count": 1917, "is_author": false, "is_subscribing": null, "subscriber_count": 69, "modified_text": "11 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "688865644a38fd5eef407891", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.869000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68886564cdc44059c7b2ef08", "name": "Denver Apartment Community website with multiple compromises", "description": "Network of a multi block Denver Townhome complex experiencing issues with info stealing, password o, spyware, ransomware, malware\u2026 \u2022Win.Trojan.Crypted-30\tPWS:Win32/Zbot\u2022(phish_alert_sp2_2.0.0.0) \u2022 (phish_alert_sp1_1.0.0.0 )(30)_url_001.bin\tFile detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 23rd 2023 06:20:30 (UTC)\tRe__Motherson_INVENSITY_Project_Discussion_url_001.bin\tFile \"Re__Motherson_INVENSITY_Project_Discussion_url_001.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror\t\nMay 5th 2023 07:59:14 (UTC)\tRE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\tFile \"RE XDR Roadmap Planning Workshop for Temasek Polytechnic_url_007.bin\" was detected as \"image\", this format is not supported on WINDOWS\terror", "modified": "2025-08-28T06:00:46.366000", "created": "2025-07-29T06:08:36.770000", "tags": [ "context related", "associated urls", "community", "present jul", "present jun", "present may", "present apr", "checked url", "hostname server", "response ip", "address google", "safe browsing", "present showing", "sha256", "submitted", "urls", "passive dns", "http", "unique", "ip asn", "as701 verizon", "url add", "pulse pulses", "ip address", "related nids", "windows error", "file", "re xdr", "workshop", "march", "february", "january", "windows nt", "klpx", "span", "script", "united", "indicator", "appdata", "pattern match", "runtime process", "copy md5", "iframe", "date", "jquery", "null", "solid", "code", "summer", "polish", "body", "hybrid", "general", "local", "accept", "click", "strings", "music", "class", "core", "contact", "flag", "united kingdom", "name server", "tcp system", "private limited", "prefetch2", "dns requests", "win32", "mtb jul", "susp", "worm", "trojan", "entries", "next associated", "mtb apr", "showing", "trojandropper", "virtool", "country", "csc corporate", "domains", "ransom", "lowfi", "urls show", "date checked", "url hostname", "domain address", "learn", "command", "control att", "ck id", "name tactics", "suspicious", "informative", "t1105 ingress", "tool transfer", "t1573 encrypted", "dynamicloader", "medium", "yara rule", "high", "windows", "remote data", "http traffic", "installs", "windows startup", "malware", "copy" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1134, "hostname": 292, "domain": 197, "FileHash-MD5": 139, "FileHash-SHA1": 130, "FileHash-SHA256": 708, "email": 2 }, "indicator_count": 2602, "is_author": false, "is_subscribing": null, "subscriber_count": 142, "modified_text": "276 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "test.name", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "test.name", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780243275.4469116 }