{
  "type": "Domain",
  "indicator": "tests.py",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/tests.py",
    "alexa": "http://www.alexa.com/siteinfo/tests.py",
    "indicator": "tests.py",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3390782519,
      "indicator": "tests.py",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "6a0eac9ae62f3f9f50ca0d18",
          "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
          "description": "May 12,2025",
          "modified": "2026-05-21T07:00:40.184000",
          "created": "2026-05-21T06:56:26.458000",
          "tags": [
            "file type",
            "ascii"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1406",
              "name": "Obfuscated Files or Information",
              "display_name": "T1406 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1064",
              "name": "Scripting",
              "display_name": "T1064 - Scripting"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 4,
            "FileHash-MD5": 101,
            "FileHash-SHA1": 99,
            "FileHash-SHA256": 799,
            "domain": 187,
            "URL": 142,
            "hostname": 24
          },
          "indicator_count": 1356,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 65,
          "modified_text": "10 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0eac9bd286b53466d6e28f",
          "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
          "description": "May 12,2025",
          "modified": "2026-05-21T06:56:27.437000",
          "created": "2026-05-21T06:56:27.437000",
          "tags": [
            "file type",
            "ascii"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1406",
              "name": "Obfuscated Files or Information",
              "display_name": "T1406 - Obfuscated Files or Information"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1064",
              "name": "Scripting",
              "display_name": "T1064 - Scripting"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1222",
              "name": "File and Directory Permissions Modification",
              "display_name": "T1222 - File and Directory Permissions Modification"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1564",
              "name": "Hide Artifacts",
              "display_name": "T1564 - Hide Artifacts"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "IPv4": 4,
            "FileHash-MD5": 38,
            "FileHash-SHA1": 37,
            "FileHash-SHA256": 741,
            "domain": 187,
            "URL": 142,
            "hostname": 24
          },
          "indicator_count": 1173,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 65,
          "modified_text": "10 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a0e9725b323ae1350c36488",
          "name": "no comment",
          "description": "",
          "modified": "2026-05-21T06:52:08.577000",
          "created": "2026-05-21T05:24:53.947000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 366,
            "FileHash-SHA1": 366,
            "FileHash-SHA256": 5078,
            "IPv4": 44,
            "URL": 2414,
            "domain": 1305,
            "hostname": 366,
            "CIDR": 1,
            "email": 2,
            "Mutex": 1
          },
          "indicator_count": 9943,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "10 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6946ef0ba069c6b92160f8f6",
          "name": "Doomscroller \u2022 BrowserHappy | Part 1",
          "description": "Comments reserved for Part 2.\nOTX I extraction keeps timing out for me. Possibly location/signal related.",
          "modified": "2026-01-19T17:03:32.999000",
          "created": "2025-12-20T18:46:35.660000",
          "tags": [
            "servers",
            "united states",
            "united",
            "script script",
            "cnc beacon",
            "x5drh",
            "ipv4",
            "urls",
            "twitter",
            "trojandropper",
            "ipv4 add",
            "reverse dns",
            "ransom",
            "mtb may",
            "backdoor",
            "trojanspy",
            "loee7oiy",
            "trojan",
            "win32",
            "susp",
            "mtb jul",
            "virtool",
            "mtb aug",
            "worm",
            "avast avg",
            "lowfi",
            "multiplug jun",
            "urls show",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "results dec",
            "k dec",
            "read c",
            "process32nextw",
            "tls handshake",
            "search",
            "show",
            "et info",
            "failure",
            "unknown",
            "service",
            "malware",
            "tools",
            "win64",
            "write",
            "revil",
            "sodinokibi",
            "titan",
            "mtb trojan",
            "mtb alf",
            "win32dinwod may"
          ],
          "references": [
            "Xpirat = doomscroller.io",
            "IDS Detections: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "Win32/Agent.BH PUP/PUA Downloader CnC Checkin",
            "Terse HTTP 1.0 Request Possible Nivdort Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
            "Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "TrojanDownloader:Win32/Upatre.AA",
              "display_name": "TrojanDownloader:Win32/Upatre.AA",
              "target": "/malware/TrojanDownloader:Win32/Upatre.AA"
            },
            {
              "id": "Upatre",
              "display_name": "Upatre",
              "target": null
            },
            {
              "id": "Sodinoki",
              "display_name": "Sodinoki",
              "target": null
            },
            {
              "id": "Ransom:Win32/Revil.A",
              "display_name": "Ransom:Win32/Revil.A",
              "target": "/malware/Ransom:Win32/Revil.A"
            },
            {
              "id": "Cutwail",
              "display_name": "Cutwail",
              "target": null
            },
            {
              "id": "!#HSTR:SigGen0136cb6c",
              "display_name": "!#HSTR:SigGen0136cb6c",
              "target": null
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Win.Malware",
              "display_name": "Win.Malware",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.BG",
              "display_name": "TrojanSpy:Win32/Nivdort.BG",
              "target": "/malware/TrojanSpy:Win32/Nivdort.BG"
            },
            {
              "id": "#Lowfi:Lua:Mampa:99!ml",
              "display_name": "#Lowfi:Lua:Mampa:99!ml",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Cutwail",
              "display_name": "TrojanDownloader:Win32/Cutwail",
              "target": "/malware/TrojanDownloader:Win32/Cutwail"
            },
            {
              "id": "#Lowfi:HSTR:Installer:Multiplug",
              "display_name": "#Lowfi:HSTR:Installer:Multiplug",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Dinwod",
              "display_name": "TrojanDropper:Win32/Dinwod",
              "target": "/malware/TrojanDropper:Win32/Dinwod"
            },
            {
              "id": "Win.Trojan.Barys-10005825-0",
              "display_name": "Win.Trojan.Barys-10005825-0",
              "target": null
            },
            {
              "id": "TrojanSpy:Win32/Nivdort.CB",
              "display_name": "TrojanSpy:Win32/Nivdort.CB",
              "target": "/malware/TrojanSpy:Win32/Nivdort.CB"
            },
            {
              "id": "Zbot",
              "display_name": "Zbot",
              "target": null
            },
            {
              "id": "Trojan:Win32/Zbot.SIBB6!MTB",
              "display_name": "Trojan:Win32/Zbot.SIBB6!MTB",
              "target": "/malware/Trojan:Win32/Zbot.SIBB6!MTB"
            },
            {
              "id": "Ploprolo",
              "display_name": "Ploprolo",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
              "display_name": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1047",
              "name": "Windows Management Instrumentation",
              "display_name": "T1047 - Windows Management Instrumentation"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 692,
            "URL": 1666,
            "FileHash-SHA256": 630,
            "hostname": 804,
            "FileHash-MD5": 441,
            "FileHash-SHA1": 437,
            "SSLCertFingerprint": 1,
            "CVE": 1
          },
          "indicator_count": 4672,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "131 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62221d71474b323d486dc3f2",
          "name": "WTF 2022",
          "description": "",
          "modified": "2022-04-03T00:00:55.161000",
          "created": "2022-03-04T14:08:49.518000",
          "tags": [],
          "references": [
            "WTF.pdf"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Kailula4",
            "id": "131997",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 587,
            "URL": 668,
            "hostname": 613,
            "domain": 1320,
            "FileHash-MD5": 59,
            "FileHash-SHA1": 2
          },
          "indicator_count": 3249,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 406,
          "modified_text": "1519 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Win32/Agent.BH PUP/PUA Downloader CnC Checkin",
        "IDS Detections: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "Terse HTTP 1.0 Request Possible Nivdort Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "WTF.pdf",
        "Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "Xpirat = doomscroller.io"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "#lowfi:hstr:installer:multiplug",
            "Sodinoki",
            "Trojanspy:win32/nivdort.cb",
            "Ransom:win32/revil.a",
            "Trojan:win32/zbot.sibb6!mtb",
            "Trojanspy:win32/nivdort.bg",
            "#lowfi:lua:mampa:99!ml",
            "Cutwail",
            "Zbot",
            "Trojandropper:win32/dinwod",
            "Win.malware",
            "Trojandownloader:win32/cutwail",
            "Ploprolo",
            "Trojandownloader:win32/upatre.aa",
            "Bayrob",
            "#lowfi:hstr:virtool:win32/obfuscator!diplugem.f",
            "Upatre",
            "Win.trojan.barys-10005825-0",
            "!#hstr:siggen0136cb6c"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "6a0eac9ae62f3f9f50ca0d18",
      "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
      "description": "May 12,2025",
      "modified": "2026-05-21T07:00:40.184000",
      "created": "2026-05-21T06:56:26.458000",
      "tags": [
        "file type",
        "ascii"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1406",
          "name": "Obfuscated Files or Information",
          "display_name": "T1406 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1064",
          "name": "Scripting",
          "display_name": "T1064 - Scripting"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 4,
        "FileHash-MD5": 101,
        "FileHash-SHA1": 99,
        "FileHash-SHA256": 799,
        "domain": 187,
        "URL": 142,
        "hostname": 24
      },
      "indicator_count": 1356,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 65,
      "modified_text": "10 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0eac9bd286b53466d6e28f",
      "name": "test/recall VirusTotal report                    for App_20250512084741811.apk",
      "description": "May 12,2025",
      "modified": "2026-05-21T06:56:27.437000",
      "created": "2026-05-21T06:56:27.437000",
      "tags": [
        "file type",
        "ascii"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1406",
          "name": "Obfuscated Files or Information",
          "display_name": "T1406 - Obfuscated Files or Information"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1064",
          "name": "Scripting",
          "display_name": "T1064 - Scripting"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1222",
          "name": "File and Directory Permissions Modification",
          "display_name": "T1222 - File and Directory Permissions Modification"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1564",
          "name": "Hide Artifacts",
          "display_name": "T1564 - Hide Artifacts"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "IPv4": 4,
        "FileHash-MD5": 38,
        "FileHash-SHA1": 37,
        "FileHash-SHA256": 741,
        "domain": 187,
        "URL": 142,
        "hostname": 24
      },
      "indicator_count": 1173,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 65,
      "modified_text": "10 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a0e9725b323ae1350c36488",
      "name": "no comment",
      "description": "",
      "modified": "2026-05-21T06:52:08.577000",
      "created": "2026-05-21T05:24:53.947000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 366,
        "FileHash-SHA1": 366,
        "FileHash-SHA256": 5078,
        "IPv4": 44,
        "URL": 2414,
        "domain": 1305,
        "hostname": 366,
        "CIDR": 1,
        "email": 2,
        "Mutex": 1
      },
      "indicator_count": 9943,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "10 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6946ef0ba069c6b92160f8f6",
      "name": "Doomscroller \u2022 BrowserHappy | Part 1",
      "description": "Comments reserved for Part 2.\nOTX I extraction keeps timing out for me. Possibly location/signal related.",
      "modified": "2026-01-19T17:03:32.999000",
      "created": "2025-12-20T18:46:35.660000",
      "tags": [
        "servers",
        "united states",
        "united",
        "script script",
        "cnc beacon",
        "x5drh",
        "ipv4",
        "urls",
        "twitter",
        "trojandropper",
        "ipv4 add",
        "reverse dns",
        "ransom",
        "mtb may",
        "backdoor",
        "trojanspy",
        "loee7oiy",
        "trojan",
        "win32",
        "susp",
        "mtb jul",
        "virtool",
        "mtb aug",
        "worm",
        "avast avg",
        "lowfi",
        "multiplug jun",
        "urls show",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "results dec",
        "k dec",
        "read c",
        "process32nextw",
        "tls handshake",
        "search",
        "show",
        "et info",
        "failure",
        "unknown",
        "service",
        "malware",
        "tools",
        "win64",
        "write",
        "revil",
        "sodinokibi",
        "titan",
        "mtb trojan",
        "mtb alf",
        "win32dinwod may"
      ],
      "references": [
        "Xpirat = doomscroller.io",
        "IDS Detections: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "Win32/Agent.BH PUP/PUA Downloader CnC Checkin",
        "Terse HTTP 1.0 Request Possible Nivdort Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon",
        "Trojan-Banker.Win32.Agent.ree Checkin Net-Worm.Win32.Koobface.jxs Checkin AlphaCrypt CnC Beacon 4 AlphaCrypt CnC Beacon 3 WS/JS Downloader Mar 07 2017 M1 Koobface HTTP Request (2) Alphacrypt/TeslaCrypt Ransomware CnC Beacon"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "TrojanDownloader:Win32/Upatre.AA",
          "display_name": "TrojanDownloader:Win32/Upatre.AA",
          "target": "/malware/TrojanDownloader:Win32/Upatre.AA"
        },
        {
          "id": "Upatre",
          "display_name": "Upatre",
          "target": null
        },
        {
          "id": "Sodinoki",
          "display_name": "Sodinoki",
          "target": null
        },
        {
          "id": "Ransom:Win32/Revil.A",
          "display_name": "Ransom:Win32/Revil.A",
          "target": "/malware/Ransom:Win32/Revil.A"
        },
        {
          "id": "Cutwail",
          "display_name": "Cutwail",
          "target": null
        },
        {
          "id": "!#HSTR:SigGen0136cb6c",
          "display_name": "!#HSTR:SigGen0136cb6c",
          "target": null
        },
        {
          "id": "Bayrob",
          "display_name": "Bayrob",
          "target": null
        },
        {
          "id": "Win.Malware",
          "display_name": "Win.Malware",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.BG",
          "display_name": "TrojanSpy:Win32/Nivdort.BG",
          "target": "/malware/TrojanSpy:Win32/Nivdort.BG"
        },
        {
          "id": "#Lowfi:Lua:Mampa:99!ml",
          "display_name": "#Lowfi:Lua:Mampa:99!ml",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Cutwail",
          "display_name": "TrojanDownloader:Win32/Cutwail",
          "target": "/malware/TrojanDownloader:Win32/Cutwail"
        },
        {
          "id": "#Lowfi:HSTR:Installer:Multiplug",
          "display_name": "#Lowfi:HSTR:Installer:Multiplug",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32/Dinwod",
          "display_name": "TrojanDropper:Win32/Dinwod",
          "target": "/malware/TrojanDropper:Win32/Dinwod"
        },
        {
          "id": "Win.Trojan.Barys-10005825-0",
          "display_name": "Win.Trojan.Barys-10005825-0",
          "target": null
        },
        {
          "id": "TrojanSpy:Win32/Nivdort.CB",
          "display_name": "TrojanSpy:Win32/Nivdort.CB",
          "target": "/malware/TrojanSpy:Win32/Nivdort.CB"
        },
        {
          "id": "Zbot",
          "display_name": "Zbot",
          "target": null
        },
        {
          "id": "Trojan:Win32/Zbot.SIBB6!MTB",
          "display_name": "Trojan:Win32/Zbot.SIBB6!MTB",
          "target": "/malware/Trojan:Win32/Zbot.SIBB6!MTB"
        },
        {
          "id": "Ploprolo",
          "display_name": "Ploprolo",
          "target": null
        },
        {
          "id": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
          "display_name": "#Lowfi:HSTR:VirTool:Win32/Obfuscator!Diplugem.F",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1047",
          "name": "Windows Management Instrumentation",
          "display_name": "T1047 - Windows Management Instrumentation"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 692,
        "URL": 1666,
        "FileHash-SHA256": 630,
        "hostname": 804,
        "FileHash-MD5": 441,
        "FileHash-SHA1": 437,
        "SSLCertFingerprint": 1,
        "CVE": 1
      },
      "indicator_count": 4672,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "131 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62221d71474b323d486dc3f2",
      "name": "WTF 2022",
      "description": "",
      "modified": "2022-04-03T00:00:55.161000",
      "created": "2022-03-04T14:08:49.518000",
      "tags": [],
      "references": [
        "WTF.pdf"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Kailula4",
        "id": "131997",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 587,
        "URL": 668,
        "hostname": 613,
        "domain": 1320,
        "FileHash-MD5": 59,
        "FileHash-SHA1": 2
      },
      "indicator_count": 3249,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 406,
      "modified_text": "1519 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "tests.py",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "tests.py",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780212921.081243
}