{
  "type": "Domain",
  "indicator": "web-clash.com.cn",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/web-clash.com.cn",
    "alexa": "http://www.alexa.com/siteinfo/web-clash.com.cn",
    "indicator": "web-clash.com.cn",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4286604019,
      "indicator": "web-clash.com.cn",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 1,
      "pulses": [
        {
          "id": "69ca38fb0db58d66ca0c73aa",
          "name": "Untitled.",
          "description": "Pulses are the latest in a series of web-based attacks, which have seen more than 1.5 million infections since its launch in 2008.. and the first of its kind.",
          "modified": "2026-04-29T08:14:54.179000",
          "created": "2026-03-30T08:48:59.142000",
          "tags": [
            "pulse pulses",
            "passive dns",
            "urls",
            "files",
            "ip address",
            "domain",
            "ip whois",
            "registrar",
            "domain names",
            "creation date",
            "thumbprint",
            "key identifier",
            "x509v3 subject",
            "v3 serial",
            "number",
            "cus cngts",
            "ogoogle trust",
            "llc validity",
            "subject public",
            "key info",
            "key algorithm",
            "server",
            "aaaa",
            "status",
            "domain status",
            "registrar abuse",
            "data",
            "date",
            "google",
            "levelblue",
            "alienvault otx"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 154,
            "domain": 170,
            "FileHash-SHA1": 155,
            "FileHash-MD5": 156,
            "FileHash-SHA256": 487,
            "URL": 322,
            "email": 6
          },
          "indicator_count": 1450,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 66,
          "modified_text": "31 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 1,
  "pulses": [
    {
      "id": "69ca38fb0db58d66ca0c73aa",
      "name": "Untitled.",
      "description": "Pulses are the latest in a series of web-based attacks, which have seen more than 1.5 million infections since its launch in 2008.. and the first of its kind.",
      "modified": "2026-04-29T08:14:54.179000",
      "created": "2026-03-30T08:48:59.142000",
      "tags": [
        "pulse pulses",
        "passive dns",
        "urls",
        "files",
        "ip address",
        "domain",
        "ip whois",
        "registrar",
        "domain names",
        "creation date",
        "thumbprint",
        "key identifier",
        "x509v3 subject",
        "v3 serial",
        "number",
        "cus cngts",
        "ogoogle trust",
        "llc validity",
        "subject public",
        "key info",
        "key algorithm",
        "server",
        "aaaa",
        "status",
        "domain status",
        "registrar abuse",
        "data",
        "date",
        "google",
        "levelblue",
        "alienvault otx"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 154,
        "domain": 170,
        "FileHash-SHA1": 155,
        "FileHash-MD5": 156,
        "FileHash-SHA256": 487,
        "URL": 322,
        "email": 6
      },
      "indicator_count": 1450,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 66,
      "modified_text": "31 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "web-clash.com.cn",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "web-clash.com.cn",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780203918.0439525
}