{ "type": "Domain", "indicator": "winimage.com", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/winimage.com", "alexa": "http://www.alexa.com/siteinfo/winimage.com", "indicator": "winimage.com", "type": "domain", "type_title": "Domain", "validation": [ { "source": "majestic", "message": "Whitelisted domain winimage.com", "name": "Whitelisted domain" } ], "base_indicator": { "id": 3774543410, "indicator": "winimage.com", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 3, "pulses": [ { "id": "69c6475aa191decaebc7a716", "name": "Yomi Hunter Sandbox", "description": "Malicious", "modified": "2026-04-26T08:04:27.318000", "created": "2026-03-27T09:01:14.165000", "tags": [ "categories", "xecj", "toggle", "users", "default", "xf4a", "windows", "xc0x88d xc0x88d", "xf4xff xf4xff", "x83xc4 x83xc4", "first", "path", "dynamicloader", "virustotal", "winsta", "mark", "stub", "class", "crypt32", "hotkey", "desktop", "false", "tools", "updater", "winmm", "enterprise", "service", "close" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/93c8d17cfc1d37198ec68235361328afa953b3986bdd2be8cdce1b3908e32a9c_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774602117&Signature=GJRAxOKy5Ti19O5danDm6jZVf9i%2B1jkONiR5EbazB5bXMI%2B40CKT98OHvQNxwneyABK7Ie%2F09NbN5O4flZk3YAHeYRny4U%2BidCF5SA0rEaF3xpXDkcv4soaYTBerX8cN6%2BtKozSPuFaEHxO1r5JJUV%2B1TPmM3vUMLIxZuFGgyhYnjMHPoAS5zBDJ%2BYgkK4flsQLHi3KJ34ZsMMGOac2o4mg0FKU5PvGwttXsaLC308cyAlSUA" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1200", "name": "Hardware Additions", "display_name": "T1200 - Hardware Additions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 65, "FileHash-MD5": 220, "FileHash-SHA1": 144, "FileHash-SHA256": 105, "BitcoinAddress": 7, "URL": 128, "hostname": 84, "email": 2 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "37 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c647ad6940228b6bb68603", "name": "Yomi Hunter Sandbox", "description": "Malicious", "modified": "2026-04-26T08:04:27.318000", "created": "2026-03-27T09:02:37.017000", "tags": [ "categories", "xecj", "toggle", "users", "default", "xf4a", "windows", "xc0x88d xc0x88d", "xf4xff xf4xff", "x83xc4 x83xc4", "first", "path", "dynamicloader", "virustotal", "winsta", "mark", "stub", "class", "crypt32", "hotkey", "desktop", "false", "tools", "updater", "winmm", "enterprise", "service", "close" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/93c8d17cfc1d37198ec68235361328afa953b3986bdd2be8cdce1b3908e32a9c_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774602117&Signature=GJRAxOKy5Ti19O5danDm6jZVf9i%2B1jkONiR5EbazB5bXMI%2B40CKT98OHvQNxwneyABK7Ie%2F09NbN5O4flZk3YAHeYRny4U%2BidCF5SA0rEaF3xpXDkcv4soaYTBerX8cN6%2BtKozSPuFaEHxO1r5JJUV%2B1TPmM3vUMLIxZuFGgyhYnjMHPoAS5zBDJ%2BYgkK4flsQLHi3KJ34ZsMMGOac2o4mg0FKU5PvGwttXsaLC308cyAlSUA" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1200", "name": "Hardware Additions", "display_name": "T1200 - Hardware Additions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 65, "FileHash-MD5": 220, "FileHash-SHA1": 144, "FileHash-SHA256": 105, "BitcoinAddress": 7, "URL": 128, "hostname": 84, "email": 2 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "37 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65333dffc82990767f6982f6", "name": "CVE-2014-0514", "description": "The following is the full text of the report on the Adobe Reader vulnerability (CVE-2014-0514), compiled by the University of California, San Francisco, and published on 1 October 2017.", "modified": "2023-11-20T03:02:27.506000", "created": "2023-10-21T02:57:03.220000", "tags": [ "adobe reader", "android", "javascript", "misc http", "scan endpoints", "all cve", "ellenmmm cve", "cve20140514 add", "new pulse", "existing pulse" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 5, "URL": 134, "hostname": 307, "domain": 381, "FileHash-SHA256": 7111, "FileHash-MD5": 1474, "FileHash-SHA1": 1441, "SSLCertFingerprint": 4, "email": 18 }, "indicator_count": 10875, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "925 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/93c8d17cfc1d37198ec68235361328afa953b3986bdd2be8cdce1b3908e32a9c_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774602117&Signature=GJRAxOKy5Ti19O5danDm6jZVf9i%2B1jkONiR5EbazB5bXMI%2B40CKT98OHvQNxwneyABK7Ie%2F09NbN5O4flZk3YAHeYRny4U%2BidCF5SA0rEaF3xpXDkcv4soaYTBerX8cN6%2BtKozSPuFaEHxO1r5JJUV%2B1TPmM3vUMLIxZuFGgyhYnjMHPoAS5zBDJ%2BYgkK4flsQLHi3KJ34ZsMMGOac2o4mg0FKU5PvGwttXsaLC308cyAlSUA" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [], "malware_families": [], "industries": [] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 3, "pulses": [ { "id": "69c6475aa191decaebc7a716", "name": "Yomi Hunter Sandbox", "description": "Malicious", "modified": "2026-04-26T08:04:27.318000", "created": "2026-03-27T09:01:14.165000", "tags": [ "categories", "xecj", "toggle", "users", "default", "xf4a", "windows", "xc0x88d xc0x88d", "xf4xff xf4xff", "x83xc4 x83xc4", "first", "path", "dynamicloader", "virustotal", "winsta", "mark", "stub", "class", "crypt32", "hotkey", "desktop", "false", "tools", "updater", "winmm", "enterprise", "service", "close" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/93c8d17cfc1d37198ec68235361328afa953b3986bdd2be8cdce1b3908e32a9c_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774602117&Signature=GJRAxOKy5Ti19O5danDm6jZVf9i%2B1jkONiR5EbazB5bXMI%2B40CKT98OHvQNxwneyABK7Ie%2F09NbN5O4flZk3YAHeYRny4U%2BidCF5SA0rEaF3xpXDkcv4soaYTBerX8cN6%2BtKozSPuFaEHxO1r5JJUV%2B1TPmM3vUMLIxZuFGgyhYnjMHPoAS5zBDJ%2BYgkK4flsQLHi3KJ34ZsMMGOac2o4mg0FKU5PvGwttXsaLC308cyAlSUA" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1200", "name": "Hardware Additions", "display_name": "T1200 - Hardware Additions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 65, "FileHash-MD5": 220, "FileHash-SHA1": 144, "FileHash-SHA256": 105, "BitcoinAddress": 7, "URL": 128, "hostname": 84, "email": 2 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "37 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69c647ad6940228b6bb68603", "name": "Yomi Hunter Sandbox", "description": "Malicious", "modified": "2026-04-26T08:04:27.318000", "created": "2026-03-27T09:02:37.017000", "tags": [ "categories", "xecj", "toggle", "users", "default", "xf4a", "windows", "xc0x88d xc0x88d", "xf4xff xf4xff", "x83xc4 x83xc4", "first", "path", "dynamicloader", "virustotal", "winsta", "mark", "stub", "class", "crypt32", "hotkey", "desktop", "false", "tools", "updater", "winmm", "enterprise", "service", "close" ], "references": [ "https://vtbehaviour.commondatastorage.googleapis.com/93c8d17cfc1d37198ec68235361328afa953b3986bdd2be8cdce1b3908e32a9c_Yomi%20Hunter.html?GoogleAccessId=758681729565-rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com&Expires=1774602117&Signature=GJRAxOKy5Ti19O5danDm6jZVf9i%2B1jkONiR5EbazB5bXMI%2B40CKT98OHvQNxwneyABK7Ie%2F09NbN5O4flZk3YAHeYRny4U%2BidCF5SA0rEaF3xpXDkcv4soaYTBerX8cN6%2BtKozSPuFaEHxO1r5JJUV%2B1TPmM3vUMLIxZuFGgyhYnjMHPoAS5zBDJ%2BYgkK4flsQLHi3KJ34ZsMMGOac2o4mg0FKU5PvGwttXsaLC308cyAlSUA" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [ { "id": "T1200", "name": "Hardware Additions", "display_name": "T1200 - Hardware Additions" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 65, "FileHash-MD5": 220, "FileHash-SHA1": 144, "FileHash-SHA256": 105, "BitcoinAddress": 7, "URL": 128, "hostname": 84, "email": 2 }, "indicator_count": 755, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "37 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65333dffc82990767f6982f6", "name": "CVE-2014-0514", "description": "The following is the full text of the report on the Adobe Reader vulnerability (CVE-2014-0514), compiled by the University of California, San Francisco, and published on 1 October 2017.", "modified": "2023-11-20T03:02:27.506000", "created": "2023-10-21T02:57:03.220000", "tags": [ "adobe reader", "android", "javascript", "misc http", "scan endpoints", "all cve", "ellenmmm cve", "cve20140514 add", "new pulse", "existing pulse" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 22, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ellenmmm", "id": "233693", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 5, "URL": 134, "hostname": 307, "domain": 381, "FileHash-SHA256": 7111, "FileHash-MD5": 1474, "FileHash-SHA1": 1441, "SSLCertFingerprint": 4, "email": 18 }, "indicator_count": 10875, "is_author": false, "is_subscribing": null, "subscriber_count": 82, "modified_text": "925 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "winimage.com", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "winimage.com", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780436672.8204725 }