{
  "type": "Domain",
  "indicator": "wt.call",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/wt.call",
    "alexa": "http://www.alexa.com/siteinfo/wt.call",
    "indicator": "wt.call",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3212234761,
      "indicator": "wt.call",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 5,
      "pulses": [
        {
          "id": "64766c6ffe0d936205c28197",
          "name": "miniwallet.bundle.js",
          "description": "confused cause hybrid scsn is clean",
          "modified": "2023-06-29T21:05:11.335000",
          "created": "2023-05-30T21:36:47.160000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "memoryfile scan",
            "ansi",
            "error",
            "runtime data",
            "highlight",
            "typeof e",
            "highlighttext",
            "windir",
            "graytext",
            "typeof symbol",
            "null",
            "date",
            "unknown",
            "path",
            "suspicious",
            "roboto",
            "meta",
            "4096",
            "span",
            "local",
            "scroll",
            "backspace",
            "insert",
            "this",
            "april",
            "hybrid",
            "model",
            "close",
            "click",
            "general",
            "strings",
            "team",
            "qakbot",
            "cookie"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 25,
            "domain": 131,
            "URL": 23,
            "CVE": 1,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 5
          },
          "indicator_count": 192,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "1066 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64766c71a5f740aaa9c915aa",
          "name": "miniwallet.bundle.js",
          "description": "confused cause hybrid scsn is clean",
          "modified": "2023-06-29T21:05:11.335000",
          "created": "2023-05-30T21:36:49.562000",
          "tags": [
            "sandbox",
            "malware",
            "analysis",
            "online",
            "submit",
            "vxstream",
            "sample",
            "download",
            "trojan",
            "apt",
            "memoryfile scan",
            "ansi",
            "error",
            "runtime data",
            "highlight",
            "typeof e",
            "highlighttext",
            "windir",
            "graytext",
            "typeof symbol",
            "null",
            "date",
            "unknown",
            "path",
            "suspicious",
            "roboto",
            "meta",
            "4096",
            "span",
            "local",
            "scroll",
            "backspace",
            "insert",
            "this",
            "april",
            "hybrid",
            "model",
            "close",
            "click",
            "general",
            "strings",
            "team",
            "qakbot",
            "cookie"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1491",
              "name": "Defacement",
              "display_name": "T1491 - Defacement"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1614",
              "name": "System Location Discovery",
              "display_name": "T1614 - System Location Discovery"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 26,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "callmeDoris",
            "id": "205385",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 25,
            "domain": 131,
            "URL": 23,
            "CVE": 1,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 2,
            "FileHash-SHA256": 5
          },
          "indicator_count": 192,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 93,
          "modified_text": "1066 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "630aa58da975d104891c6565",
          "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams",
          "description": "",
          "modified": "2022-08-27T23:15:25.718000",
          "created": "2022-08-27T23:15:25.718000",
          "tags": [
            "hammer",
            "gc",
            "vob",
            "tvb",
            "service",
            "date",
            "check favorite",
            "dare",
            "continuecta",
            "vote",
            "goprivate",
            "buycredits",
            "ff8d00",
            "favorite",
            "error",
            "null",
            "nonce",
            "enterprise",
            "script",
            "please do",
            "not copy",
            "and paste",
            "this code",
            "cgrecaptchacfg",
            "ngrecaptcha",
            "eenterprise",
            "object",
            "customevent",
            "ethis",
            "layouttest",
            "faceliftlayout",
            "stubbutton",
            "similarmodels",
            "purchasepagev3",
            "langtag",
            "newbannerchat",
            "image",
            "typeof atrkopts",
            "dailagill",
            "strong",
            "streams",
            "your",
            "source of",
            "pleasure",
            "live sex",
            "normal",
            "cosplay",
            "fingering",
            "chat",
            "deepthroat",
            "close",
            "live",
            "free cams",
            "sex chat",
            "live porn",
            "sex cam",
            "livesex",
            "webcamsex",
            "adult cams",
            "free live sex chat",
            "webcam sex",
            "chat online",
            "free adults hd",
            "mins",
            "xxx cams",
            "xxx porn",
            "free live cam",
            "adult sex",
            "material",
            "majority",
            "here looking",
            "for child",
            "pornography",
            "move on",
            "on this",
            "website",
            "we will",
            "turn over",
            "free porn webcams",
            "live webcam",
            "online sex cam",
            "xxx girls",
            "live sex chat",
            "teen sexchat",
            "amateur video",
            "web cam",
            "sexcams",
            "shows",
            "porn chat",
            "bongacams",
            "function",
            "i2c1",
            "xeir",
            "cef4",
            "m4sr",
            "e4c4",
            "math",
            "ttmt",
            "y4giwe",
            "h5gg",
            "window",
            "css1062",
            "segoe ui",
            "emoji",
            "href",
            "roboto",
            "helvetica neue",
            "arial",
            "apple color",
            "symbol",
            "typecheckbox",
            "twitter",
            "web design",
            "iran",
            "author url",
            "github",
            "regexp",
            "pseudo",
            "child",
            "typeof n",
            "typeof t",
            "class",
            "attr",
            "typeof module",
            "this"
          ],
          "references": [
            "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json",
            "https://payvtylhwjxnr.xyz/Content/script?v=2",
            "https://payvtylhwjxnr.xyz/Content/css/banks.css",
            "https://payvtylhwjxnr.xyz/Content/style?v=1",
            "xfe-IP-104.21.72.150-stix2-2.1-export.json",
            "xfe-IP-172.67.151.101-stix2-2.1-export.json",
            "https://static.selfpuc.com/mnpw3.js",
            "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full",
            "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on",
            "https://bongacams.com/GianaWatson",
            "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools",
            "https://d31qbv1cthcecs.cloudfront.net/atrk.js",
            "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js",
            "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB",
            "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "New Caledonia",
            "New Zealand"
          ],
          "malware_families": [
            {
              "id": "Hammer",
              "display_name": "Hammer",
              "target": null
            },
            {
              "id": "Tvb",
              "display_name": "Tvb",
              "target": null
            },
            {
              "id": "Vob",
              "display_name": "Vob",
              "target": null
            },
            {
              "id": "Gc",
              "display_name": "Gc",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "62509a05316b00bcca30c693",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Hardtogiveafuck",
            "id": "205637",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 425,
            "domain": 459,
            "URL": 1412,
            "FileHash-SHA256": 125
          },
          "indicator_count": 2421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 7,
          "modified_text": "1372 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62e1ca167a1591e7b4ca1129",
          "name": "VirusTotal view-source on https://www.virustotal.com/en/file/undefined/analysis/",
          "description": "someone really needs to figure out wtf this is all doing it has to be part of the net.sh",
          "modified": "2022-07-28T02:05:04.183000",
          "created": "2022-07-27T23:28:22.504000",
          "tags": [
            "array",
            "object",
            "typeof t",
            "layer1",
            "error",
            "path",
            "function",
            "typeerror",
            "date",
            "svg export",
            "span",
            "null",
            "unknown",
            "click",
            "february",
            "april",
            "june",
            "august",
            "this",
            "void",
            "bounce",
            "string",
            "regexp",
            "number",
            "sxa0",
            "amptoken",
            "optout",
            "notfound",
            "contenttype",
            "form",
            "copyright",
            "element",
            "polymer project",
            "authors",
            "bsd style",
            "code",
            "google",
            "software",
            "window",
            "generator",
            "comment",
            "trident",
            "typeof e",
            "typeof symbol",
            "typeof btoa",
            "btoa",
            "typeof reflect",
            "boolean",
            "customevent",
            "plugin",
            "build",
            "home",
            "intelligence",
            "graph",
            "report",
            "urls",
            "please",
            "javascript",
            "https://www.virustotal.com/en/file/undefined/analysis/",
            "net.sh"
          ],
          "references": [
            "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
            "14.main.bundle.91f9f7ff635e0b797de3.js",
            "5.main.bundle.e92e5e24e074f9c2a52b.js",
            "0.main.bundle.a9d68f5204cd3ac257b6.js",
            "webcomponent-polyfill.js",
            "analytics.js",
            "12.main.bundle.50be73a11d1d3745a5ee.js",
            "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
            "https://www.virustotal.com/en/file/undefined/analysis/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1538,
            "FileHash-SHA256": 138,
            "hostname": 363,
            "domain": 235
          },
          "indicator_count": 2274,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 392,
          "modified_text": "1403 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "62509a05316b00bcca30c693",
          "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams",
          "description": "Here is the full text of the code for the new animation, which will take place at 20:00 GMT on Friday, 1:30 BST.. (19:45 GMT)..",
          "modified": "2022-05-08T00:03:14.586000",
          "created": "2022-04-08T20:24:37.141000",
          "tags": [
            "hammer",
            "gc",
            "vob",
            "tvb",
            "service",
            "date",
            "check favorite",
            "dare",
            "continuecta",
            "vote",
            "goprivate",
            "buycredits",
            "ff8d00",
            "favorite",
            "error",
            "null",
            "nonce",
            "enterprise",
            "script",
            "please do",
            "not copy",
            "and paste",
            "this code",
            "cgrecaptchacfg",
            "ngrecaptcha",
            "eenterprise",
            "object",
            "customevent",
            "ethis",
            "layouttest",
            "faceliftlayout",
            "stubbutton",
            "similarmodels",
            "purchasepagev3",
            "langtag",
            "newbannerchat",
            "image",
            "typeof atrkopts",
            "dailagill",
            "strong",
            "streams",
            "your",
            "source of",
            "pleasure",
            "live sex",
            "normal",
            "cosplay",
            "fingering",
            "chat",
            "deepthroat",
            "close",
            "live",
            "free cams",
            "sex chat",
            "live porn",
            "sex cam",
            "livesex",
            "webcamsex",
            "adult cams",
            "free live sex chat",
            "webcam sex",
            "chat online",
            "free adults hd",
            "mins",
            "xxx cams",
            "xxx porn",
            "free live cam",
            "adult sex",
            "material",
            "majority",
            "here looking",
            "for child",
            "pornography",
            "move on",
            "on this",
            "website",
            "we will",
            "turn over",
            "free porn webcams",
            "live webcam",
            "online sex cam",
            "xxx girls",
            "live sex chat",
            "teen sexchat",
            "amateur video",
            "web cam",
            "sexcams",
            "shows",
            "porn chat",
            "bongacams",
            "function",
            "i2c1",
            "xeir",
            "cef4",
            "m4sr",
            "e4c4",
            "math",
            "ttmt",
            "y4giwe",
            "h5gg",
            "window",
            "css1062",
            "segoe ui",
            "emoji",
            "href",
            "roboto",
            "helvetica neue",
            "arial",
            "apple color",
            "symbol",
            "typecheckbox",
            "twitter",
            "web design",
            "iran",
            "author url",
            "github",
            "regexp",
            "pseudo",
            "child",
            "typeof n",
            "typeof t",
            "class",
            "attr",
            "typeof module",
            "this"
          ],
          "references": [
            "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json",
            "https://payvtylhwjxnr.xyz/Content/script?v=2",
            "https://payvtylhwjxnr.xyz/Content/css/banks.css",
            "https://payvtylhwjxnr.xyz/Content/style?v=1",
            "xfe-IP-104.21.72.150-stix2-2.1-export.json",
            "xfe-IP-172.67.151.101-stix2-2.1-export.json",
            "https://static.selfpuc.com/mnpw3.js",
            "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full",
            "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on",
            "https://bongacams.com/GianaWatson",
            "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools",
            "https://d31qbv1cthcecs.cloudfront.net/atrk.js",
            "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js",
            "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB",
            "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "New Caledonia",
            "New Zealand"
          ],
          "malware_families": [
            {
              "id": "Hammer",
              "display_name": "Hammer",
              "target": null
            },
            {
              "id": "Tvb",
              "display_name": "Tvb",
              "target": null
            },
            {
              "id": "Vob",
              "display_name": "Vob",
              "target": null
            },
            {
              "id": "Gc",
              "display_name": "Gc",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "adjadex1@gmail.com",
            "id": "187163",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 425,
            "domain": 459,
            "URL": 1412,
            "FileHash-SHA256": 125
          },
          "indicator_count": 2421,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 71,
          "modified_text": "1484 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
        "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB",
        "analytics.js",
        "https://payvtylhwjxnr.xyz/Content/css/banks.css",
        "https://d31qbv1cthcecs.cloudfront.net/atrk.js",
        "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
        "https://payvtylhwjxnr.xyz/Content/script?v=2",
        "0.main.bundle.a9d68f5204cd3ac257b6.js",
        "5.main.bundle.e92e5e24e074f9c2a52b.js",
        "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0",
        "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools",
        "12.main.bundle.50be73a11d1d3745a5ee.js",
        "14.main.bundle.91f9f7ff635e0b797de3.js",
        "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js",
        "https://payvtylhwjxnr.xyz/Content/style?v=1",
        "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json",
        "https://bongacams.com/GianaWatson",
        "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full",
        "xfe-IP-172.67.151.101-stix2-2.1-export.json",
        "https://static.selfpuc.com/mnpw3.js",
        "webcomponent-polyfill.js",
        "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on",
        "https://www.virustotal.com/en/file/undefined/analysis/",
        "xfe-IP-104.21.72.150-stix2-2.1-export.json",
        "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Vob",
            "Hammer",
            "Gc",
            "Tvb"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 5,
  "pulses": [
    {
      "id": "64766c6ffe0d936205c28197",
      "name": "miniwallet.bundle.js",
      "description": "confused cause hybrid scsn is clean",
      "modified": "2023-06-29T21:05:11.335000",
      "created": "2023-05-30T21:36:47.160000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "memoryfile scan",
        "ansi",
        "error",
        "runtime data",
        "highlight",
        "typeof e",
        "highlighttext",
        "windir",
        "graytext",
        "typeof symbol",
        "null",
        "date",
        "unknown",
        "path",
        "suspicious",
        "roboto",
        "meta",
        "4096",
        "span",
        "local",
        "scroll",
        "backspace",
        "insert",
        "this",
        "april",
        "hybrid",
        "model",
        "close",
        "click",
        "general",
        "strings",
        "team",
        "qakbot",
        "cookie"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 25,
        "domain": 131,
        "URL": 23,
        "CVE": 1,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 5
      },
      "indicator_count": 192,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "1066 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "64766c71a5f740aaa9c915aa",
      "name": "miniwallet.bundle.js",
      "description": "confused cause hybrid scsn is clean",
      "modified": "2023-06-29T21:05:11.335000",
      "created": "2023-05-30T21:36:49.562000",
      "tags": [
        "sandbox",
        "malware",
        "analysis",
        "online",
        "submit",
        "vxstream",
        "sample",
        "download",
        "trojan",
        "apt",
        "memoryfile scan",
        "ansi",
        "error",
        "runtime data",
        "highlight",
        "typeof e",
        "highlighttext",
        "windir",
        "graytext",
        "typeof symbol",
        "null",
        "date",
        "unknown",
        "path",
        "suspicious",
        "roboto",
        "meta",
        "4096",
        "span",
        "local",
        "scroll",
        "backspace",
        "insert",
        "this",
        "april",
        "hybrid",
        "model",
        "close",
        "click",
        "general",
        "strings",
        "team",
        "qakbot",
        "cookie"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/78a7e765ffd6dff7af3b92b6234271fd0dddf5945f38e70d0e22324c1ec06eca/64414afe0ebb5831a20ce8f0"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1491",
          "name": "Defacement",
          "display_name": "T1491 - Defacement"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1614",
          "name": "System Location Discovery",
          "display_name": "T1614 - System Location Discovery"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 26,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "callmeDoris",
        "id": "205385",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 25,
        "domain": 131,
        "URL": 23,
        "CVE": 1,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 2,
        "FileHash-SHA256": 5
      },
      "indicator_count": 192,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 93,
      "modified_text": "1066 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "630aa58da975d104891c6565",
      "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams",
      "description": "",
      "modified": "2022-08-27T23:15:25.718000",
      "created": "2022-08-27T23:15:25.718000",
      "tags": [
        "hammer",
        "gc",
        "vob",
        "tvb",
        "service",
        "date",
        "check favorite",
        "dare",
        "continuecta",
        "vote",
        "goprivate",
        "buycredits",
        "ff8d00",
        "favorite",
        "error",
        "null",
        "nonce",
        "enterprise",
        "script",
        "please do",
        "not copy",
        "and paste",
        "this code",
        "cgrecaptchacfg",
        "ngrecaptcha",
        "eenterprise",
        "object",
        "customevent",
        "ethis",
        "layouttest",
        "faceliftlayout",
        "stubbutton",
        "similarmodels",
        "purchasepagev3",
        "langtag",
        "newbannerchat",
        "image",
        "typeof atrkopts",
        "dailagill",
        "strong",
        "streams",
        "your",
        "source of",
        "pleasure",
        "live sex",
        "normal",
        "cosplay",
        "fingering",
        "chat",
        "deepthroat",
        "close",
        "live",
        "free cams",
        "sex chat",
        "live porn",
        "sex cam",
        "livesex",
        "webcamsex",
        "adult cams",
        "free live sex chat",
        "webcam sex",
        "chat online",
        "free adults hd",
        "mins",
        "xxx cams",
        "xxx porn",
        "free live cam",
        "adult sex",
        "material",
        "majority",
        "here looking",
        "for child",
        "pornography",
        "move on",
        "on this",
        "website",
        "we will",
        "turn over",
        "free porn webcams",
        "live webcam",
        "online sex cam",
        "xxx girls",
        "live sex chat",
        "teen sexchat",
        "amateur video",
        "web cam",
        "sexcams",
        "shows",
        "porn chat",
        "bongacams",
        "function",
        "i2c1",
        "xeir",
        "cef4",
        "m4sr",
        "e4c4",
        "math",
        "ttmt",
        "y4giwe",
        "h5gg",
        "window",
        "css1062",
        "segoe ui",
        "emoji",
        "href",
        "roboto",
        "helvetica neue",
        "arial",
        "apple color",
        "symbol",
        "typecheckbox",
        "twitter",
        "web design",
        "iran",
        "author url",
        "github",
        "regexp",
        "pseudo",
        "child",
        "typeof n",
        "typeof t",
        "class",
        "attr",
        "typeof module",
        "this"
      ],
      "references": [
        "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json",
        "https://payvtylhwjxnr.xyz/Content/script?v=2",
        "https://payvtylhwjxnr.xyz/Content/css/banks.css",
        "https://payvtylhwjxnr.xyz/Content/style?v=1",
        "xfe-IP-104.21.72.150-stix2-2.1-export.json",
        "xfe-IP-172.67.151.101-stix2-2.1-export.json",
        "https://static.selfpuc.com/mnpw3.js",
        "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full",
        "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on",
        "https://bongacams.com/GianaWatson",
        "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools",
        "https://d31qbv1cthcecs.cloudfront.net/atrk.js",
        "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js",
        "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB",
        "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "New Caledonia",
        "New Zealand"
      ],
      "malware_families": [
        {
          "id": "Hammer",
          "display_name": "Hammer",
          "target": null
        },
        {
          "id": "Tvb",
          "display_name": "Tvb",
          "target": null
        },
        {
          "id": "Vob",
          "display_name": "Vob",
          "target": null
        },
        {
          "id": "Gc",
          "display_name": "Gc",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "62509a05316b00bcca30c693",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Hardtogiveafuck",
        "id": "205637",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 425,
        "domain": 459,
        "URL": 1412,
        "FileHash-SHA256": 125
      },
      "indicator_count": 2421,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 7,
      "modified_text": "1372 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62e1ca167a1591e7b4ca1129",
      "name": "VirusTotal view-source on https://www.virustotal.com/en/file/undefined/analysis/",
      "description": "someone really needs to figure out wtf this is all doing it has to be part of the net.sh",
      "modified": "2022-07-28T02:05:04.183000",
      "created": "2022-07-27T23:28:22.504000",
      "tags": [
        "array",
        "object",
        "typeof t",
        "layer1",
        "error",
        "path",
        "function",
        "typeerror",
        "date",
        "svg export",
        "span",
        "null",
        "unknown",
        "click",
        "february",
        "april",
        "june",
        "august",
        "this",
        "void",
        "bounce",
        "string",
        "regexp",
        "number",
        "sxa0",
        "amptoken",
        "optout",
        "notfound",
        "contenttype",
        "form",
        "copyright",
        "element",
        "polymer project",
        "authors",
        "bsd style",
        "code",
        "google",
        "software",
        "window",
        "generator",
        "comment",
        "trident",
        "typeof e",
        "typeof symbol",
        "typeof btoa",
        "btoa",
        "typeof reflect",
        "boolean",
        "customevent",
        "plugin",
        "build",
        "home",
        "intelligence",
        "graph",
        "report",
        "urls",
        "please",
        "javascript",
        "https://www.virustotal.com/en/file/undefined/analysis/",
        "net.sh"
      ],
      "references": [
        "entity%3Aip%20whois%3Ainfo%40anodicnetwork.com.html",
        "14.main.bundle.91f9f7ff635e0b797de3.js",
        "5.main.bundle.e92e5e24e074f9c2a52b.js",
        "0.main.bundle.a9d68f5204cd3ac257b6.js",
        "webcomponent-polyfill.js",
        "analytics.js",
        "12.main.bundle.50be73a11d1d3745a5ee.js",
        "\"<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\" \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\"> <html xmlns=\"http://www.w3.org/1999/xhtml\">   <head>     <title>           Page not found       </title>       <meta http-equiv=\"Content-type\" content=\"text/html; charset=utf-8\">     <meta http-equiv=\"Pragma\" content=\"no-cache\">     <meta http-equiv=\"Pragma\" content=\"no-store\">     <meta http-equiv=\"Expires\" content=\"-1\">     <meta name=\"keywords\" content=\"virustotal, antivirus, infected, free, sca",
        "https://www.virustotal.com/en/file/undefined/analysis/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1538,
        "FileHash-SHA256": 138,
        "hostname": 363,
        "domain": 235
      },
      "indicator_count": 2274,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 392,
      "modified_text": "1403 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "62509a05316b00bcca30c693",
      "name": "Live Sexcams: XXX Adult Shows - Free Porn Chat - BongaCams",
      "description": "Here is the full text of the code for the new animation, which will take place at 20:00 GMT on Friday, 1:30 BST.. (19:45 GMT)..",
      "modified": "2022-05-08T00:03:14.586000",
      "created": "2022-04-08T20:24:37.141000",
      "tags": [
        "hammer",
        "gc",
        "vob",
        "tvb",
        "service",
        "date",
        "check favorite",
        "dare",
        "continuecta",
        "vote",
        "goprivate",
        "buycredits",
        "ff8d00",
        "favorite",
        "error",
        "null",
        "nonce",
        "enterprise",
        "script",
        "please do",
        "not copy",
        "and paste",
        "this code",
        "cgrecaptchacfg",
        "ngrecaptcha",
        "eenterprise",
        "object",
        "customevent",
        "ethis",
        "layouttest",
        "faceliftlayout",
        "stubbutton",
        "similarmodels",
        "purchasepagev3",
        "langtag",
        "newbannerchat",
        "image",
        "typeof atrkopts",
        "dailagill",
        "strong",
        "streams",
        "your",
        "source of",
        "pleasure",
        "live sex",
        "normal",
        "cosplay",
        "fingering",
        "chat",
        "deepthroat",
        "close",
        "live",
        "free cams",
        "sex chat",
        "live porn",
        "sex cam",
        "livesex",
        "webcamsex",
        "adult cams",
        "free live sex chat",
        "webcam sex",
        "chat online",
        "free adults hd",
        "mins",
        "xxx cams",
        "xxx porn",
        "free live cam",
        "adult sex",
        "material",
        "majority",
        "here looking",
        "for child",
        "pornography",
        "move on",
        "on this",
        "website",
        "we will",
        "turn over",
        "free porn webcams",
        "live webcam",
        "online sex cam",
        "xxx girls",
        "live sex chat",
        "teen sexchat",
        "amateur video",
        "web cam",
        "sexcams",
        "shows",
        "porn chat",
        "bongacams",
        "function",
        "i2c1",
        "xeir",
        "cef4",
        "m4sr",
        "e4c4",
        "math",
        "ttmt",
        "y4giwe",
        "h5gg",
        "window",
        "css1062",
        "segoe ui",
        "emoji",
        "href",
        "roboto",
        "helvetica neue",
        "arial",
        "apple color",
        "symbol",
        "typecheckbox",
        "twitter",
        "web design",
        "iran",
        "author url",
        "github",
        "regexp",
        "pseudo",
        "child",
        "typeof n",
        "typeof t",
        "class",
        "attr",
        "typeof module",
        "this"
      ],
      "references": [
        "xfe-URL-payvtylhwjxnr.xyz-stix2-2.1-export.json",
        "https://payvtylhwjxnr.xyz/Content/script?v=2",
        "https://payvtylhwjxnr.xyz/Content/css/banks.css",
        "https://payvtylhwjxnr.xyz/Content/style?v=1",
        "xfe-IP-104.21.72.150-stix2-2.1-export.json",
        "xfe-IP-172.67.151.101-stix2-2.1-export.json",
        "https://static.selfpuc.com/mnpw3.js",
        "https://bcprm.com/promo.php?c=716918&type=embed_chat&page=popular_chat&top_model=1&stream_only_size=full",
        "https://en.bongacams.com/popular-chat-popup?livetab=female&top_model=1&c=716918&hit_url=https%3A%2F%2Fbongacams.com%2Ftrack%3Fc%3D716918%26ps%3Dembed_chat&stream_only=1&amute=1&classic=on",
        "https://bongacams.com/GianaWatson",
        "https://m.bimbim.com/en/DailaGill?psid=crakmedia2&psprogram=revs&pstool=450_1&utm_campaign=main&utm_content=redirect&utm_medium=webmaster&utm_source=promotools",
        "https://d31qbv1cthcecs.cloudfront.net/atrk.js",
        "https://i.bcicdn.com/js-min/1NCJjq/27984029c73362dbf9ec0727.js",
        "https://www.google.com/recaptcha/enterprise.js?&render=6LeY5wkeAAAAAHNlJZXiHgJrpCTsD-Qu0O2GlYgB",
        "https://staticx1.dditscdn.com/mbl/frontend_backbone/static/_common/modular-member-client/script/maincontext_9af26.min.js"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "New Caledonia",
        "New Zealand"
      ],
      "malware_families": [
        {
          "id": "Hammer",
          "display_name": "Hammer",
          "target": null
        },
        {
          "id": "Tvb",
          "display_name": "Tvb",
          "target": null
        },
        {
          "id": "Vob",
          "display_name": "Vob",
          "target": null
        },
        {
          "id": "Gc",
          "display_name": "Gc",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "adjadex1@gmail.com",
        "id": "187163",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 425,
        "domain": 459,
        "URL": 1412,
        "FileHash-SHA256": 125
      },
      "indicator_count": 2421,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 71,
      "modified_text": "1484 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "wt.call",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "wt.call",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780214762.752698
}