ActivityPub Viewer

A small tool to view real-world ActivityPub objects as JSON! Enter a URL or username from Mastodon or a similar service below, and we'll send a request with the right Accept header to the server to view the underlying object.

Open in browser →
{ "@context": [ "https://www.w3.org/ns/activitystreams", { "ostatus": "http://ostatus.org#", "atomUri": "ostatus:atomUri", "inReplyToAtomUri": "ostatus:inReplyToAtomUri", "conversation": "ostatus:conversation", "sensitive": "as:sensitive", "toot": "http://joinmastodon.org/ns#", "votersCount": "toot:votersCount", "litepub": "http://litepub.social/ns#", "directMessage": "litepub:directMessage", "blurhash": "toot:blurhash", "focalPoint": { "@container": "@list", "@id": "toot:focalPoint" }, "Hashtag": "as:Hashtag" } ], "id": "https://infosec.exchange/users/adulau/statuses/114046625610233446", "type": "Note", "summary": null, "inReplyTo": null, "published": "2025-02-22T08:36:43Z", "url": "https://infosec.exchange/@adulau/114046625610233446", "attributedTo": "https://infosec.exchange/users/adulau", "to": [ "https://www.w3.org/ns/activitystreams#Public" ], "cc": [ "https://infosec.exchange/users/adulau/followers", "https://infosec.exchange/users/terrtia", "https://infosec.exchange/users/ail_project", "https://infosec.exchange/users/fr0gger" ], "sensitive": false, "atomUri": "https://infosec.exchange/users/adulau/statuses/114046625610233446", "inReplyToAtomUri": null, "conversation": "tag:infosec.exchange,2025-02-22:objectId=244185380:objectType=Conversation", "content": "<p>We imported the data from Black Basta Ransomware group leak into AIL and there are many interesting aspects.</p><ul><li><p>The federation network of Matrix servers (see the screenshot) used to communicated among the affiliates/group(s).</p></li><li><p>Activities in the chat room, especially the daily activity view in AIL. Guessing the location and timezone of groups or affiliates is an endless source of information.</p></li><li><p>They rely on many open-source and SaaS tools, including Google Docs or Zoom. </p></li><li><p>Many interesting correlations with cryptocurrencies, IP addresses, CVE numbers, and chat username relationships (who talks to whom and when).</p></li></ul><p>If you are using AIL project and want to import the leak dataset, <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@terrtia\" class=\"u-url mention\">@<span>terrtia</span></a></span> did an importer <a href=\"https://github.com/ail-project/ail-feeder-matrix\" target=\"_blank\" rel=\"nofollow noopener\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">github.com/ail-project/ail-fee</span><span class=\"invisible\">der-matrix</span></a></p><p><a href=\"https://infosec.exchange/tags/BlackBasta\" class=\"mention hashtag\" rel=\"tag\">#<span>BlackBasta</span></a> <a href=\"https://infosec.exchange/tags/blackbastleaks\" class=\"mention hashtag\" rel=\"tag\">#<span>blackbastleaks</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> <a href=\"https://infosec.exchange/tags/osint\" class=\"mention hashtag\" rel=\"tag\">#<span>osint</span></a> <a href=\"https://infosec.exchange/tags/threatintelligence\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintelligence</span></a> <a href=\"https://infosec.exchange/tags/opensource\" class=\"mention hashtag\" rel=\"tag\">#<span>opensource</span></a> <a href=\"https://infosec.exchange/tags/dataset\" class=\"mention hashtag\" rel=\"tag\">#<span>dataset</span></a> </p><p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@ail_project\" class=\"u-url mention\">@<span>ail_project</span></a></span> </p><p>Maybe some interesting input for <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@fr0gger\" class=\"u-url mention\">@<span>fr0gger</span></a></span> for his existing analysis.</p><p>I see that this dataset can be used to enhance some of our open-source tools.</p><p><a href=\"https://github.com/ail-project/ail-framework\" target=\"_blank\" rel=\"nofollow noopener\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">github.com/ail-project/ail-fra</span><span class=\"invisible\">mework</span></a></p>", "contentMap": { "en": "<p>We imported the data from Black Basta Ransomware group leak into AIL and there are many interesting aspects.</p><ul><li><p>The federation network of Matrix servers (see the screenshot) used to communicated among the affiliates/group(s).</p></li><li><p>Activities in the chat room, especially the daily activity view in AIL. Guessing the location and timezone of groups or affiliates is an endless source of information.</p></li><li><p>They rely on many open-source and SaaS tools, including Google Docs or Zoom. </p></li><li><p>Many interesting correlations with cryptocurrencies, IP addresses, CVE numbers, and chat username relationships (who talks to whom and when).</p></li></ul><p>If you are using AIL project and want to import the leak dataset, <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@terrtia\" class=\"u-url mention\">@<span>terrtia</span></a></span> did an importer <a href=\"https://github.com/ail-project/ail-feeder-matrix\" target=\"_blank\" rel=\"nofollow noopener\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">github.com/ail-project/ail-fee</span><span class=\"invisible\">der-matrix</span></a></p><p><a href=\"https://infosec.exchange/tags/BlackBasta\" class=\"mention hashtag\" rel=\"tag\">#<span>BlackBasta</span></a> <a href=\"https://infosec.exchange/tags/blackbastleaks\" class=\"mention hashtag\" rel=\"tag\">#<span>blackbastleaks</span></a> <a href=\"https://infosec.exchange/tags/threatintel\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintel</span></a> <a href=\"https://infosec.exchange/tags/osint\" class=\"mention hashtag\" rel=\"tag\">#<span>osint</span></a> <a href=\"https://infosec.exchange/tags/threatintelligence\" class=\"mention hashtag\" rel=\"tag\">#<span>threatintelligence</span></a> <a href=\"https://infosec.exchange/tags/opensource\" class=\"mention hashtag\" rel=\"tag\">#<span>opensource</span></a> <a href=\"https://infosec.exchange/tags/dataset\" class=\"mention hashtag\" rel=\"tag\">#<span>dataset</span></a> </p><p><span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@ail_project\" class=\"u-url mention\">@<span>ail_project</span></a></span> </p><p>Maybe some interesting input for <span class=\"h-card\" translate=\"no\"><a href=\"https://infosec.exchange/@fr0gger\" class=\"u-url mention\">@<span>fr0gger</span></a></span> for his existing analysis.</p><p>I see that this dataset can be used to enhance some of our open-source tools.</p><p><a href=\"https://github.com/ail-project/ail-framework\" target=\"_blank\" rel=\"nofollow noopener\" translate=\"no\"><span class=\"invisible\">https://</span><span class=\"ellipsis\">github.com/ail-project/ail-fra</span><span class=\"invisible\">mework</span></a></p>" }, "attachment": [ { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/046/568/718/137/909/original/65b6782ab5245a70.png", "name": "Lists of Matrix server references involved in the Black Basta ransomware group leak. The data has been imported to AIL.", "blurhash": "UCN-Ts?8?8?T9NjYocoe~MRkRlWE9gjrocoe", "focalPoint": [ 0, 0 ], "width": 1391, "height": 1048 }, { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/046/578/472/811/355/original/25099c438d6e08e8.png", "name": "Activities in the chat room, especially the daily activity view in AIL.", "blurhash": "U6SijXRj~E9aaSRp9Zog?0Wr9r-pEH-,~CIn", "focalPoint": [ 0.05, -0.3 ], "width": 1230, "height": 761 }, { "type": "Document", "mediaType": "image/png", "url": "https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/046/610/136/739/875/original/e1317dd2a72d59c2.png", "name": "Many interesting correlations with cryptocurrencies, IP addresses, CVE numbers, and chat username relationships (who talks to whom and when).", "blurhash": "UHQ]~HE1^+~Wx_%29ZD%xuWCWBR+ITRi%MR-", "focalPoint": [ 0, 0 ], "width": 1603, "height": 980 } ], "tag": [ { "type": "Mention", "href": "https://infosec.exchange/users/terrtia", "name": "@terrtia" }, { "type": "Mention", "href": "https://infosec.exchange/users/ail_project", "name": "@ail_project" }, { "type": "Mention", "href": "https://infosec.exchange/users/fr0gger", "name": "@fr0gger" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/BlackBasta", "name": "#BlackBasta" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/blackbastleaks", "name": "#blackbastleaks" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintel", "name": "#threatintel" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/osint", "name": "#osint" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/threatintelligence", "name": "#threatintelligence" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/opensource", "name": "#opensource" }, { "type": "Hashtag", "href": "https://infosec.exchange/tags/dataset", "name": "#dataset" } ], "replies": { "id": "https://infosec.exchange/users/adulau/statuses/114046625610233446/replies", "type": "Collection", "first": { "type": "CollectionPage", "next": "https://infosec.exchange/users/adulau/statuses/114046625610233446/replies?only_other_accounts=true&page=true", "partOf": "https://infosec.exchange/users/adulau/statuses/114046625610233446/replies", "items": [] } }, "likes": { "id": "https://infosec.exchange/users/adulau/statuses/114046625610233446/likes", "type": "Collection", "totalItems": 15 }, "shares": { "id": "https://infosec.exchange/users/adulau/statuses/114046625610233446/shares", "type": "Collection", "totalItems": 15 } }