{
  "type": "Domain",
  "indicator": "420willienelsonblvd.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/420willienelsonblvd.com",
    "alexa": "http://www.alexa.com/siteinfo/420willienelsonblvd.com",
    "indicator": "420willienelsonblvd.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3831132369,
      "indicator": "420willienelsonblvd.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "69a02837827feb0b78fa3ad2",
          "name": "The Belasco Chain",
          "description": "The adversary delivers a masterclass in \"Regular Belasco\" stagecraft, utilizing authentic Adobe PIDs to construct a \"living library\" of legitimacy where mundane metadata like SOPHIA.json acts as Gatsby\u2019s \"real but uncut\" volumes to mask a hollowed-out interior. This is a triumph of performative evasion; while researchers marvel at the realism of the set-dressing, MSI50B8.tmp and MSI4F2F.tmp wait in the wings of the Windows\\Installer directory, invisible to the human eye and using NGEN hijacking to bake illicit scripts directly into the OS framework. By employing Cryptnet certificates as \"stage lighting\" to mask C2 handshakes, the malware doesn't just attend the system\u2019s party\u2014it rewrites the invitation to own the house. Unlike the tragic end at West Egg, this Belasco chain is a play that refuses to end; it simply resets the stage, ensuring the performance continues as long as the \"green light\" of the C2 remains active.",
          "modified": "2026-05-31T01:02:14",
          "created": "2026-02-26T11:02:15.932000",
          "tags": [
            "file size",
            "mwdb",
            "bazaar",
            "sha3384",
            "ssdeep",
            "file type",
            "sha1",
            "sha256",
            "crc32",
            "filenames c"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2813,
            "FileHash-SHA1": 2576,
            "FileHash-SHA256": 8145,
            "domain": 1903,
            "hostname": 1502,
            "URL": 1359,
            "email": 46,
            "CVE": 54,
            "CIDR": 3,
            "YARA": 7,
            "JA3": 1,
            "IPv4": 11
          },
          "indicator_count": 18420,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 74,
          "modified_text": "4 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "698e93e1ab02db8c49e8c3ed",
          "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)",
          "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.",
          "modified": "2026-05-17T15:52:35.396000",
          "created": "2026-02-13T03:00:49.872000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
            "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 28000,
            "FileHash-SHA256": 48374,
            "FileHash-MD5": 42596,
            "FileHash-SHA1": 23243,
            "hostname": 35654,
            "URL": 75758,
            "SSLCertFingerprint": 30,
            "CVE": 7585,
            "email": 316,
            "FileHash-IMPHASH": 8,
            "CIDR": 26205,
            "JA3": 1,
            "URI": 5,
            "IPv4": 574,
            "Mutex": 1
          },
          "indicator_count": 288350,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 92,
          "modified_text": "13 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf64e1d5e06aa6207f78de",
          "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
          "description": "",
          "modified": "2026-03-27T00:30:39.055000",
          "created": "2026-03-22T03:41:21.863000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": "698e93e1ab02db8c49e8c3ed",
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 27572,
            "FileHash-SHA256": 46076,
            "FileHash-MD5": 42177,
            "FileHash-SHA1": 22874,
            "hostname": 33438,
            "URL": 74810,
            "SSLCertFingerprint": 21,
            "CVE": 7579,
            "email": 297,
            "FileHash-IMPHASH": 8,
            "CIDR": 26203,
            "JA3": 1
          },
          "indicator_count": 281056,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 149,
          "modified_text": "65 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69bf64eccb5d39a90a3c391e",
          "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
          "description": "",
          "modified": "2026-03-27T00:30:39.055000",
          "created": "2026-03-22T03:41:32.565000",
          "tags": [
            "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
            "9698f46495ce9401c8bcaf9a2afe1598",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
            "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
            "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
            "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
          ],
          "references": [
            "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
            "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
            "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
            "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
            "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
            "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
            "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
            "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
            "Verification failure observed in automated verification handlers during sandbox replay.",
            "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
            "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
            "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
            "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
            "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
            "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
            "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
            "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
            "",
            "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "China",
            "United States of America",
            "Spain",
            "Japan",
            "Canada"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
          ],
          "TLP": "green",
          "cloned_from": "698e93e1ab02db8c49e8c3ed",
          "export_count": 4,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 27572,
            "FileHash-SHA256": 46076,
            "FileHash-MD5": 42177,
            "FileHash-SHA1": 22874,
            "hostname": 33438,
            "URL": 74810,
            "SSLCertFingerprint": 21,
            "CVE": 7579,
            "email": 297,
            "FileHash-IMPHASH": 8,
            "CIDR": 26203,
            "JA3": 1
          },
          "indicator_count": 281056,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 152,
          "modified_text": "65 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5c5ebba25ca46fc5b36bc",
          "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:11:39.752000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "msie",
            "chrome",
            "certificate",
            "hostname",
            "url analysis",
            "http response",
            "final url",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers date",
            "connection",
            "date sat",
            "html info",
            "forbidden",
            "google tag",
            "utc aw741566034",
            "utc redirection",
            "asnone united",
            "as54113",
            "cname",
            "script urls",
            "as19527 google",
            "as35280 acorus",
            "encrypt",
            "reverse dns",
            "location dublin",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "as4808 china",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "tulach",
            "c-67-181-73-197.hsd1.ca.comcast.net",
            "social engineering",
            "contact made by mark brian sabey",
            "contact made by o'dea",
            "benjamin c"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "NSO Group",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4655,
            "URL": 9981,
            "FileHash-MD5": 219,
            "FileHash-SHA1": 213,
            "FileHash-SHA256": 6722,
            "hostname": 4341,
            "CVE": 2,
            "email": 12,
            "BitcoinAddress": 3
          },
          "indicator_count": 26148,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbadc21b9891c459b9d2",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:13.975000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9995,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25999,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b5cbbbcb7a479db222f053",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
          "modified": "2024-03-27T00:05:34.925000",
          "created": "2024-01-28T03:36:27.745000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 2,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4226,
            "URL": 9996,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6882,
            "hostname": 4402,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 26000,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "795 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80944a3d1c9e36346e0c1",
          "name": "NSO Group Pegasus spyware used nefariously",
          "description": "",
          "modified": "2024-02-27T03:01:21.421000",
          "created": "2024-01-29T20:23:32.737000",
          "tags": [
            "whois record",
            "ssl certificate",
            "threat roundup",
            "october",
            "august",
            "september",
            "november",
            "april",
            "march",
            "tsara brashears",
            "copy",
            "execution",
            "metro",
            "awful",
            "attack",
            "quasar",
            "malicious",
            "crypto",
            "contact",
            "contacted",
            "pe resource",
            "communicating",
            "pegasus",
            "bundled",
            "historical ssl",
            "cellbrite",
            "core",
            "startpage",
            "ursnif",
            "amadey",
            "probe",
            "targets sa",
            "survivor",
            "referrer",
            "whois whois",
            "whois ssl",
            "apple",
            "status",
            "creation date",
            "passive dns",
            "urls",
            "search",
            "expiration date",
            "name servers",
            "scan endpoints",
            "all octoseek",
            "pulse submit",
            "date",
            "next",
            "et exploit",
            "probe ms17010",
            "smbds ipc",
            "show",
            "service",
            "entries",
            "msf style",
            "generic flags",
            "pe32",
            "exploit",
            "malware",
            "dock",
            "push",
            "write",
            "win32",
            "eternalblue",
            "playgame",
            "bitcoin",
            "virgin islands",
            "as19905",
            "record value",
            "unknown",
            "body",
            "meta",
            "error",
            "united",
            "as7922 comcast",
            "x ua",
            "ipv4",
            "pulse pulses",
            "files",
            "moved",
            "title",
            "gmt content",
            "cookie",
            "as15169 google",
            "mtb jan",
            "otx telemetry",
            "query",
            "trojan",
            "msr jan",
            "as29580 a1",
            "domain",
            "showing",
            "as8866",
            "cellebrite",
            "aaaa",
            "russia unknown",
            "dnssec",
            "nxdomain",
            "a domains",
            "download",
            "accept",
            "url https",
            "http",
            "ip address",
            "related nids",
            "files location",
            "ios",
            "ireland",
            "servers",
            "as4808 china",
            "china",
            "reverse dns",
            "asnone united",
            "as54113",
            "cname",
            "domain name",
            "emails",
            "as23724",
            "as4812 china",
            "win32mydoom jan",
            "ransom",
            "worm",
            "browse scan",
            "endpoints all",
            "login",
            "sign up",
            "cellebrite",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "server",
            "domain status",
            "registrar abuse",
            "whois lookup",
            "contact email",
            "contact phone",
            "popularity",
            "rank position",
            "ingestion time",
            "cisco umbrella",
            "record type",
            "ttl value",
            "sa victim",
            "assaulter",
            "privilege https",
            "tulach"
          ],
          "references": [
            "enterprise.cellebrite.com [ digitalclues.com]",
            "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
            "https://tulach.cc/ [malware engineering | phishing]",
            "deviceinbox.com [malware hosting]",
            "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
            "https://timersys.com/ [ phishing | deb opera.com]",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
            "message.htm.com [ message stealer]",
            "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
            "https://www.nsogroup.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
            "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
            "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
            "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
            "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
            "training001.blackbagtech.com [opportunity?]",
            "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
            "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
            "Tracking: 8.8.4.4 [ NOT a false.positive]",
            "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
            "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Germany",
            "Virgin Islands, British"
          ],
          "malware_families": [
            {
              "id": "Amadey",
              "display_name": "Amadey",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Backdoor:Win32/Mydoom",
              "display_name": "Backdoor:Win32/Mydoom",
              "target": "/malware/Backdoor:Win32/Mydoom"
            },
            {
              "id": "ETERNALBLUE",
              "display_name": "ETERNALBLUE",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1158",
              "name": "Hidden Files and Directories",
              "display_name": "T1158 - Hidden Files and Directories"
            }
          ],
          "industries": [
            "Civil Society",
            "Healthcare"
          ],
          "TLP": "green",
          "cloned_from": "65b5cbbbcb7a479db222f053",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 4174,
            "URL": 9617,
            "FileHash-MD5": 241,
            "FileHash-SHA1": 235,
            "FileHash-SHA256": 6801,
            "hostname": 4314,
            "CVE": 2,
            "email": 13,
            "BitcoinAddress": 3
          },
          "indicator_count": 25400,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "824 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://tulach.cc/ [malware engineering | phishing]",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "enterprise.cellebrite.com [ digitalclues.com]",
        "training001.blackbagtech.com [opportunity?]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "https://www.nsogroup.com",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all.",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "message.htm.com [ message stealer]",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "deviceinbox.com [malware hosting]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "NSO Group"
          ],
          "malware_families": [
            "Tulach",
            "Quasar rat",
            "Pegasus",
            "Amadey",
            "Eternalblue",
            "Backdoor:win32/mydoom"
          ],
          "industries": [
            "Healthcare",
            "Civil society",
            "Legal, financial, healthcare, government, municipal, real-estate, enterprise-technology, critical-in"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "69a02837827feb0b78fa3ad2",
      "name": "The Belasco Chain",
      "description": "The adversary delivers a masterclass in \"Regular Belasco\" stagecraft, utilizing authentic Adobe PIDs to construct a \"living library\" of legitimacy where mundane metadata like SOPHIA.json acts as Gatsby\u2019s \"real but uncut\" volumes to mask a hollowed-out interior. This is a triumph of performative evasion; while researchers marvel at the realism of the set-dressing, MSI50B8.tmp and MSI4F2F.tmp wait in the wings of the Windows\\Installer directory, invisible to the human eye and using NGEN hijacking to bake illicit scripts directly into the OS framework. By employing Cryptnet certificates as \"stage lighting\" to mask C2 handshakes, the malware doesn't just attend the system\u2019s party\u2014it rewrites the invitation to own the house. Unlike the tragic end at West Egg, this Belasco chain is a play that refuses to end; it simply resets the stage, ensuring the performance continues as long as the \"green light\" of the C2 remains active.",
      "modified": "2026-05-31T01:02:14",
      "created": "2026-02-26T11:02:15.932000",
      "tags": [
        "file size",
        "mwdb",
        "bazaar",
        "sha3384",
        "ssdeep",
        "file type",
        "sha1",
        "sha256",
        "crc32",
        "filenames c"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2813,
        "FileHash-SHA1": 2576,
        "FileHash-SHA256": 8145,
        "domain": 1903,
        "hostname": 1502,
        "URL": 1359,
        "email": 46,
        "CVE": 54,
        "CIDR": 3,
        "YARA": 7,
        "JA3": 1,
        "IPv4": 11
      },
      "indicator_count": 18420,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 74,
      "modified_text": "4 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "698e93e1ab02db8c49e8c3ed",
      "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)",
      "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.",
      "modified": "2026-05-17T15:52:35.396000",
      "created": "2026-02-13T03:00:49.872000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr",
        "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 28000,
        "FileHash-SHA256": 48374,
        "FileHash-MD5": 42596,
        "FileHash-SHA1": 23243,
        "hostname": 35654,
        "URL": 75758,
        "SSLCertFingerprint": 30,
        "CVE": 7585,
        "email": 316,
        "FileHash-IMPHASH": 8,
        "CIDR": 26205,
        "JA3": 1,
        "URI": 5,
        "IPv4": 574,
        "Mutex": 1
      },
      "indicator_count": 288350,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 92,
      "modified_text": "13 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf64e1d5e06aa6207f78de",
      "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
      "description": "",
      "modified": "2026-03-27T00:30:39.055000",
      "created": "2026-03-22T03:41:21.863000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": "698e93e1ab02db8c49e8c3ed",
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 27572,
        "FileHash-SHA256": 46076,
        "FileHash-MD5": 42177,
        "FileHash-SHA1": 22874,
        "hostname": 33438,
        "URL": 74810,
        "SSLCertFingerprint": 21,
        "CVE": 7579,
        "email": 297,
        "FileHash-IMPHASH": 8,
        "CIDR": 26203,
        "JA3": 1
      },
      "indicator_count": 281056,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 149,
      "modified_text": "65 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69bf64eccb5d39a90a3c391e",
      "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos",
      "description": "",
      "modified": "2026-03-27T00:30:39.055000",
      "created": "2026-03-22T03:41:32.565000",
      "tags": [
        "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi",
        "9698f46495ce9401c8bcaf9a2afe1598",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)",
        "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71",
        "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link",
        "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)"
      ],
      "references": [
        "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.",
        "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)",
        "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.",
        "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure",
        "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess",
        "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.",
        "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.",
        "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)",
        "Verification failure observed in automated verification handlers during sandbox replay.",
        "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.",
        "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.",
        "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.",
        "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.",
        "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).",
        "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.",
        "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.",
        "Whitelisted IP Address 204.79.197.212 Location  United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. ,  ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc.,   Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 ,  5943 ,  80211 ,  #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf ,  The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat",
        "",
        "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "China",
        "United States of America",
        "Spain",
        "Japan",
        "Canada"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In"
      ],
      "TLP": "green",
      "cloned_from": "698e93e1ab02db8c49e8c3ed",
      "export_count": 4,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 27572,
        "FileHash-SHA256": 46076,
        "FileHash-MD5": 42177,
        "FileHash-SHA1": 22874,
        "hostname": 33438,
        "URL": 74810,
        "SSLCertFingerprint": 21,
        "CVE": 7579,
        "email": 297,
        "FileHash-IMPHASH": 8,
        "CIDR": 26203,
        "JA3": 1
      },
      "indicator_count": 281056,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 152,
      "modified_text": "65 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5c5ebba25ca46fc5b36bc",
      "name": "NSO Group Pegasus spyware found attack a US citizen. Silencing",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\n\u2022NSO Group develops best-in-class technology to help government agencies detect and prevent terrorism and crime.\n\u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. \nNon terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:11:39.752000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "msie",
        "chrome",
        "certificate",
        "hostname",
        "url analysis",
        "http response",
        "final url",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers date",
        "connection",
        "date sat",
        "html info",
        "forbidden",
        "google tag",
        "utc aw741566034",
        "utc redirection",
        "asnone united",
        "as54113",
        "cname",
        "script urls",
        "as19527 google",
        "as35280 acorus",
        "encrypt",
        "reverse dns",
        "location dublin",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "as4808 china",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "tulach",
        "c-67-181-73-197.hsd1.ca.comcast.net",
        "social engineering",
        "contact made by mark brian sabey",
        "contact made by o'dea",
        "benjamin c"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "NSO Group",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4655,
        "URL": 9981,
        "FileHash-MD5": 219,
        "FileHash-SHA1": 213,
        "FileHash-SHA256": 6722,
        "hostname": 4341,
        "CVE": 2,
        "email": 12,
        "BitcoinAddress": 3
      },
      "indicator_count": 26148,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbadc21b9891c459b9d2",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:13.975000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9995,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25999,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b5cbbbcb7a479db222f053",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "\u2022 Cellebrite Empowers Law Enforcement Agencies with The Leading Digital Forensic Solutions\ngovernment agencies detect and prevent terrorism and crime. \u2022Pegasus reveals all to the NSO customers who control it \u2014 text messages, photos, emails, videos, contact lists \u2014 and can record phone calls. Non terrorist. Assaulted in physical therapy. Critically injurer. Immediate cyber attacks including NSO Group. Very dangerous. Unsuspected interaction with bad actors is a thing.",
      "modified": "2024-03-27T00:05:34.925000",
      "created": "2024-01-28T03:36:27.745000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 31,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 2,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4226,
        "URL": 9996,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6882,
        "hostname": 4402,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 26000,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "795 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80944a3d1c9e36346e0c1",
      "name": "NSO Group Pegasus spyware used nefariously",
      "description": "",
      "modified": "2024-02-27T03:01:21.421000",
      "created": "2024-01-29T20:23:32.737000",
      "tags": [
        "whois record",
        "ssl certificate",
        "threat roundup",
        "october",
        "august",
        "september",
        "november",
        "april",
        "march",
        "tsara brashears",
        "copy",
        "execution",
        "metro",
        "awful",
        "attack",
        "quasar",
        "malicious",
        "crypto",
        "contact",
        "contacted",
        "pe resource",
        "communicating",
        "pegasus",
        "bundled",
        "historical ssl",
        "cellbrite",
        "core",
        "startpage",
        "ursnif",
        "amadey",
        "probe",
        "targets sa",
        "survivor",
        "referrer",
        "whois whois",
        "whois ssl",
        "apple",
        "status",
        "creation date",
        "passive dns",
        "urls",
        "search",
        "expiration date",
        "name servers",
        "scan endpoints",
        "all octoseek",
        "pulse submit",
        "date",
        "next",
        "et exploit",
        "probe ms17010",
        "smbds ipc",
        "show",
        "service",
        "entries",
        "msf style",
        "generic flags",
        "pe32",
        "exploit",
        "malware",
        "dock",
        "push",
        "write",
        "win32",
        "eternalblue",
        "playgame",
        "bitcoin",
        "virgin islands",
        "as19905",
        "record value",
        "unknown",
        "body",
        "meta",
        "error",
        "united",
        "as7922 comcast",
        "x ua",
        "ipv4",
        "pulse pulses",
        "files",
        "moved",
        "title",
        "gmt content",
        "cookie",
        "as15169 google",
        "mtb jan",
        "otx telemetry",
        "query",
        "trojan",
        "msr jan",
        "as29580 a1",
        "domain",
        "showing",
        "as8866",
        "cellebrite",
        "aaaa",
        "russia unknown",
        "dnssec",
        "nxdomain",
        "a domains",
        "download",
        "accept",
        "url https",
        "http",
        "ip address",
        "related nids",
        "files location",
        "ios",
        "ireland",
        "servers",
        "as4808 china",
        "china",
        "reverse dns",
        "asnone united",
        "as54113",
        "cname",
        "domain name",
        "emails",
        "as23724",
        "as4812 china",
        "win32mydoom jan",
        "ransom",
        "worm",
        "browse scan",
        "endpoints all",
        "login",
        "sign up",
        "cellebrite",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "server",
        "domain status",
        "registrar abuse",
        "whois lookup",
        "contact email",
        "contact phone",
        "popularity",
        "rank position",
        "ingestion time",
        "cisco umbrella",
        "record type",
        "ttl value",
        "sa victim",
        "assaulter",
        "privilege https",
        "tulach"
      ],
      "references": [
        "enterprise.cellebrite.com [ digitalclues.com]",
        "http://www.pegasustech.net/Pegasustechnology/ProductDetails.aspx?pid=Pegasus RIMS",
        "https://tulach.cc/ [malware engineering | phishing]",
        "deviceinbox.com [malware hosting]",
        "http://auditrage.top/Rossmaansywh/tb.php?wmtvjltu",
        "https://timersys.com/ [ phishing | deb opera.com]",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [malware | evader]",
        "message.htm.com [ message stealer]",
        "https://www.nsogroup.com/governance/whistleblower-policies/ [ Attacking whistle blower. PT documentedly assaulted and injured patient. PMD blew whistle warning PT]",
        "https://www.nsogroup.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [ Tracking BotNetwork malvertizing SA victims name. His name was Jeffrey Scott Reimer DPT, changed after causing SCI]",
        "https://pin.it/ [ Pegasus Pinterest. Collecting everything Tsara does ]",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [ Enters through apple music app.]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Password cracker ios unlocker | made you look tactics]",
        "Libel. Brashears confirms straight status. Has never been with a female. Advocates humane rights for all. Matthew Shepard Lives on.",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ Data collection]",
        "https://www.blackbagtech.com/wp-content/uploads/2020/04/BlackLight-QuickStart-Guide-v2020R1.pdf",
        "https://lawlink.com/documents/10935/blackbag-technologies-announces-new-release-of-blacklight-forensic-software [wildly abused by Mark Brian Sabey \u2022 HallRender.com & others]",
        "training001.blackbagtech.com [opportunity?]",
        "https://otx.alienvault.com/indicator/hostname/apptree.comcast.net",
        "nr-data.net [Apple Private Data Collection] data.net points to aps.net",
        "Tracking: 8.8.4.4 [ NOT a false.positive]",
        "https://api.hireez.com/webhooks/tracking-v2/click/46ecdc52-c791-4f1f-8167-c0cfd752727b",
        "Found in malicious DGA domain of Law Firm | c-67-181-73-197.hsd1.ca.comcast.net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Germany",
        "Virgin Islands, British"
      ],
      "malware_families": [
        {
          "id": "Amadey",
          "display_name": "Amadey",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Backdoor:Win32/Mydoom",
          "display_name": "Backdoor:Win32/Mydoom",
          "target": "/malware/Backdoor:Win32/Mydoom"
        },
        {
          "id": "ETERNALBLUE",
          "display_name": "ETERNALBLUE",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1158",
          "name": "Hidden Files and Directories",
          "display_name": "T1158 - Hidden Files and Directories"
        }
      ],
      "industries": [
        "Civil Society",
        "Healthcare"
      ],
      "TLP": "green",
      "cloned_from": "65b5cbbbcb7a479db222f053",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 4174,
        "URL": 9617,
        "FileHash-MD5": 241,
        "FileHash-SHA1": 235,
        "FileHash-SHA256": 6801,
        "hostname": 4314,
        "CVE": 2,
        "email": 13,
        "BitcoinAddress": 3
      },
      "indicator_count": 25400,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "824 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "420willienelsonblvd.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "420willienelsonblvd.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780204559.6879396
}