{
  "type": "Domain",
  "indicator": "asteroidofbethlehem.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/asteroidofbethlehem.com",
    "alexa": "http://www.alexa.com/siteinfo/asteroidofbethlehem.com",
    "indicator": "asteroidofbethlehem.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2900570156,
      "indicator": "asteroidofbethlehem.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 8,
      "pulses": [
        {
          "id": "6a056cacb981e6f3b2dd4647",
          "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
          "description": "",
          "modified": "2026-05-14T07:28:01.780000",
          "created": "2026-05-14T06:33:16.946000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb3ef6d765187a437767e4",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1521,
            "FileHash-SHA1": 1395,
            "FileHash-SHA256": 6084,
            "URL": 1499,
            "domain": 1947,
            "hostname": 1361,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13826,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6a056cac80d9b80eb1a97e29",
          "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
          "description": "",
          "modified": "2026-05-14T07:14:09.098000",
          "created": "2026-05-14T06:33:16.505000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "66eb3ef6d765187a437767e4",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1493,
            "FileHash-SHA1": 1393,
            "FileHash-SHA256": 5881,
            "URL": 1499,
            "domain": 1947,
            "hostname": 1360,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13592,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "18 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69116f89c600907a25e6b397",
          "name": "GoBrut Service Bruter CnC Activity  \u2022 TAM Legal \u2022 Christopher P. Ahmann",
          "description": "Malicious attacks from Special Counsel criminal attorney defending Jeffrey Scott Reimer and Concentra against and on premises vicious SA. Caused grate bodily injury. Christopher P. Ahmann and Hall\nRender (down the street) Palantir has been harassing , working 24/7 at silencing one crime victim. I\u2019m sure there are more because we thwarted an attempt in 2018. \n\nHitman hired. You couldn\u2019t believe manpower and cyber attacks one family has been through. They attack the Large Loss clients.",
          "modified": "2025-12-10T04:02:00.145000",
          "created": "2025-11-10T04:52:25.542000",
          "tags": [
            "united",
            "ipv4",
            "america asn",
            "asn as397241",
            "neustar",
            "united states",
            "ubuntu",
            "linux x8664",
            "gobrut service",
            "bruter cnc",
            "activity",
            "malware",
            "present mar",
            "present oct",
            "present jun",
            "brazil",
            "present jul",
            "present feb",
            "present nov",
            "moved",
            "a domains",
            "win64",
            "alfper",
            "ransom",
            "script urls",
            "bank",
            "trojan",
            "win32",
            "meta",
            "path",
            "read c",
            "port",
            "destination",
            "delete",
            "write",
            "persistence",
            "execution",
            "generic",
            "hostile",
            "cookie",
            "suspicious",
            "e ee",
            "epeq",
            "efjeg",
            "eebe",
            "e ge",
            "eveoe6ee",
            "elem",
            "e ie",
            "eieeieeie",
            "jea ebjecedjee",
            "ipv4 add",
            "files",
            "reverse dns",
            "america flag",
            "msie",
            "chrome",
            "title",
            "h1 center",
            "gmt content",
            "unknown ns",
            "ip address",
            "for privacy",
            "icedid",
            "bokbot",
            "united states",
            "div div",
            "link",
            "amazon web",
            "a li",
            "click",
            "span",
            "unknown aaaa",
            "record value",
            "apache x",
            "asn as398101",
            "hosting",
            "twitter",
            "present may",
            "present jan",
            "error",
            "present sep",
            "url analysis",
            "passive dns",
            "urls",
            "less whois",
            "registrar",
            "criminal defense",
            "quasi gov",
            "tam legal",
            "monitored target",
            "p",
            "amazon",
            "apple",
            "japan unknown",
            "license",
            "expiresmon",
            "gmt path",
            "html",
            "tokyo",
            "show",
            "unknown",
            "tracking",
            "germany unknown",
            "bq nov",
            "virtool",
            "germany asn",
            "as47846",
            "cyber attacks",
            "christopher",
            "ahmann",
            "pulse pulses",
            "location united",
            "dns resolutions",
            "domains top",
            "hitmen",
            "hall",
            "hall render",
            "telper",
            "hostname add",
            "pulse submit",
            "domain",
            "files ip",
            "address",
            "yara detections",
            "contacted",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "detections elf",
            "lowfi",
            "entries",
            "win32midia",
            "next associated",
            "trojanclicker",
            "win32ellell jan",
            "date"
          ],
          "references": [
            "Tam Legal \u2022 Christopher P. Ahmann Esq Cyber Criminal",
            "GoBrut Service Bruter CnC Activity",
            "interface.xpacemobilitycloud.com",
            "103.224.182.243 ghdukshop.com lb-182-243.above.comAustraliaCOUNTRYAS133618 trellian pty. limited",
            "http://pornsure.com/ \u2022  http://www.kittipornfiberglass.com/ \u2022  kittipornfiberglass.com \u2022 pornsure.com",
            "http://colorado-realestate-finder.com/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "TrojanDownloader:Linux/Morila",
              "display_name": "TrojanDownloader:Linux/Morila",
              "target": "/malware/TrojanDownloader:Linux/Morila"
            },
            {
              "id": "Gafgyt",
              "display_name": "Gafgyt",
              "target": null
            },
            {
              "id": "ELF:Agent-VW\\ [Trj]",
              "display_name": "ELF:Agent-VW\\ [Trj]",
              "target": null
            },
            {
              "id": "Win32:IcedID-E\\ [Bank]",
              "display_name": "Win32:IcedID-E\\ [Bank]",
              "target": null
            },
            {
              "id": "Win64:MalwareX-gen\\ [Trj]",
              "display_name": "Win64:MalwareX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Ransom:Win32/ContiCrypt",
              "display_name": "Ransom:Win32/ContiCrypt",
              "target": "/malware/Ransom:Win32/ContiCrypt"
            },
            {
              "id": "ALFPER:RefLoadApiHash",
              "display_name": "ALFPER:RefLoadApiHash",
              "target": null
            },
            {
              "id": "Win64:CrypterX-gen\\ [Trj]",
              "display_name": "Win64:CrypterX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Win64:BotX-gen\\ [Trj]",
              "display_name": "Win64:BotX-gen\\ [Trj]",
              "target": null
            },
            {
              "id": "Bank",
              "display_name": "Bank",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Exploit:Win32/CVE-2017-0147",
              "display_name": "Exploit:Win32/CVE-2017-0147",
              "target": "/malware/Exploit:Win32/CVE-2017-0147"
            },
            {
              "id": "Win.Trojan.Agent",
              "display_name": "Win.Trojan.Agent",
              "target": null
            },
            {
              "id": "AutoRun",
              "display_name": "AutoRun",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-316098",
              "display_name": "Win.Trojan.Agent-316098",
              "target": null
            },
            {
              "id": "virtool:Win32/Injector.gen!BQ",
              "display_name": "virtool:Win32/Injector.gen!BQ",
              "target": "/malware/virtool:Win32/Injector.gen!BQ"
            }
          ],
          "attack_ids": [
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 3031,
            "email": 8,
            "hostname": 1840,
            "FileHash-SHA256": 1015,
            "URL": 4792,
            "FileHash-MD5": 441,
            "FileHash-SHA1": 432,
            "SSLCertFingerprint": 9,
            "CVE": 1
          },
          "indicator_count": 11569,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "173 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "66eb3ef6d765187a437767e4",
          "name": "Hijacked 'Operation Endgame' Tofsee  Ransomware",
          "description": "This a project. A target has been put into  different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT  get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click'  document.. Faldif0, empty docmpty doc, citing  it was refreshed in 2023. \nThere is no doubt these  masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely.  Attack is disseminates from USA.",
          "modified": "2024-10-18T20:04:41.836000",
          "created": "2024-09-18T20:58:30.691000",
          "tags": [
            "as8075",
            "united",
            "pid425870621",
            "tid700443057",
            "tpid425870621",
            "slot1",
            "mascore2",
            "bcnt1",
            "unid88000705",
            "nct1",
            "date",
            "china",
            "china unknown",
            "passive dns",
            "body xml",
            "error code",
            "requestid",
            "hostid ec",
            "server",
            "gmt content",
            "type",
            "registry",
            "intel",
            "ms windows",
            "show",
            "entries",
            "search",
            "high",
            "pe32",
            "high process",
            "injection t1055",
            "salicode",
            "worm",
            "copy",
            "tools",
            "service",
            "write",
            "win32",
            "persistence",
            "execution",
            "april",
            "urls",
            "http",
            "unique",
            "scan endpoints",
            "all scoreblue",
            "url http",
            "pulse pulses",
            "ip address",
            "related nids",
            "code",
            "as54113",
            "unknown",
            "body",
            "fastly error",
            "please",
            "sea p",
            "msil",
            "accept",
            "aaaa",
            "nxdomain",
            "whitelisted",
            "as15169 google",
            "status",
            "as44273 host",
            "as46691",
            "domain",
            "url https",
            "files location",
            "info",
            "script urls",
            "path max",
            "age86400 set",
            "cookie",
            "script domains",
            "javascript",
            "script script",
            "trojanspy",
            "cname",
            "emails",
            "servers",
            "all search",
            "related pulses",
            "file samples",
            "files matching",
            "creation date",
            "germany unknown",
            "yara detections",
            "filehash",
            "av detections",
            "ids detections",
            "alerts",
            "analysis date",
            "file score",
            "meta",
            "home welcome",
            "write c",
            "delete c",
            "query",
            "local",
            "hostname",
            "a domains",
            "lowfi",
            "content type",
            "record value",
            "suite",
            "showing",
            "asnone united",
            "as29873",
            "ipv4",
            "pulse submit",
            "url analysis",
            "files",
            "pe32 executable",
            "potential scan",
            "0pgtwhu",
            "t1045",
            "port",
            "infection",
            "recon",
            "malware",
            "june",
            "delphi",
            "taobao network",
            "as45102 alibaba",
            "as4812 china",
            "next",
            "expiration date",
            "name servers",
            "dynamicloader",
            "dynamic",
            "sha256",
            "dynamic link",
            "library exe",
            "adobe",
            "incorporated",
            "read",
            "yara rule",
            "delete",
            "binary file",
            "push",
            "malicious",
            "july",
            "iocs",
            "levelbluelabs",
            "jeff4son",
            "adversaries",
            "registry run",
            "flow t1574",
            "dll sideloading",
            "boot",
            "logon autostart",
            "execution t1547",
            "keys",
            "startup folder",
            "t1497 may",
            "encryption",
            "catalog tree",
            "analysis ob0001",
            "virtual machine",
            "detection b0009",
            "check registry",
            "analysis ob0002",
            "executable code",
            "stack strings",
            "control ob0004",
            "get http",
            "http requests",
            "dns resolutions",
            "ip traffic",
            "pattern domains",
            "memory pattern",
            "urls http",
            "request",
            "response",
            "connection",
            "trojan",
            "otx scoreblue",
            "windows",
            "embeddedwb",
            "medium",
            "shellexecuteexw",
            "msie",
            "windows nt",
            "displayname",
            "tofsee",
            "hashes",
            "vhash",
            "authentihash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "library",
            "read c",
            "file guard",
            "rtversion",
            "langchinese",
            "legalcopyright",
            "reserved",
            "ransom",
            "moved",
            "media",
            "ascii text",
            "default",
            "upack",
            "mike",
            "contacted",
            "x87xe1x1d",
            "regsetvalueexa",
            "x95xd3xa4",
            "regbinary",
            "x84xa8xe8i",
            "x8dxb7xb7",
            "hx88x9ax1e",
            "mx81xd1r",
            "x92xac",
            "xc2x84",
            "stream",
            "swipper",
            "pdfcreator.sf.net",
            "botnet",
            "black mercedes",
            "please forgive me",
            "therahand thouroughhand"
          ],
          "references": [
            "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
            "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
            "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
            "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
            "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
            "compromised_site_redirector_fromcharcode fromCharCode",
            "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
            "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
            "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
            "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
            "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
            "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
            "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
            "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Worm:Win32/Macoute.A",
              "display_name": "Worm:Win32/Macoute.A",
              "target": "/malware/Worm:Win32/Macoute.A"
            },
            {
              "id": "TrojanDownloader:Win32/Nemucod",
              "display_name": "TrojanDownloader:Win32/Nemucod",
              "target": "/malware/TrojanDownloader:Win32/Nemucod"
            },
            {
              "id": "TrojanSpy:Win32/Nivdort",
              "display_name": "TrojanSpy:Win32/Nivdort",
              "target": "/malware/TrojanSpy:Win32/Nivdort"
            },
            {
              "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
              "target": null
            },
            {
              "id": "Worm:Win32/Fesber.A",
              "display_name": "Worm:Win32/Fesber.A",
              "target": "/malware/Worm:Win32/Fesber.A"
            },
            {
              "id": "Ransom:Win32/Eniqma.A",
              "display_name": "Ransom:Win32/Eniqma.A",
              "target": "/malware/Ransom:Win32/Eniqma.A"
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "UpackV037Dwing",
              "display_name": "UpackV037Dwing",
              "target": null
            },
            {
              "id": "Cryp_Xed-12",
              "display_name": "Cryp_Xed-12",
              "target": null
            },
            {
              "id": "Mal/Generic-S",
              "display_name": "Mal/Generic-S",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1018",
              "name": "Remote System Discovery",
              "display_name": "T1018 - Remote System Discovery"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1096",
              "name": "NTFS File Attributes",
              "display_name": "T1096 - NTFS File Attributes"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 29,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1493,
            "FileHash-SHA1": 1393,
            "FileHash-SHA256": 5881,
            "URL": 1495,
            "domain": 1947,
            "hostname": 1360,
            "email": 18,
            "CVE": 1
          },
          "indicator_count": 13588,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "590 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a39f005c7f0a1c1eb33125",
          "name": "Formbook",
          "description": "FormBook is a data stealer that is being distributed as a MaaS. FormBook is available in the dark web market as a Malware-as-Service.\n I n known situations targets were contacted by bad actors  via social media accounts Twitter & Facebook.",
          "modified": "2024-03-21T10:00:24.070000",
          "created": "2024-01-14T08:44:48.297000",
          "tags": [
            "ssl certificate",
            "contacted",
            "execution",
            "ah6itbtgl",
            "whois record",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "formbook",
            "threat roundup",
            "malware",
            "metro",
            "social engineering",
            "jansky",
            "script urls",
            "a domains",
            "united",
            "search",
            "date",
            "script domains",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "meta",
            "body",
            "encrypt",
            "as63949 linode",
            "as41357",
            "united kingdom",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse submit",
            "url analysis",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "email",
            "registry domain",
            "win32 exe",
            "javascript",
            "eqsray",
            "zip blaze",
            "ms excel",
            "detections type",
            "name",
            "text",
            "csv order",
            "files",
            "microsoft",
            "dns replication",
            "bt6lcuigydc9yc",
            "jxaavf4jnzza0",
            "submission",
            "community score",
            "no security",
            "graph api",
            "status",
            "content type",
            "xcitium verdict",
            "cloud marketing",
            "history first",
            "thebrotherssabey",
            "passive dns",
            "gmt content",
            "plesklin",
            "ipv4",
            "pulse pulses",
            "urls",
            "vbs",
            "data center",
            "reverse dns",
            "first",
            "utc submissions",
            "submitters",
            "bbonline uk",
            "namecheap inc",
            "summary iocs",
            "graph community",
            "ionos se",
            "keysystems gmbh",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "sabey",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "hostname",
            "files domain",
            "msie",
            "chrome",
            "expiration date",
            "next",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "cname",
            "as44273 host",
            "ip address"
          ],
          "references": [
            "appleremote.net",
            "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
            "FormBook",
            "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
            "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1708,
            "hostname": 1920,
            "domain": 2221,
            "URL": 4822,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 119,
            "email": 2,
            "CIDR": 1
          },
          "indicator_count": 10893,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "802 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a4880cf26f0feaf9a75648",
          "name": "Formbook",
          "description": "",
          "modified": "2024-02-13T08:03:20.064000",
          "created": "2024-01-15T01:19:08.041000",
          "tags": [
            "ssl certificate",
            "contacted",
            "execution",
            "ah6itbtgl",
            "whois record",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "formbook",
            "threat roundup",
            "malware",
            "metro",
            "social engineering",
            "jansky",
            "script urls",
            "a domains",
            "united",
            "search",
            "date",
            "script domains",
            "creation date",
            "record value",
            "showing",
            "unknown",
            "meta",
            "body",
            "encrypt",
            "as63949 linode",
            "as41357",
            "united kingdom",
            "scan endpoints",
            "all octoseek",
            "domain",
            "pulse submit",
            "url analysis",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "domain status",
            "registrar url",
            "registrar whois",
            "email",
            "registry domain",
            "win32 exe",
            "javascript",
            "eqsray",
            "zip blaze",
            "ms excel",
            "detections type",
            "name",
            "text",
            "csv order",
            "files",
            "microsoft",
            "dns replication",
            "bt6lcuigydc9yc",
            "jxaavf4jnzza0",
            "submission",
            "community score",
            "no security",
            "graph api",
            "status",
            "content type",
            "xcitium verdict",
            "cloud marketing",
            "history first",
            "thebrotherssabey",
            "passive dns",
            "gmt content",
            "plesklin",
            "ipv4",
            "pulse pulses",
            "urls",
            "vbs",
            "data center",
            "reverse dns",
            "first",
            "utc submissions",
            "submitters",
            "bbonline uk",
            "namecheap inc",
            "summary iocs",
            "graph community",
            "ionos se",
            "keysystems gmbh",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus cnr3",
            "olet",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "sabey",
            "all search",
            "otx octoseek",
            "url http",
            "http",
            "hostname",
            "files domain",
            "msie",
            "chrome",
            "expiration date",
            "next",
            "whois lookup",
            "dnssec",
            "domain name",
            "abuse contact",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "usage",
            "x509v3 extended",
            "info",
            "cname",
            "as44273 host",
            "ip address"
          ],
          "references": [
            "appleremote.net",
            "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
            "FormBook",
            "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
            "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
            "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "FormBook",
              "display_name": "FormBook",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65a39f005c7f0a1c1eb33125",
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1650,
            "hostname": 1778,
            "domain": 2102,
            "URL": 4435,
            "FileHash-MD5": 100,
            "FileHash-SHA1": 119,
            "email": 2,
            "CIDR": 1
          },
          "indicator_count": 10187,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "839 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65707dbbb0493c03ba107643",
          "name": "loggly.com and pstv.com/ supernetforme.com live malware",
          "description": "",
          "modified": "2023-12-06T13:57:15.377000",
          "created": "2023-12-06T13:57:15.377000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 1,
            "FileHash-SHA256": 1933,
            "domain": 1302,
            "hostname": 805,
            "URL": 3593,
            "FileHash-MD5": 1
          },
          "indicator_count": 7635,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "907 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "61f9b4b2c6c645e9839112b2",
          "name": "loggly.com and pstv.com/ supernetforme.com live malware",
          "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com",
          "modified": "2022-03-04T00:00:56.902000",
          "created": "2022-02-01T22:31:14.017000",
          "tags": [
            "irst seen",
            "date",
            "file sha256",
            "network related",
            "malicious",
            "found"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "dorkingbeauty1",
            "id": "80137",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3593,
            "FileHash-SHA256": 1933,
            "hostname": 805,
            "domain": 1302,
            "FileHash-MD5": 1,
            "CVE": 1
          },
          "indicator_count": 7635,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 398,
          "modified_text": "1550 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "FormBook",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "interface.xpacemobilitycloud.com",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL",
        "appleremote.net",
        "http://colorado-realestate-finder.com/",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "GoBrut Service Bruter CnC Activity",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "103.224.182.243 ghdukshop.com lb-182-243.above.comAustraliaCOUNTRYAS133618 trellian pty. limited",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "Tam Legal \u2022 Christopher P. Ahmann Esq Cyber Criminal",
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://pornsure.com/ \u2022  http://www.kittipornfiberglass.com/ \u2022  kittipornfiberglass.com \u2022 pornsure.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Tofsee",
            "Worm:win32/macoute.a",
            "Trojandownloader:linux/morila",
            "Gafgyt",
            "Elf:agent-vw\\ [trj]",
            "Ransom:win32/conticrypt",
            "Alf:heraklezeval:rogue:win32/fakerean",
            "Formbook",
            "Win.trojan.agent",
            "Mal/generic-s",
            "Other malware",
            "Ransom:win32/eniqma.a",
            "Trojanspy:win32/nivdort",
            "Exploit:win32/cve-2017-0147",
            "Win32:icedid-e\\ [bank]",
            "Alfper:refloadapihash",
            "Win64:botx-gen\\ [trj]",
            "Win64:crypterx-gen\\ [trj]",
            "Upackv037dwing",
            "Worm:win32/fesber.a",
            "Cryp_xed-12",
            "Autorun",
            "Win64:malwarex-gen\\ [trj]",
            "Bank",
            "Trojandownloader:win32/nemucod",
            "Win.trojan.agent-316098",
            "Virtool:win32/injector.gen!bq"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 8,
  "pulses": [
    {
      "id": "6a056cacb981e6f3b2dd4647",
      "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
      "description": "",
      "modified": "2026-05-14T07:28:01.780000",
      "created": "2026-05-14T06:33:16.946000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb3ef6d765187a437767e4",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1521,
        "FileHash-SHA1": 1395,
        "FileHash-SHA256": 6084,
        "URL": 1499,
        "domain": 1947,
        "hostname": 1361,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13826,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6a056cac80d9b80eb1a97e29",
      "name": "Hijacked 'Operation Endgame' Tofsee Ransomware clone credit scoreblue",
      "description": "",
      "modified": "2026-05-14T07:14:09.098000",
      "created": "2026-05-14T06:33:16.505000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "66eb3ef6d765187a437767e4",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1493,
        "FileHash-SHA1": 1393,
        "FileHash-SHA256": 5881,
        "URL": 1499,
        "domain": 1947,
        "hostname": 1360,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13592,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "18 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69116f89c600907a25e6b397",
      "name": "GoBrut Service Bruter CnC Activity  \u2022 TAM Legal \u2022 Christopher P. Ahmann",
      "description": "Malicious attacks from Special Counsel criminal attorney defending Jeffrey Scott Reimer and Concentra against and on premises vicious SA. Caused grate bodily injury. Christopher P. Ahmann and Hall\nRender (down the street) Palantir has been harassing , working 24/7 at silencing one crime victim. I\u2019m sure there are more because we thwarted an attempt in 2018. \n\nHitman hired. You couldn\u2019t believe manpower and cyber attacks one family has been through. They attack the Large Loss clients.",
      "modified": "2025-12-10T04:02:00.145000",
      "created": "2025-11-10T04:52:25.542000",
      "tags": [
        "united",
        "ipv4",
        "america asn",
        "asn as397241",
        "neustar",
        "united states",
        "ubuntu",
        "linux x8664",
        "gobrut service",
        "bruter cnc",
        "activity",
        "malware",
        "present mar",
        "present oct",
        "present jun",
        "brazil",
        "present jul",
        "present feb",
        "present nov",
        "moved",
        "a domains",
        "win64",
        "alfper",
        "ransom",
        "script urls",
        "bank",
        "trojan",
        "win32",
        "meta",
        "path",
        "read c",
        "port",
        "destination",
        "delete",
        "write",
        "persistence",
        "execution",
        "generic",
        "hostile",
        "cookie",
        "suspicious",
        "e ee",
        "epeq",
        "efjeg",
        "eebe",
        "e ge",
        "eveoe6ee",
        "elem",
        "e ie",
        "eieeieeie",
        "jea ebjecedjee",
        "ipv4 add",
        "files",
        "reverse dns",
        "america flag",
        "msie",
        "chrome",
        "title",
        "h1 center",
        "gmt content",
        "unknown ns",
        "ip address",
        "for privacy",
        "icedid",
        "bokbot",
        "united states",
        "div div",
        "link",
        "amazon web",
        "a li",
        "click",
        "span",
        "unknown aaaa",
        "record value",
        "apache x",
        "asn as398101",
        "hosting",
        "twitter",
        "present may",
        "present jan",
        "error",
        "present sep",
        "url analysis",
        "passive dns",
        "urls",
        "less whois",
        "registrar",
        "criminal defense",
        "quasi gov",
        "tam legal",
        "monitored target",
        "p",
        "amazon",
        "apple",
        "japan unknown",
        "license",
        "expiresmon",
        "gmt path",
        "html",
        "tokyo",
        "show",
        "unknown",
        "tracking",
        "germany unknown",
        "bq nov",
        "virtool",
        "germany asn",
        "as47846",
        "cyber attacks",
        "christopher",
        "ahmann",
        "pulse pulses",
        "location united",
        "dns resolutions",
        "domains top",
        "hitmen",
        "hall",
        "hall render",
        "telper",
        "hostname add",
        "pulse submit",
        "domain",
        "files ip",
        "address",
        "yara detections",
        "contacted",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "detections elf",
        "lowfi",
        "entries",
        "win32midia",
        "next associated",
        "trojanclicker",
        "win32ellell jan",
        "date"
      ],
      "references": [
        "Tam Legal \u2022 Christopher P. Ahmann Esq Cyber Criminal",
        "GoBrut Service Bruter CnC Activity",
        "interface.xpacemobilitycloud.com",
        "103.224.182.243 ghdukshop.com lb-182-243.above.comAustraliaCOUNTRYAS133618 trellian pty. limited",
        "http://pornsure.com/ \u2022  http://www.kittipornfiberglass.com/ \u2022  kittipornfiberglass.com \u2022 pornsure.com",
        "http://colorado-realestate-finder.com/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "TrojanDownloader:Linux/Morila",
          "display_name": "TrojanDownloader:Linux/Morila",
          "target": "/malware/TrojanDownloader:Linux/Morila"
        },
        {
          "id": "Gafgyt",
          "display_name": "Gafgyt",
          "target": null
        },
        {
          "id": "ELF:Agent-VW\\ [Trj]",
          "display_name": "ELF:Agent-VW\\ [Trj]",
          "target": null
        },
        {
          "id": "Win32:IcedID-E\\ [Bank]",
          "display_name": "Win32:IcedID-E\\ [Bank]",
          "target": null
        },
        {
          "id": "Win64:MalwareX-gen\\ [Trj]",
          "display_name": "Win64:MalwareX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Ransom:Win32/ContiCrypt",
          "display_name": "Ransom:Win32/ContiCrypt",
          "target": "/malware/Ransom:Win32/ContiCrypt"
        },
        {
          "id": "ALFPER:RefLoadApiHash",
          "display_name": "ALFPER:RefLoadApiHash",
          "target": null
        },
        {
          "id": "Win64:CrypterX-gen\\ [Trj]",
          "display_name": "Win64:CrypterX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Win64:BotX-gen\\ [Trj]",
          "display_name": "Win64:BotX-gen\\ [Trj]",
          "target": null
        },
        {
          "id": "Bank",
          "display_name": "Bank",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Exploit:Win32/CVE-2017-0147",
          "display_name": "Exploit:Win32/CVE-2017-0147",
          "target": "/malware/Exploit:Win32/CVE-2017-0147"
        },
        {
          "id": "Win.Trojan.Agent",
          "display_name": "Win.Trojan.Agent",
          "target": null
        },
        {
          "id": "AutoRun",
          "display_name": "AutoRun",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-316098",
          "display_name": "Win.Trojan.Agent-316098",
          "target": null
        },
        {
          "id": "virtool:Win32/Injector.gen!BQ",
          "display_name": "virtool:Win32/Injector.gen!BQ",
          "target": "/malware/virtool:Win32/Injector.gen!BQ"
        }
      ],
      "attack_ids": [
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 3031,
        "email": 8,
        "hostname": 1840,
        "FileHash-SHA256": 1015,
        "URL": 4792,
        "FileHash-MD5": 441,
        "FileHash-SHA1": 432,
        "SSLCertFingerprint": 9,
        "CVE": 1
      },
      "indicator_count": 11569,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "173 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "66eb3ef6d765187a437767e4",
      "name": "Hijacked 'Operation Endgame' Tofsee  Ransomware",
      "description": "This a project. A target has been put into  different Operations: Project Hilo, Project Helix, Operation Endgame, The NSO Cellebrite Pegasus hit list. These are real and very serious serious threat. Severe Cyber issues made their way to her infected devices as well as the devices of family members. Death threats continue to come in. Several DoD IP addresses found in a PDF. It's unresearched at this time,, DoD via BGP HE has been questionable considering use gateway abuse by SWIPPER. \n\nStill no authority can confirm victim is a suspect. Must be a crazy high to help Jeffrey Scott Reiner PT. DPT  get away with assault in such a ridiculous manner. Court report posted online by Trellis (BS) is of course a falsified , vulnerability filled 'made you click'  document.. Faldif0, empty docmpty doc, citing  it was refreshed in 2023. \nThere is no doubt these  masqueraders mean to intimidate, humiliate, isolate & harm target. These people are not in China. False attribution is likely.  Attack is disseminates from USA.",
      "modified": "2024-10-18T20:04:41.836000",
      "created": "2024-09-18T20:58:30.691000",
      "tags": [
        "as8075",
        "united",
        "pid425870621",
        "tid700443057",
        "tpid425870621",
        "slot1",
        "mascore2",
        "bcnt1",
        "unid88000705",
        "nct1",
        "date",
        "china",
        "china unknown",
        "passive dns",
        "body xml",
        "error code",
        "requestid",
        "hostid ec",
        "server",
        "gmt content",
        "type",
        "registry",
        "intel",
        "ms windows",
        "show",
        "entries",
        "search",
        "high",
        "pe32",
        "high process",
        "injection t1055",
        "salicode",
        "worm",
        "copy",
        "tools",
        "service",
        "write",
        "win32",
        "persistence",
        "execution",
        "april",
        "urls",
        "http",
        "unique",
        "scan endpoints",
        "all scoreblue",
        "url http",
        "pulse pulses",
        "ip address",
        "related nids",
        "code",
        "as54113",
        "unknown",
        "body",
        "fastly error",
        "please",
        "sea p",
        "msil",
        "accept",
        "aaaa",
        "nxdomain",
        "whitelisted",
        "as15169 google",
        "status",
        "as44273 host",
        "as46691",
        "domain",
        "url https",
        "files location",
        "info",
        "script urls",
        "path max",
        "age86400 set",
        "cookie",
        "script domains",
        "javascript",
        "script script",
        "trojanspy",
        "cname",
        "emails",
        "servers",
        "all search",
        "related pulses",
        "file samples",
        "files matching",
        "creation date",
        "germany unknown",
        "yara detections",
        "filehash",
        "av detections",
        "ids detections",
        "alerts",
        "analysis date",
        "file score",
        "meta",
        "home welcome",
        "write c",
        "delete c",
        "query",
        "local",
        "hostname",
        "a domains",
        "lowfi",
        "content type",
        "record value",
        "suite",
        "showing",
        "asnone united",
        "as29873",
        "ipv4",
        "pulse submit",
        "url analysis",
        "files",
        "pe32 executable",
        "potential scan",
        "0pgtwhu",
        "t1045",
        "port",
        "infection",
        "recon",
        "malware",
        "june",
        "delphi",
        "taobao network",
        "as45102 alibaba",
        "as4812 china",
        "next",
        "expiration date",
        "name servers",
        "dynamicloader",
        "dynamic",
        "sha256",
        "dynamic link",
        "library exe",
        "adobe",
        "incorporated",
        "read",
        "yara rule",
        "delete",
        "binary file",
        "push",
        "malicious",
        "july",
        "iocs",
        "levelbluelabs",
        "jeff4son",
        "adversaries",
        "registry run",
        "flow t1574",
        "dll sideloading",
        "boot",
        "logon autostart",
        "execution t1547",
        "keys",
        "startup folder",
        "t1497 may",
        "encryption",
        "catalog tree",
        "analysis ob0001",
        "virtual machine",
        "detection b0009",
        "check registry",
        "analysis ob0002",
        "executable code",
        "stack strings",
        "control ob0004",
        "get http",
        "http requests",
        "dns resolutions",
        "ip traffic",
        "pattern domains",
        "memory pattern",
        "urls http",
        "request",
        "response",
        "connection",
        "trojan",
        "otx scoreblue",
        "windows",
        "embeddedwb",
        "medium",
        "shellexecuteexw",
        "msie",
        "windows nt",
        "displayname",
        "tofsee",
        "hashes",
        "vhash",
        "authentihash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "library",
        "read c",
        "file guard",
        "rtversion",
        "langchinese",
        "legalcopyright",
        "reserved",
        "ransom",
        "moved",
        "media",
        "ascii text",
        "default",
        "upack",
        "mike",
        "contacted",
        "x87xe1x1d",
        "regsetvalueexa",
        "x95xd3xa4",
        "regbinary",
        "x84xa8xe8i",
        "x8dxb7xb7",
        "hx88x9ax1e",
        "mx81xd1r",
        "x92xac",
        "xc2x84",
        "stream",
        "swipper",
        "pdfcreator.sf.net",
        "botnet",
        "black mercedes",
        "please forgive me",
        "therahand thouroughhand"
      ],
      "references": [
        "Project Endgame - pegausintel.com -Unsjre if related to NSO Group",
        "Antivirus Detections: ALF:HeraklezEval:Rogue:Win32/FakeRean",
        "Yara Detections: compromised_site_redirector_fromcharcode ,  Cabinet_Archive ,  SFX_CAB",
        "Alerts: infostealer_cookies persistence_autorun recon_programs recon_fingerprint removes_zoneid_ads anomalous_deletefile",
        "P\u2019s Contacted:  93.184.221.240  3.33.130.190 |  Domains Contacted: counterslocal.com",
        "compromised_site_redirector_fromcharcode fromCharCode",
        "Interesting Strings: http://www.interoperabilitybridges.com/wmp http://crbug.com/40902 http://crbug.com/516527",
        "Interesting Strings: http://service.real.com/realplayer/security/02062012_player/en/",
        "Interesting Strings: https://support.google.com/chrome/?p=plugin_pdf",
        "https://support.google.com/chrome/?p=plugin_quicktime https://chrome.google.com/",
        "Interesting Strings: http://schema.org/GovernmentOrganization https://support.google.com/chrome/?p=plugin_java https://crbug.com/593166",
        "Pdf.Phishing.TtraffRobotInstall-7605656-0 00004feb58be42ba1bd506ea89f90c5e1d83e6e1fb84841931949a454b0bb539",
        "Antivirus Detections Cryp_Xed-12 ,  Mal/Generic-S ,  Packed/Upack Yara Detections Upackv039finalDwing ,  UpackV037Dwing",
        "https://pin.it/ | https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Worm:Win32/Macoute.A",
          "display_name": "Worm:Win32/Macoute.A",
          "target": "/malware/Worm:Win32/Macoute.A"
        },
        {
          "id": "TrojanDownloader:Win32/Nemucod",
          "display_name": "TrojanDownloader:Win32/Nemucod",
          "target": "/malware/TrojanDownloader:Win32/Nemucod"
        },
        {
          "id": "TrojanSpy:Win32/Nivdort",
          "display_name": "TrojanSpy:Win32/Nivdort",
          "target": "/malware/TrojanSpy:Win32/Nivdort"
        },
        {
          "id": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "display_name": "ALF:HeraklezEval:Rogue:Win32/FakeRean",
          "target": null
        },
        {
          "id": "Worm:Win32/Fesber.A",
          "display_name": "Worm:Win32/Fesber.A",
          "target": "/malware/Worm:Win32/Fesber.A"
        },
        {
          "id": "Ransom:Win32/Eniqma.A",
          "display_name": "Ransom:Win32/Eniqma.A",
          "target": "/malware/Ransom:Win32/Eniqma.A"
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "UpackV037Dwing",
          "display_name": "UpackV037Dwing",
          "target": null
        },
        {
          "id": "Cryp_Xed-12",
          "display_name": "Cryp_Xed-12",
          "target": null
        },
        {
          "id": "Mal/Generic-S",
          "display_name": "Mal/Generic-S",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1018",
          "name": "Remote System Discovery",
          "display_name": "T1018 - Remote System Discovery"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1096",
          "name": "NTFS File Attributes",
          "display_name": "T1096 - NTFS File Attributes"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 29,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1493,
        "FileHash-SHA1": 1393,
        "FileHash-SHA256": 5881,
        "URL": 1495,
        "domain": 1947,
        "hostname": 1360,
        "email": 18,
        "CVE": 1
      },
      "indicator_count": 13588,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "590 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a39f005c7f0a1c1eb33125",
      "name": "Formbook",
      "description": "FormBook is a data stealer that is being distributed as a MaaS. FormBook is available in the dark web market as a Malware-as-Service.\n I n known situations targets were contacted by bad actors  via social media accounts Twitter & Facebook.",
      "modified": "2024-03-21T10:00:24.070000",
      "created": "2024-01-14T08:44:48.297000",
      "tags": [
        "ssl certificate",
        "contacted",
        "execution",
        "ah6itbtgl",
        "whois record",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "formbook",
        "threat roundup",
        "malware",
        "metro",
        "social engineering",
        "jansky",
        "script urls",
        "a domains",
        "united",
        "search",
        "date",
        "script domains",
        "creation date",
        "record value",
        "showing",
        "unknown",
        "meta",
        "body",
        "encrypt",
        "as63949 linode",
        "as41357",
        "united kingdom",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse submit",
        "url analysis",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "email",
        "registry domain",
        "win32 exe",
        "javascript",
        "eqsray",
        "zip blaze",
        "ms excel",
        "detections type",
        "name",
        "text",
        "csv order",
        "files",
        "microsoft",
        "dns replication",
        "bt6lcuigydc9yc",
        "jxaavf4jnzza0",
        "submission",
        "community score",
        "no security",
        "graph api",
        "status",
        "content type",
        "xcitium verdict",
        "cloud marketing",
        "history first",
        "thebrotherssabey",
        "passive dns",
        "gmt content",
        "plesklin",
        "ipv4",
        "pulse pulses",
        "urls",
        "vbs",
        "data center",
        "reverse dns",
        "first",
        "utc submissions",
        "submitters",
        "bbonline uk",
        "namecheap inc",
        "summary iocs",
        "graph community",
        "ionos se",
        "keysystems gmbh",
        "record type",
        "ttl value",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "sabey",
        "all search",
        "otx octoseek",
        "url http",
        "http",
        "hostname",
        "files domain",
        "msie",
        "chrome",
        "expiration date",
        "next",
        "whois lookup",
        "dnssec",
        "domain name",
        "abuse contact",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "cname",
        "as44273 host",
        "ip address"
      ],
      "references": [
        "appleremote.net",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "FormBook",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1708,
        "hostname": 1920,
        "domain": 2221,
        "URL": 4822,
        "FileHash-MD5": 100,
        "FileHash-SHA1": 119,
        "email": 2,
        "CIDR": 1
      },
      "indicator_count": 10893,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "802 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a4880cf26f0feaf9a75648",
      "name": "Formbook",
      "description": "",
      "modified": "2024-02-13T08:03:20.064000",
      "created": "2024-01-15T01:19:08.041000",
      "tags": [
        "ssl certificate",
        "contacted",
        "execution",
        "ah6itbtgl",
        "whois record",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "formbook",
        "threat roundup",
        "malware",
        "metro",
        "social engineering",
        "jansky",
        "script urls",
        "a domains",
        "united",
        "search",
        "date",
        "script domains",
        "creation date",
        "record value",
        "showing",
        "unknown",
        "meta",
        "body",
        "encrypt",
        "as63949 linode",
        "as41357",
        "united kingdom",
        "scan endpoints",
        "all octoseek",
        "domain",
        "pulse submit",
        "url analysis",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "domain status",
        "registrar url",
        "registrar whois",
        "email",
        "registry domain",
        "win32 exe",
        "javascript",
        "eqsray",
        "zip blaze",
        "ms excel",
        "detections type",
        "name",
        "text",
        "csv order",
        "files",
        "microsoft",
        "dns replication",
        "bt6lcuigydc9yc",
        "jxaavf4jnzza0",
        "submission",
        "community score",
        "no security",
        "graph api",
        "status",
        "content type",
        "xcitium verdict",
        "cloud marketing",
        "history first",
        "thebrotherssabey",
        "passive dns",
        "gmt content",
        "plesklin",
        "ipv4",
        "pulse pulses",
        "urls",
        "vbs",
        "data center",
        "reverse dns",
        "first",
        "utc submissions",
        "submitters",
        "bbonline uk",
        "namecheap inc",
        "summary iocs",
        "graph community",
        "ionos se",
        "keysystems gmbh",
        "record type",
        "ttl value",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus cnr3",
        "olet",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "sabey",
        "all search",
        "otx octoseek",
        "url http",
        "http",
        "hostname",
        "files domain",
        "msie",
        "chrome",
        "expiration date",
        "next",
        "whois lookup",
        "dnssec",
        "domain name",
        "abuse contact",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "usage",
        "x509v3 extended",
        "info",
        "cname",
        "as44273 host",
        "ip address"
      ],
      "references": [
        "appleremote.net",
        "CnC 103.224.182.241 | 188.240.191.162 | 207.148.248.143 | 70.32.23.111",
        "FormBook",
        "FileHash-SHA256 3072c32dcb5754e08282a8ce2c7c60d93a5ad2ee3ae216d23c94b1f536471acc",
        "http://www.nimtax.com/k9/,Formbook,Medium,9/9/2019,1/7/2020",
        "http://t.go.leadthrottle.com/ls/click?upn=QhIPT8KEOABIXMIAxwxPqJ280BBgOcomwXzYntjGICKScv8M4tWQQv4cQuNEja5M44qD_uKOrj1xe-2BYklVyDerLi-2F8mevEGdJeLwCcy3wsiM69F4EC3HAQoZ582VU8uxrVcciNra6YszFQV9gxv53c9iiXOjTuuW-2Fx2QeRPLTofIbYdsrV0aHfkFFhlixBU98mWJE7J0sEjKal1RV6nobxwnEeiVnye8NmQRJx-2FU9UfSEgWQJkTRSj9fP71LBPXBfsc8hOmZFtxOK0v3NQPflOZaAcy5iWdp2hFJGs4seKW1H2KrW5ufvec0BQBd1-2BT0vkNMAbCRhYmaLIAIyjw8lLFewDKeh7z1Ab1irO0L76m8UtAPp2ggxJTpeu-2BTpA0DNS2YtJw0V8Ucha5zN7OgSKumBbxxQEaK8UUm3ZjUVbsX-2Fyv-2B-2BteXtCeZE-2FzL3wmcIL"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "FormBook",
          "display_name": "FormBook",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65a39f005c7f0a1c1eb33125",
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1650,
        "hostname": 1778,
        "domain": 2102,
        "URL": 4435,
        "FileHash-MD5": 100,
        "FileHash-SHA1": 119,
        "email": 2,
        "CIDR": 1
      },
      "indicator_count": 10187,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "839 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65707dbbb0493c03ba107643",
      "name": "loggly.com and pstv.com/ supernetforme.com live malware",
      "description": "",
      "modified": "2023-12-06T13:57:15.377000",
      "created": "2023-12-06T13:57:15.377000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 1,
        "FileHash-SHA256": 1933,
        "domain": 1302,
        "hostname": 805,
        "URL": 3593,
        "FileHash-MD5": 1
      },
      "indicator_count": 7635,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "907 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "61f9b4b2c6c645e9839112b2",
      "name": "loggly.com and pstv.com/ supernetforme.com live malware",
      "description": "www.logs-01.loggly.com\ncallplus.loggly.com\npopcap.loggly.com\nwiki.loggly.com",
      "modified": "2022-03-04T00:00:56.902000",
      "created": "2022-02-01T22:31:14.017000",
      "tags": [
        "irst seen",
        "date",
        "file sha256",
        "network related",
        "malicious",
        "found"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "dorkingbeauty1",
        "id": "80137",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 3593,
        "FileHash-SHA256": 1933,
        "hostname": 805,
        "domain": 1302,
        "FileHash-MD5": 1,
        "CVE": 1
      },
      "indicator_count": 7635,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 398,
      "modified_text": "1550 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "asteroidofbethlehem.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "asteroidofbethlehem.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780311602.9991376
}