{
  "type": "Domain",
  "indicator": "behdashtemanavi.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/behdashtemanavi.com",
    "alexa": "http://www.alexa.com/siteinfo/behdashtemanavi.com",
    "indicator": "behdashtemanavi.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 4304036837,
      "indicator": "behdashtemanavi.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "69a82c54067ca1d502b1eb6c",
          "name": "TTB-Chained (Tehran-Transversal Belasco Chain)",
          "description": "TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock \"Hollow Library\" assets into the environment pre-enforcement, ensuring total detection evasion.\nThe conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB \"hollowed\" assets masquerade as signed updates for total penetration. In Infra/Bank/Gov sectors, TTB executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos",
          "modified": "2026-06-02T10:34:55.368000",
          "created": "2026-03-04T12:57:56.738000",
          "tags": [
            "malicious",
            "Microsoft",
            "intent: reckless",
            "wiper",
            "Transip",
            "bankers document gone rogue",
            "Tehran",
            "pdfkit.net",
            "United",
            "broken Docusign seal",
            "esign violation",
            "us lawyers",
            "Iran",
            "IP Abuse US",
            "Spreader",
            "corruption that spread",
            "52.123.250.180",
            "Mass Data Loss and exfiltration",
            "Docusign exploited by insecure workflows",
            "Adobe exploited by insecure workflows",
            "threat map",
            "Infra / healthcare / more at risk from this negligence",
            "remediation: long. expire the certs. block 53..",
            "accountability, NOW.",
            "Burned",
            "Kitplay",
            "iOS",
            "Watering hole",
            "Webkit",
            "Religious Regime",
            "MS Office",
            "Compliance Hold Purgatory",
            "WIN EXE.32",
            "Firmware neutral",
            "Trusted Insider",
            "DKIM, SPF, DMARC Failures"
          ],
          "references": [
            "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
            "People who exploit this put the US at risk. Bottom line.",
            "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
            "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
            "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
            "",
            "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
            "This document might expose someone, more than another.",
            "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
            "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Telecommunications"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 70,
            "hostname": 226,
            "CVE": 6,
            "URL": 366,
            "domain": 112,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 26,
            "CIDR": 4,
            "email": 20
          },
          "indicator_count": 835,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 69,
          "modified_text": "5 hours ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d967590f40c612c90ce84f",
          "name": "TTB-Chained (Tehran-Transversal Belasco Chain) - Clone of My Own Post. Updated",
          "description": "TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock \"Hollow Library\" assets into the environment pre-enforcement, ensuring total detection evasion. The conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB \"hollowed\" assets masquerade as signed updates for total penetration. TTB-chained executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root hosted in IP {53.xxx] is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos. See Belasco Chain for more.",
          "modified": "2026-05-31T01:02:14",
          "created": "2026-04-10T21:10:49.749000",
          "tags": [
            "malicious",
            "Microsoft",
            "intent: reckless",
            "wiper",
            "Transip",
            "bankers document gone rogue",
            "Tehran",
            "pdfkit.net",
            "United",
            "broken Docusign seal",
            "esign violation",
            "us lawyers",
            "Iran",
            "IP Abuse US",
            "Spreader",
            "corruption that spread",
            "52.123.250.180",
            "Mass Data Loss and exfiltration",
            "Docusign exploited by insecure workflows",
            "Adobe exploited by insecure workflows",
            "threat map",
            "Infra / healthcare / more at risk from this negligence",
            "remediation: long. expire the certs. block 53..",
            "accountability, NOW.",
            "Burned",
            "Kitplay",
            "iOS",
            "Watering hole",
            "Webkit",
            "Religious Regime",
            "MS Office",
            "Compliance Hold Purgatory",
            "WIN EXE.32",
            "Firmware neutral",
            "Trusted Insider",
            "DKIM, SPF, DMARC Failures",
            "APKmirror",
            "ILOVEYOUBABY",
            "No Problems",
            "Christmas Tree EXEC Code Red worm Computer virus Nimda",
            "Wanna Cry",
            "APK",
            "DC RAT",
            "Emotnet",
            "Redline Swiper",
            "Open Door",
            "Bankers Document",
            "Y2K",
            "wsscript.exe, VBE",
            "Compliance Lock Trap",
            "Globalsign 2020 (potentially exploited)",
            "Heuristic Smear",
            "Gatsby Library Loader DLL",
            "w31999",
            "UofA"
          ],
          "references": [
            "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
            "People who exploit this put the US at risk. Bottom line.",
            "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
            "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
            "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
            "",
            "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
            "This document might expose someone, more than another.",
            "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
            "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there.",
            "Micro - Dates to look for specific: April/May/June 2025",
            "Sectigo- Check abnormal patterns Sept 8, 2025 and ADT check alarms that went off",
            "Amazon- Check new cert subscribers on or around Sept 15 2025",
            "Entrust to Sectigo- Review vendors",
            "Apple: Look at Devs around Aug 20-sept 15 2025 abnormalities",
            "CA DMV- 2020 exploits, if even exist in your records, may be related.",
            "Digi/Global Sign - audit 2020 digital intersect",
            "Proton.me/Zenbox: Audit July 2025",
            "Google- look at 202 to Icloud docs likely feb 2025 but possible Dec 24, jan 25 up until June 2025",
            "APKMirror https://www.apkmirror.com",
            "Google Docs 1.25.202.02 APK Download by Google LLC",
            "The ILOVEYOU virus, released on May 4, 2000, - PDKIT.net May 4, 2025.",
            "Y2K",
            "US, Philippines, Ukraine, Iran, China. Alberta.",
            "France",
            "Germany, Austria, and Switzerland GmbH",
            "Gatsby Library Loader, DLL",
            "Spellbinding! Indeed. SpellEditor.exe"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Telecommunications"
          ],
          "TLP": "green",
          "cloned_from": "69a82c54067ca1d502b1eb6c",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 3921,
            "hostname": 1668,
            "CVE": 14,
            "URL": 1984,
            "domain": 1432,
            "FileHash-MD5": 882,
            "FileHash-SHA1": 946,
            "CIDR": 10,
            "email": 29,
            "JA3": 2,
            "IPv4": 11
          },
          "indicator_count": 10899,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 70,
          "modified_text": "2 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "69d9675a25be662c17cd3a9c",
          "name": "TTB-Chained (Tehran-Transversal Belasco Chain) - Clone of My Own Post. Updated",
          "description": "TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock \"Hollow Library\" assets into the environment pre-enforcement, ensuring total detection evasion. The conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB \"hollowed\" assets masquerade as signed updates for total penetration. TTB-chained executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root hosted in IP {53.xxx] is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos. See Belasco Chain for more.",
          "modified": "2026-05-31T01:02:14",
          "created": "2026-04-10T21:10:50.646000",
          "tags": [
            "malicious",
            "Microsoft",
            "intent: reckless",
            "wiper",
            "Transip",
            "bankers document gone rogue",
            "Tehran",
            "pdfkit.net",
            "United",
            "broken Docusign seal",
            "esign violation",
            "us lawyers",
            "Iran",
            "IP Abuse US",
            "Spreader",
            "corruption that spread",
            "52.123.250.180",
            "Mass Data Loss and exfiltration",
            "Docusign exploited by insecure workflows",
            "Adobe exploited by insecure workflows",
            "threat map",
            "Infra / healthcare / more at risk from this negligence",
            "remediation: long. expire the certs. block 53..",
            "accountability, NOW.",
            "Burned",
            "Kitplay",
            "iOS",
            "Watering hole",
            "Webkit",
            "Religious Regime",
            "MS Office",
            "Compliance Hold Purgatory",
            "WIN EXE.32",
            "Firmware neutral",
            "Trusted Insider",
            "DKIM, SPF, DMARC Failures",
            "No Problems"
          ],
          "references": [
            "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
            "People who exploit this put the US at risk. Bottom line.",
            "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
            "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
            "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
            "",
            "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
            "This document might expose someone, more than another.",
            "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
            "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Government",
            "Telecommunications"
          ],
          "TLP": "green",
          "cloned_from": "69a82c54067ca1d502b1eb6c",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 70,
            "hostname": 232,
            "CVE": 9,
            "URL": 371,
            "domain": 112,
            "FileHash-MD5": 5,
            "FileHash-SHA1": 26,
            "CIDR": 4,
            "email": 20,
            "JA3": 1,
            "IPv4": 3
          },
          "indicator_count": 853,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 68,
          "modified_text": "2 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "",
        "France",
        "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
        "Entrust to Sectigo- Review vendors",
        "Micro - Dates to look for specific: April/May/June 2025",
        "Gatsby Library Loader, DLL",
        "CA DMV- 2020 exploits, if even exist in your records, may be related.",
        "Amazon- Check new cert subscribers on or around Sept 15 2025",
        "The ILOVEYOU virus, released on May 4, 2000, - PDKIT.net May 4, 2025.",
        "Sectigo- Check abnormal patterns Sept 8, 2025 and ADT check alarms that went off",
        "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
        "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
        "Google Docs 1.25.202.02 APK Download by Google LLC",
        "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
        "This document might expose someone, more than another.",
        "APKMirror https://www.apkmirror.com",
        "Spellbinding! Indeed. SpellEditor.exe",
        "US, Philippines, Ukraine, Iran, China. Alberta.",
        "Y2K",
        "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
        "Germany, Austria, and Switzerland GmbH",
        "People who exploit this put the US at risk. Bottom line.",
        "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there.",
        "Google- look at 202 to Icloud docs likely feb 2025 but possible Dec 24, jan 25 up until June 2025",
        "Apple: Look at Devs around Aug 20-sept 15 2025 abnormalities",
        "Proton.me/Zenbox: Audit July 2025",
        "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
        "Digi/Global Sign - audit 2020 digital intersect"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [],
          "industries": [
            "Government",
            "Telecommunications"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "69a82c54067ca1d502b1eb6c",
      "name": "TTB-Chained (Tehran-Transversal Belasco Chain)",
      "description": "TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock \"Hollow Library\" assets into the environment pre-enforcement, ensuring total detection evasion.\nThe conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB \"hollowed\" assets masquerade as signed updates for total penetration. In Infra/Bank/Gov sectors, TTB executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos",
      "modified": "2026-06-02T10:34:55.368000",
      "created": "2026-03-04T12:57:56.738000",
      "tags": [
        "malicious",
        "Microsoft",
        "intent: reckless",
        "wiper",
        "Transip",
        "bankers document gone rogue",
        "Tehran",
        "pdfkit.net",
        "United",
        "broken Docusign seal",
        "esign violation",
        "us lawyers",
        "Iran",
        "IP Abuse US",
        "Spreader",
        "corruption that spread",
        "52.123.250.180",
        "Mass Data Loss and exfiltration",
        "Docusign exploited by insecure workflows",
        "Adobe exploited by insecure workflows",
        "threat map",
        "Infra / healthcare / more at risk from this negligence",
        "remediation: long. expire the certs. block 53..",
        "accountability, NOW.",
        "Burned",
        "Kitplay",
        "iOS",
        "Watering hole",
        "Webkit",
        "Religious Regime",
        "MS Office",
        "Compliance Hold Purgatory",
        "WIN EXE.32",
        "Firmware neutral",
        "Trusted Insider",
        "DKIM, SPF, DMARC Failures"
      ],
      "references": [
        "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
        "People who exploit this put the US at risk. Bottom line.",
        "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
        "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
        "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
        "",
        "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
        "This document might expose someone, more than another.",
        "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
        "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Telecommunications"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 70,
        "hostname": 226,
        "CVE": 6,
        "URL": 366,
        "domain": 112,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 26,
        "CIDR": 4,
        "email": 20
      },
      "indicator_count": 835,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 69,
      "modified_text": "5 hours ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d967590f40c612c90ce84f",
      "name": "TTB-Chained (Tehran-Transversal Belasco Chain) - Clone of My Own Post. Updated",
      "description": "TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock \"Hollow Library\" assets into the environment pre-enforcement, ensuring total detection evasion. The conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB \"hollowed\" assets masquerade as signed updates for total penetration. TTB-chained executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root hosted in IP {53.xxx] is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos. See Belasco Chain for more.",
      "modified": "2026-05-31T01:02:14",
      "created": "2026-04-10T21:10:49.749000",
      "tags": [
        "malicious",
        "Microsoft",
        "intent: reckless",
        "wiper",
        "Transip",
        "bankers document gone rogue",
        "Tehran",
        "pdfkit.net",
        "United",
        "broken Docusign seal",
        "esign violation",
        "us lawyers",
        "Iran",
        "IP Abuse US",
        "Spreader",
        "corruption that spread",
        "52.123.250.180",
        "Mass Data Loss and exfiltration",
        "Docusign exploited by insecure workflows",
        "Adobe exploited by insecure workflows",
        "threat map",
        "Infra / healthcare / more at risk from this negligence",
        "remediation: long. expire the certs. block 53..",
        "accountability, NOW.",
        "Burned",
        "Kitplay",
        "iOS",
        "Watering hole",
        "Webkit",
        "Religious Regime",
        "MS Office",
        "Compliance Hold Purgatory",
        "WIN EXE.32",
        "Firmware neutral",
        "Trusted Insider",
        "DKIM, SPF, DMARC Failures",
        "APKmirror",
        "ILOVEYOUBABY",
        "No Problems",
        "Christmas Tree EXEC Code Red worm Computer virus Nimda",
        "Wanna Cry",
        "APK",
        "DC RAT",
        "Emotnet",
        "Redline Swiper",
        "Open Door",
        "Bankers Document",
        "Y2K",
        "wsscript.exe, VBE",
        "Compliance Lock Trap",
        "Globalsign 2020 (potentially exploited)",
        "Heuristic Smear",
        "Gatsby Library Loader DLL",
        "w31999",
        "UofA"
      ],
      "references": [
        "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
        "People who exploit this put the US at risk. Bottom line.",
        "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
        "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
        "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
        "",
        "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
        "This document might expose someone, more than another.",
        "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
        "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there.",
        "Micro - Dates to look for specific: April/May/June 2025",
        "Sectigo- Check abnormal patterns Sept 8, 2025 and ADT check alarms that went off",
        "Amazon- Check new cert subscribers on or around Sept 15 2025",
        "Entrust to Sectigo- Review vendors",
        "Apple: Look at Devs around Aug 20-sept 15 2025 abnormalities",
        "CA DMV- 2020 exploits, if even exist in your records, may be related.",
        "Digi/Global Sign - audit 2020 digital intersect",
        "Proton.me/Zenbox: Audit July 2025",
        "Google- look at 202 to Icloud docs likely feb 2025 but possible Dec 24, jan 25 up until June 2025",
        "APKMirror https://www.apkmirror.com",
        "Google Docs 1.25.202.02 APK Download by Google LLC",
        "The ILOVEYOU virus, released on May 4, 2000, - PDKIT.net May 4, 2025.",
        "Y2K",
        "US, Philippines, Ukraine, Iran, China. Alberta.",
        "France",
        "Germany, Austria, and Switzerland GmbH",
        "Gatsby Library Loader, DLL",
        "Spellbinding! Indeed. SpellEditor.exe"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Telecommunications"
      ],
      "TLP": "green",
      "cloned_from": "69a82c54067ca1d502b1eb6c",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 3921,
        "hostname": 1668,
        "CVE": 14,
        "URL": 1984,
        "domain": 1432,
        "FileHash-MD5": 882,
        "FileHash-SHA1": 946,
        "CIDR": 10,
        "email": 29,
        "JA3": 2,
        "IPv4": 11
      },
      "indicator_count": 10899,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 70,
      "modified_text": "2 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "69d9675a25be662c17cd3a9c",
      "name": "TTB-Chained (Tehran-Transversal Belasco Chain) - Clone of My Own Post. Updated",
      "description": "TTB-Chained executes a systemic collapse of the cryptographic chain of trust. Exploiting DNSSEC-unsigned protocols and .net edge nodes, it injects C++ payloads into the resolution chain prior to verification. Remediating via certificate expiration is ineffective; the architecture leverages systemic flaws in DMARC/SPF/DKIM and cryptographic handshake protocols to lock \"Hollow Library\" assets into the environment pre-enforcement, ensuring total detection evasion. The conduit utilizes a multi-umbrella transit strategy: Lumen (AS3356) + RIPE (37.97.254.27) + Fastly (151.101.130.159). These 63.16 KB \"hollowed\" assets masquerade as signed updates for total penetration. TTB-chained executes high-speed wipers targeting firmware/boot sectors, triggering complete corruption of hardware beyond restore. Once the root hosted in IP {53.xxx] is compromised and the pre-verified environment is saturated, the hardware is physically neutralized. -msudosos. See Belasco Chain for more.",
      "modified": "2026-05-31T01:02:14",
      "created": "2026-04-10T21:10:50.646000",
      "tags": [
        "malicious",
        "Microsoft",
        "intent: reckless",
        "wiper",
        "Transip",
        "bankers document gone rogue",
        "Tehran",
        "pdfkit.net",
        "United",
        "broken Docusign seal",
        "esign violation",
        "us lawyers",
        "Iran",
        "IP Abuse US",
        "Spreader",
        "corruption that spread",
        "52.123.250.180",
        "Mass Data Loss and exfiltration",
        "Docusign exploited by insecure workflows",
        "Adobe exploited by insecure workflows",
        "threat map",
        "Infra / healthcare / more at risk from this negligence",
        "remediation: long. expire the certs. block 53..",
        "accountability, NOW.",
        "Burned",
        "Kitplay",
        "iOS",
        "Watering hole",
        "Webkit",
        "Religious Regime",
        "MS Office",
        "Compliance Hold Purgatory",
        "WIN EXE.32",
        "Firmware neutral",
        "Trusted Insider",
        "DKIM, SPF, DMARC Failures",
        "No Problems"
      ],
      "references": [
        "The source of corruption stems from a US wiper/trust bypass doc resting an in Iranian node for C+C. Prelim Data supports this 'may' be misused by [some US lawyer, lower gov]  for suppression and sale to Iran. I want to be explicit in saying, this is a few bad apples, not the majority.",
        "People who exploit this put the US at risk. Bottom line.",
        "Further threat mapping indicates the root of this lies at 52.123.250.[180]. The",
        "For Record: This is not singular blame, while the origin of this root is the problem. It is not isolated.",
        "This is reckless. This is dangerous. Us actors should be ashamed of themselves. #spreader",
        "",
        "IMPACT: https://www.virustotal.com/graph/g92989765f2d44094a4f25307e33fdef026650fe364c640f894bef43f2646a815",
        "This document might expose someone, more than another.",
        "Remediation: Long. Expire the certs. Block the IP for exfiltration 53. Audit 'badge' usage, ASAP.",
        "Other Recs: Pull every Micro Compliance Hold Email. This is a trap. The problem likely resides there."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Government",
        "Telecommunications"
      ],
      "TLP": "green",
      "cloned_from": "69a82c54067ca1d502b1eb6c",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 70,
        "hostname": 232,
        "CVE": 9,
        "URL": 371,
        "domain": 112,
        "FileHash-MD5": 5,
        "FileHash-SHA1": 26,
        "CIDR": 4,
        "email": 20,
        "JA3": 1,
        "IPv4": 3
      },
      "indicator_count": 853,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 68,
      "modified_text": "2 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "behdashtemanavi.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "behdashtemanavi.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780414680.8772318
}