{
  "type": "Domain",
  "indicator": "benefitsofcloves.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/benefitsofcloves.com",
    "alexa": "http://www.alexa.com/siteinfo/benefitsofcloves.com",
    "indicator": "benefitsofcloves.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3830067282,
      "indicator": "benefitsofcloves.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 11,
      "pulses": [
        {
          "id": "69e2cc9ebd63c32d9c0392c6",
          "name": "Hidden Tear BruteForcer Clone Credit OctoSeek",
          "description": "",
          "modified": "2026-04-18T00:13:18.484000",
          "created": "2026-04-18T00:13:18.484000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "url https",
            "iocs",
            "filehashsha1",
            "next",
            "x509v3",
            "key",
            "windows",
            "write",
            "whois ssl",
            "whois whois",
            "win32",
            "198-46-194-153-host.colocrossing.com",
            "a domains",
            "a nxdomain",
            "aaaa",
            "accept",
            "adapter driver",
            "address",
            "address domain",
            "algorithm",
            "all octoseek",
            "cookie",
            "copy",
            "core",
            "domain names",
            "domain",
            "dnssec",
            "discord",
            "whois record",
            "cyberstalking",
            "d417n",
            "timestamp",
            "data",
            "subject",
            "cyberstalking",
            "creation date",
            "ipv4",
            "ip address",
            "http identifier",
            "hostname",
            "historical ssl",
            "highly targeted",
            "high level",
            "high",
            "hiddentear",
            "gmtn",
            "germany unknown",
            "location first",
            "ip files",
            "files",
            "false files",
            "eu data",
            "entries",
            "download encrypt",
            "encrypt",
            "download",
            "contacted",
            "communicating",
            "coinminer",
            "code",
            "cobalt strike",
            "cname",
            "click",
            "ca issuers",
            "issuers",
            "as133618",
            "as24940",
            "hetzner",
            "as26710",
            "icann",
            "as36352",
            "as24940 hetzner",
            "asn as133618",
            "as26710 icann",
            "apple as8075",
            "as47846",
            "as47995",
            "key algorithm",
            "united",
            "name",
            "type",
            "tsara brashears",
            "trojan",
            "key identifier",
            "key info",
            "land use",
            "link location",
            "united tls web",
            "tls web",
            "log id",
            "malvertizing",
            "malware",
            "http",
            "meekserver",
            "meta",
            "metasploit",
            "admin",
            "subject",
            "ransomware",
            "stop ransomware",
            "certificate status",
            "metro",
            "moved",
            "name servers",
            "netsupport rat",
            "number",
            "nxdomain",
            "passive dns",
            "servers",
            "server",
            "pegasus",
            "pingback",
            "submit",
            "ransom",
            "raspberry robin",
            "subject public",
            "subject key",
            "subject billing",
            "pdf broadcom",
            "pulse pulses",
            "pulse submit",
            "read c",
            "record value",
            "redacted referrer",
            "regbinary",
            "regdword",
            "registrant fax",
            "registrar",
            "registrar abuse",
            "registry domain",
            "registrar of",
            "registry policy",
            "regsetvalueexa",
            "regsetvalueexw",
            "show",
            "showing",
            "search",
            "urls",
            "script",
            "script domains",
            "scan endpoints",
            "russia unknown",
            "reverse dns",
            "resolutions",
            "nids",
            "related nids",
            "as39494 jsc",
            "body",
            "attorney james",
            "asn as133618",
            "javascript",
            "unknown",
            "url analysis",
            "unknown url",
            "url http",
            "v3 serial",
            "http",
            "as40528 icann",
            "as44273 host",
            "data center",
            "hosting",
            "vps",
            "reverse dns"
          ],
          "references": [
            "deviceinbox.com [Malware Hosting - Pegasus]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
            "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
            "103.224.182.253 [Command and Control]",
            "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b60b85453c45eca795034d",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 77,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 359,
            "URL": 218,
            "SSLCertFingerprint": 2,
            "domain": 1932,
            "email": 12,
            "hostname": 528
          },
          "indicator_count": 3209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "1 day ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b3fb6752ac464268b971b1",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA.\nContact made. Physical records. Client: Brashears.\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/\n1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376\nhttps://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/\nhttps://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html\nTEL:Trojan:Win32/BazaarLoader\n987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7",
          "modified": "2024-09-05T07:02:20.491000",
          "created": "2024-01-26T18:35:19.690000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2401,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5377,
            "domain": 3794,
            "hostname": 2763,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 18927,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85df45cc3d3fd07139ea9",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
          "description": "",
          "modified": "2024-09-05T06:38:09.443000",
          "created": "2024-01-30T02:24:52.774000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b47501fcbc39983f098723",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2390,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4357,
            "domain": 3534,
            "hostname": 2670,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17111,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65caca061fbb7674de86ec7b",
          "name": "Invicta Stealer",
          "description": "Invicta Stealer is equipped to steal data from most locations of a system which makes it a dangerous threat.\nLink found in https://house.mo.com",
          "modified": "2024-03-14T01:01:47.115000",
          "created": "2024-02-13T01:46:46.969000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "resolutions",
            "communicating",
            "whois whois",
            "subdomains",
            "referrer",
            "problems",
            "core",
            "startpage",
            "june",
            "passive dns",
            "urls",
            "domain",
            "otx telemetry",
            "body",
            "gmt content",
            "x adblock",
            "scan endpoints",
            "all octoseek",
            "hostname",
            "date",
            "encrypt",
            "threat roundup",
            "october",
            "november",
            "march",
            "february",
            "apple ios",
            "april",
            "tsara brashears",
            "copy",
            "hacktool",
            "phishing",
            "metro",
            "crypto",
            "installer",
            "awful",
            "united",
            "unknown",
            "germany unknown",
            "search",
            "servers",
            "registrar",
            "name servers",
            "status",
            "next",
            "moved",
            "address",
            "creation date",
            "showing",
            "ipv4",
            "pulse submit",
            "url analysis",
            "accept",
            "aaaa",
            "record type",
            "ttl value",
            "html document",
            "ascii text",
            "anchor hrefs",
            "hrefs",
            "anchor",
            "anchor href",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "url https",
            "sample",
            "server",
            "code",
            "registry domain",
            "dnssec",
            "registrar url",
            "registrar whois",
            "iana id",
            "registrar abuse",
            "tech email",
            "fake update",
            "utilizes new",
            "idat loader",
            "stealc",
            "urls http",
            "isadultno",
            "adposbottom",
            "adformatplain",
            "adnetworks",
            "quasar rat",
            "ip detections",
            "country",
            "cellbrite",
            "execution",
            "pegasus",
            "malware",
            "agent tesla",
            "attack",
            "ukraine",
            "silent",
            "invicta stealer",
            "redline stealer",
            "orcus rat",
            "files",
            "germany asn",
            "as196763",
            "a domains",
            "redacted for",
            "record value",
            "for privacy",
            "emails",
            "name",
            "contacted urls",
            "bundled",
            "de indicators",
            "domains",
            "hashes",
            "gmbh version",
            "status page",
            "service privacy",
            "legal",
            "impressum",
            "pulse pulses",
            "location united",
            "open",
            "cookie",
            "customer",
            "0 report",
            "sea alt",
            "certificate",
            "#targeting",
            "#discordwallets",
            "house.mo.gov"
          ],
          "references": [
            "https://www.facebooksunglassshop.com/",
            "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
            "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
            "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
            "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
            "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
            "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
            "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
            "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
            "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
            "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
            "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "wallpapers-nature.com",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
            "edgedl.me.gvt1.com",
            "Link found in https://house.mo.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Invicta Stealer",
              "display_name": "Invicta Stealer",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Orcus RAT",
              "display_name": "Orcus RAT",
              "target": null
            },
            {
              "id": "Silent",
              "display_name": "Silent",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Government",
            "Civil Society",
            "Technology"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 65,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 153,
            "FileHash-SHA1": 145,
            "FileHash-SHA256": 3848,
            "CVE": 3,
            "URL": 8291,
            "domain": 2541,
            "hostname": 3034,
            "email": 13
          },
          "indicator_count": 18028,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "766 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b60b85453c45eca795034d",
          "name": "Hidden Tear BruteForcer",
          "description": "\u2022 The Hidden Tear BruteForcer is a program created by Michael Gillespie that can be used to brute force the password for ransomware infections. A ransomware-like file crypter sample which can be modified for specific purposes. Features. Uses AES algorithm to encrypt files. Can be downloaded for free for anyone to download in GitHub. Many cyber criminals, lawyers, investigators and governments use this project.\n\u2022 Raspberry Robin is an activity cluster spread by external drives that leverages Windows Installer.",
          "modified": "2024-02-27T06:04:19.663000",
          "created": "2024-01-28T08:08:37.586000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "url https",
            "iocs",
            "filehashsha1",
            "next",
            "x509v3",
            "key",
            "windows",
            "write",
            "whois ssl",
            "whois whois",
            "win32",
            "198-46-194-153-host.colocrossing.com",
            "a domains",
            "a nxdomain",
            "aaaa",
            "accept",
            "adapter driver",
            "address",
            "address domain",
            "algorithm",
            "all octoseek",
            "cookie",
            "copy",
            "core",
            "domain names",
            "domain",
            "dnssec",
            "discord",
            "whois record",
            "cyberstalking",
            "d417n",
            "timestamp",
            "data",
            "subject",
            "cyberstalking",
            "creation date",
            "ipv4",
            "ip address",
            "http identifier",
            "hostname",
            "historical ssl",
            "highly targeted",
            "high level",
            "high",
            "hiddentear",
            "gmtn",
            "germany unknown",
            "location first",
            "ip files",
            "files",
            "false files",
            "eu data",
            "entries",
            "download encrypt",
            "encrypt",
            "download",
            "contacted",
            "communicating",
            "coinminer",
            "code",
            "cobalt strike",
            "cname",
            "click",
            "ca issuers",
            "issuers",
            "as133618",
            "as24940",
            "hetzner",
            "as26710",
            "icann",
            "as36352",
            "as24940 hetzner",
            "asn as133618",
            "as26710 icann",
            "apple as8075",
            "as47846",
            "as47995",
            "key algorithm",
            "united",
            "name",
            "type",
            "tsara brashears",
            "trojan",
            "key identifier",
            "key info",
            "land use",
            "link location",
            "united tls web",
            "tls web",
            "log id",
            "malvertizing",
            "malware",
            "http",
            "meekserver",
            "meta",
            "metasploit",
            "admin",
            "subject",
            "ransomware",
            "stop ransomware",
            "certificate status",
            "metro",
            "moved",
            "name servers",
            "netsupport rat",
            "number",
            "nxdomain",
            "passive dns",
            "servers",
            "server",
            "pegasus",
            "pingback",
            "submit",
            "ransom",
            "raspberry robin",
            "subject public",
            "subject key",
            "subject billing",
            "pdf broadcom",
            "pulse pulses",
            "pulse submit",
            "read c",
            "record value",
            "redacted referrer",
            "regbinary",
            "regdword",
            "registrant fax",
            "registrar",
            "registrar abuse",
            "registry domain",
            "registrar of",
            "registry policy",
            "regsetvalueexa",
            "regsetvalueexw",
            "show",
            "showing",
            "search",
            "urls",
            "script",
            "script domains",
            "scan endpoints",
            "russia unknown",
            "reverse dns",
            "resolutions",
            "nids",
            "related nids",
            "as39494 jsc",
            "body",
            "attorney james",
            "asn as133618",
            "javascript",
            "unknown",
            "url analysis",
            "unknown url",
            "url http",
            "v3 serial",
            "http",
            "as40528 icann",
            "as44273 host",
            "data center",
            "hosting",
            "vps",
            "reverse dns"
          ],
          "references": [
            "deviceinbox.com [Malware Hosting - Pegasus]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
            "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
            "103.224.182.253 [Command and Control]",
            "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 77,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 359,
            "URL": 218,
            "SSLCertFingerprint": 2,
            "domain": 1932,
            "email": 12,
            "hostname": 528
          },
          "indicator_count": 3209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "782 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8086a651e881715b3fc47",
          "name": "Hidden Tear BruteForcer",
          "description": "",
          "modified": "2024-02-27T06:04:19.663000",
          "created": "2024-01-29T20:19:54.173000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "url https",
            "iocs",
            "filehashsha1",
            "next",
            "x509v3",
            "key",
            "windows",
            "write",
            "whois ssl",
            "whois whois",
            "win32",
            "198-46-194-153-host.colocrossing.com",
            "a domains",
            "a nxdomain",
            "aaaa",
            "accept",
            "adapter driver",
            "address",
            "address domain",
            "algorithm",
            "all octoseek",
            "cookie",
            "copy",
            "core",
            "domain names",
            "domain",
            "dnssec",
            "discord",
            "whois record",
            "cyberstalking",
            "d417n",
            "timestamp",
            "data",
            "subject",
            "cyberstalking",
            "creation date",
            "ipv4",
            "ip address",
            "http identifier",
            "hostname",
            "historical ssl",
            "highly targeted",
            "high level",
            "high",
            "hiddentear",
            "gmtn",
            "germany unknown",
            "location first",
            "ip files",
            "files",
            "false files",
            "eu data",
            "entries",
            "download encrypt",
            "encrypt",
            "download",
            "contacted",
            "communicating",
            "coinminer",
            "code",
            "cobalt strike",
            "cname",
            "click",
            "ca issuers",
            "issuers",
            "as133618",
            "as24940",
            "hetzner",
            "as26710",
            "icann",
            "as36352",
            "as24940 hetzner",
            "asn as133618",
            "as26710 icann",
            "apple as8075",
            "as47846",
            "as47995",
            "key algorithm",
            "united",
            "name",
            "type",
            "tsara brashears",
            "trojan",
            "key identifier",
            "key info",
            "land use",
            "link location",
            "united tls web",
            "tls web",
            "log id",
            "malvertizing",
            "malware",
            "http",
            "meekserver",
            "meta",
            "metasploit",
            "admin",
            "subject",
            "ransomware",
            "stop ransomware",
            "certificate status",
            "metro",
            "moved",
            "name servers",
            "netsupport rat",
            "number",
            "nxdomain",
            "passive dns",
            "servers",
            "server",
            "pegasus",
            "pingback",
            "submit",
            "ransom",
            "raspberry robin",
            "subject public",
            "subject key",
            "subject billing",
            "pdf broadcom",
            "pulse pulses",
            "pulse submit",
            "read c",
            "record value",
            "redacted referrer",
            "regbinary",
            "regdword",
            "registrant fax",
            "registrar",
            "registrar abuse",
            "registry domain",
            "registrar of",
            "registry policy",
            "regsetvalueexa",
            "regsetvalueexw",
            "show",
            "showing",
            "search",
            "urls",
            "script",
            "script domains",
            "scan endpoints",
            "russia unknown",
            "reverse dns",
            "resolutions",
            "nids",
            "related nids",
            "as39494 jsc",
            "body",
            "attorney james",
            "asn as133618",
            "javascript",
            "unknown",
            "url analysis",
            "unknown url",
            "url http",
            "v3 serial",
            "http",
            "as40528 icann",
            "as44273 host",
            "data center",
            "hosting",
            "vps",
            "reverse dns"
          ],
          "references": [
            "deviceinbox.com [Malware Hosting - Pegasus]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
            "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
            "103.224.182.253 [Command and Control]",
            "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b60b85453c45eca795034d",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 77,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 359,
            "URL": 218,
            "SSLCertFingerprint": 2,
            "domain": 1932,
            "email": 12,
            "hostname": 528
          },
          "indicator_count": 3209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "782 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b3fe6c4cd0f5158eb18692",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader,",
          "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA. Contact made. Physical records. Client: Brashears. https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/ 1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376 https://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/ https://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html TEL:Trojan:Win32/BazaarLoader 987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7https://www.joesandbox.com/analysis/1311477\nTarget: Critical Risk. In person contact made. Fraud services offered. \nThis is crazy.",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-26T18:48:12.433000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1509,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4239,
            "domain": 3480,
            "hostname": 2466,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 15854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b47501fcbc39983f098723",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-27T03:14:09.392000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b3fe6c4cd0f5158eb18692",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1509,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4239,
            "domain": 3480,
            "hostname": 2466,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 15854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b47524b1ec6b5c783a832e",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-27T03:14:44.070000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b3fb6752ac464268b971b1",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1530,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5239,
            "domain": 3740,
            "hostname": 2560,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17661,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80982381b53c66f0dd1e1",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-29T20:24:34.644000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b47524b1ec6b5c783a832e",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1530,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5239,
            "domain": 3740,
            "hostname": 2560,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17661,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be8dde8544d0b022b4c464",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage  | Emotet ",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-02-03T19:02:54.507000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b85df45cc3d3fd07139ea9",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1509,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4239,
            "domain": 3480,
            "hostname": 2466,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 15854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
        "wallpapers-nature.com",
        "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
        "Link found in https://house.mo.com",
        "https://www.facebooksunglassshop.com/",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
        "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
        "103.224.182.253 [Command and Control]",
        "edgedl.me.gvt1.com",
        "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
        "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
        "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
        "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Silent",
            "Hacktool",
            "Orcus rat",
            "Hiddentear",
            "Redline stealer",
            "Pegasus",
            "Invicta stealer",
            "Quasar rat"
          ],
          "industries": [
            "Civil society",
            "Government",
            "Technology"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 11,
  "pulses": [
    {
      "id": "69e2cc9ebd63c32d9c0392c6",
      "name": "Hidden Tear BruteForcer Clone Credit OctoSeek",
      "description": "",
      "modified": "2026-04-18T00:13:18.484000",
      "created": "2026-04-18T00:13:18.484000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "url https",
        "iocs",
        "filehashsha1",
        "next",
        "x509v3",
        "key",
        "windows",
        "write",
        "whois ssl",
        "whois whois",
        "win32",
        "198-46-194-153-host.colocrossing.com",
        "a domains",
        "a nxdomain",
        "aaaa",
        "accept",
        "adapter driver",
        "address",
        "address domain",
        "algorithm",
        "all octoseek",
        "cookie",
        "copy",
        "core",
        "domain names",
        "domain",
        "dnssec",
        "discord",
        "whois record",
        "cyberstalking",
        "d417n",
        "timestamp",
        "data",
        "subject",
        "cyberstalking",
        "creation date",
        "ipv4",
        "ip address",
        "http identifier",
        "hostname",
        "historical ssl",
        "highly targeted",
        "high level",
        "high",
        "hiddentear",
        "gmtn",
        "germany unknown",
        "location first",
        "ip files",
        "files",
        "false files",
        "eu data",
        "entries",
        "download encrypt",
        "encrypt",
        "download",
        "contacted",
        "communicating",
        "coinminer",
        "code",
        "cobalt strike",
        "cname",
        "click",
        "ca issuers",
        "issuers",
        "as133618",
        "as24940",
        "hetzner",
        "as26710",
        "icann",
        "as36352",
        "as24940 hetzner",
        "asn as133618",
        "as26710 icann",
        "apple as8075",
        "as47846",
        "as47995",
        "key algorithm",
        "united",
        "name",
        "type",
        "tsara brashears",
        "trojan",
        "key identifier",
        "key info",
        "land use",
        "link location",
        "united tls web",
        "tls web",
        "log id",
        "malvertizing",
        "malware",
        "http",
        "meekserver",
        "meta",
        "metasploit",
        "admin",
        "subject",
        "ransomware",
        "stop ransomware",
        "certificate status",
        "metro",
        "moved",
        "name servers",
        "netsupport rat",
        "number",
        "nxdomain",
        "passive dns",
        "servers",
        "server",
        "pegasus",
        "pingback",
        "submit",
        "ransom",
        "raspberry robin",
        "subject public",
        "subject key",
        "subject billing",
        "pdf broadcom",
        "pulse pulses",
        "pulse submit",
        "read c",
        "record value",
        "redacted referrer",
        "regbinary",
        "regdword",
        "registrant fax",
        "registrar",
        "registrar abuse",
        "registry domain",
        "registrar of",
        "registry policy",
        "regsetvalueexa",
        "regsetvalueexw",
        "show",
        "showing",
        "search",
        "urls",
        "script",
        "script domains",
        "scan endpoints",
        "russia unknown",
        "reverse dns",
        "resolutions",
        "nids",
        "related nids",
        "as39494 jsc",
        "body",
        "attorney james",
        "asn as133618",
        "javascript",
        "unknown",
        "url analysis",
        "unknown url",
        "url http",
        "v3 serial",
        "http",
        "as40528 icann",
        "as44273 host",
        "data center",
        "hosting",
        "vps",
        "reverse dns"
      ],
      "references": [
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "103.224.182.253 [Command and Control]",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b60b85453c45eca795034d",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 77,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 359,
        "URL": 218,
        "SSLCertFingerprint": 2,
        "domain": 1932,
        "email": 12,
        "hostname": 528
      },
      "indicator_count": 3209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "1 day ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b3fb6752ac464268b971b1",
      "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
      "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA.\nContact made. Physical records. Client: Brashears.\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/\n1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376\nhttps://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/\nhttps://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html\nTEL:Trojan:Win32/BazaarLoader\n987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7",
      "modified": "2024-09-05T07:02:20.491000",
      "created": "2024-01-26T18:35:19.690000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as3356 level",
        "as15133 verizon",
        "as22822",
        "as20446",
        "cname",
        "honeypot",
        "read c",
        "regsetvalueexa",
        "regdword",
        "as29789",
        "moved",
        "morphex",
        "cryp",
        "susp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2401,
        "FileHash-MD5": 2428,
        "FileHash-SHA1": 2136,
        "FileHash-SHA256": 5377,
        "domain": 3794,
        "hostname": 2763,
        "CVE": 5,
        "email": 19,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 18927,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85df45cc3d3fd07139ea9",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
      "description": "",
      "modified": "2024-09-05T06:38:09.443000",
      "created": "2024-01-30T02:24:52.774000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b47501fcbc39983f098723",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2390,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4357,
        "domain": 3534,
        "hostname": 2670,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 17111,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65caca061fbb7674de86ec7b",
      "name": "Invicta Stealer",
      "description": "Invicta Stealer is equipped to steal data from most locations of a system which makes it a dangerous threat.\nLink found in https://house.mo.com",
      "modified": "2024-03-14T01:01:47.115000",
      "created": "2024-02-13T01:46:46.969000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "resolutions",
        "communicating",
        "whois whois",
        "subdomains",
        "referrer",
        "problems",
        "core",
        "startpage",
        "june",
        "passive dns",
        "urls",
        "domain",
        "otx telemetry",
        "body",
        "gmt content",
        "x adblock",
        "scan endpoints",
        "all octoseek",
        "hostname",
        "date",
        "encrypt",
        "threat roundup",
        "october",
        "november",
        "march",
        "february",
        "apple ios",
        "april",
        "tsara brashears",
        "copy",
        "hacktool",
        "phishing",
        "metro",
        "crypto",
        "installer",
        "awful",
        "united",
        "unknown",
        "germany unknown",
        "search",
        "servers",
        "registrar",
        "name servers",
        "status",
        "next",
        "moved",
        "address",
        "creation date",
        "showing",
        "ipv4",
        "pulse submit",
        "url analysis",
        "accept",
        "aaaa",
        "record type",
        "ttl value",
        "html document",
        "ascii text",
        "anchor hrefs",
        "hrefs",
        "anchor",
        "anchor href",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "url https",
        "sample",
        "server",
        "code",
        "registry domain",
        "dnssec",
        "registrar url",
        "registrar whois",
        "iana id",
        "registrar abuse",
        "tech email",
        "fake update",
        "utilizes new",
        "idat loader",
        "stealc",
        "urls http",
        "isadultno",
        "adposbottom",
        "adformatplain",
        "adnetworks",
        "quasar rat",
        "ip detections",
        "country",
        "cellbrite",
        "execution",
        "pegasus",
        "malware",
        "agent tesla",
        "attack",
        "ukraine",
        "silent",
        "invicta stealer",
        "redline stealer",
        "orcus rat",
        "files",
        "germany asn",
        "as196763",
        "a domains",
        "redacted for",
        "record value",
        "for privacy",
        "emails",
        "name",
        "contacted urls",
        "bundled",
        "de indicators",
        "domains",
        "hashes",
        "gmbh version",
        "status page",
        "service privacy",
        "legal",
        "impressum",
        "pulse pulses",
        "location united",
        "open",
        "cookie",
        "customer",
        "0 report",
        "sea alt",
        "certificate",
        "#targeting",
        "#discordwallets",
        "house.mo.gov"
      ],
      "references": [
        "https://www.facebooksunglassshop.com/",
        "CVE-2017-0147 \u2022 CVE-2023-4966 \u2022 CVE-2023-22518",
        "https://ispy-official.com/ X Cache: Redirect from cloudfront Via: 1.1 030fe0607711293dda988e571617a9f2.cloudfront.net CloudFront X Amz Cf",
        "Pop: HIO50 C1 X Amz Cf Id: Jt aBPO2nI3Nt D0E4nzqpun66btDLhJ41kQwhDASrIukoWyUOWE1w==",
        "apple.com-auth.eu [Find apple] | https://applemusic-spotlight.myunidays.com/US/en-US? [compromise via apple media]",
        "http://init-p01st.push.apple.com/bag [= Google.com.uy modified browser - malicious] apple.com-auth.eu \u2022 appleid.apple.com-auth.eu\u2022",
        "https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635 [apple media compromise. Pega behavior?]",
        "all-live.secure2storeapple.xxianzi.com \u2022 https://www.symbios.pk/apple-ipod-5-32gb",
        "http://m.xiang5.com/keyword/17655.html&ht=%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%8D%E8%B4%B9%E9%98%85%E8%AF%BB_%E9%98%BF%E6%BD%BC%E5%B0%8F%E8%AF%B4%E5%9C%A8%E7%BA%BF%E9%98%85%E8%AF%BB%E5%85%A8%E6%9C%AC%E6%97%A0%E5%BC%B9%E7%AA%97-%E9%A6%99%E7%BD%91%E5%B0%8F%E8%AF%B4%E6%89%8B%E6%9C%BA%E7%89%88&uaddr=https:/www.sogou.com/link?url=58p16RfDRLtDzo-0AEmfJoGs8rDRUEq4ejjohgXqBYnQGuHk6xSRXg..&h=1080&w=1920&cd=24&lg=zh-CN&ua=mozilla/5.0%20(windows%20nt%2010.0;%20win64;%20x64)%20",
        "Tracking: mailtrack.io \u2022 nr-data.net \u2022 tracking.bullseyeedu.com \u2022 https://smtp.mail.pentrack.com \u2022 tracking.vetsindexes.com",
        "Remote threats: http://watchhers.net/index.php \u2022 http://eye.infunvip.com/appinterface/other/login.remote",
        "https://plussizedesi.com/wp-content/uploads/2022/07/SniperGhostWarrior2BlackBox_Version_Download_INSTALL.pdf",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password decryption]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [ phishing \u2022 apple collection]",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "wallpapers-nature.com",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "hello-world-mute-unit-3072.a-rahimi-farahani.workers.dev",
        "edgedl.me.gvt1.com",
        "Link found in https://house.mo.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Invicta Stealer",
          "display_name": "Invicta Stealer",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "Orcus RAT",
          "display_name": "Orcus RAT",
          "target": null
        },
        {
          "id": "Silent",
          "display_name": "Silent",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Government",
        "Civil Society",
        "Technology"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 65,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 153,
        "FileHash-SHA1": 145,
        "FileHash-SHA256": 3848,
        "CVE": 3,
        "URL": 8291,
        "domain": 2541,
        "hostname": 3034,
        "email": 13
      },
      "indicator_count": 18028,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "766 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b60b85453c45eca795034d",
      "name": "Hidden Tear BruteForcer",
      "description": "\u2022 The Hidden Tear BruteForcer is a program created by Michael Gillespie that can be used to brute force the password for ransomware infections. A ransomware-like file crypter sample which can be modified for specific purposes. Features. Uses AES algorithm to encrypt files. Can be downloaded for free for anyone to download in GitHub. Many cyber criminals, lawyers, investigators and governments use this project.\n\u2022 Raspberry Robin is an activity cluster spread by external drives that leverages Windows Installer.",
      "modified": "2024-02-27T06:04:19.663000",
      "created": "2024-01-28T08:08:37.586000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "url https",
        "iocs",
        "filehashsha1",
        "next",
        "x509v3",
        "key",
        "windows",
        "write",
        "whois ssl",
        "whois whois",
        "win32",
        "198-46-194-153-host.colocrossing.com",
        "a domains",
        "a nxdomain",
        "aaaa",
        "accept",
        "adapter driver",
        "address",
        "address domain",
        "algorithm",
        "all octoseek",
        "cookie",
        "copy",
        "core",
        "domain names",
        "domain",
        "dnssec",
        "discord",
        "whois record",
        "cyberstalking",
        "d417n",
        "timestamp",
        "data",
        "subject",
        "cyberstalking",
        "creation date",
        "ipv4",
        "ip address",
        "http identifier",
        "hostname",
        "historical ssl",
        "highly targeted",
        "high level",
        "high",
        "hiddentear",
        "gmtn",
        "germany unknown",
        "location first",
        "ip files",
        "files",
        "false files",
        "eu data",
        "entries",
        "download encrypt",
        "encrypt",
        "download",
        "contacted",
        "communicating",
        "coinminer",
        "code",
        "cobalt strike",
        "cname",
        "click",
        "ca issuers",
        "issuers",
        "as133618",
        "as24940",
        "hetzner",
        "as26710",
        "icann",
        "as36352",
        "as24940 hetzner",
        "asn as133618",
        "as26710 icann",
        "apple as8075",
        "as47846",
        "as47995",
        "key algorithm",
        "united",
        "name",
        "type",
        "tsara brashears",
        "trojan",
        "key identifier",
        "key info",
        "land use",
        "link location",
        "united tls web",
        "tls web",
        "log id",
        "malvertizing",
        "malware",
        "http",
        "meekserver",
        "meta",
        "metasploit",
        "admin",
        "subject",
        "ransomware",
        "stop ransomware",
        "certificate status",
        "metro",
        "moved",
        "name servers",
        "netsupport rat",
        "number",
        "nxdomain",
        "passive dns",
        "servers",
        "server",
        "pegasus",
        "pingback",
        "submit",
        "ransom",
        "raspberry robin",
        "subject public",
        "subject key",
        "subject billing",
        "pdf broadcom",
        "pulse pulses",
        "pulse submit",
        "read c",
        "record value",
        "redacted referrer",
        "regbinary",
        "regdword",
        "registrant fax",
        "registrar",
        "registrar abuse",
        "registry domain",
        "registrar of",
        "registry policy",
        "regsetvalueexa",
        "regsetvalueexw",
        "show",
        "showing",
        "search",
        "urls",
        "script",
        "script domains",
        "scan endpoints",
        "russia unknown",
        "reverse dns",
        "resolutions",
        "nids",
        "related nids",
        "as39494 jsc",
        "body",
        "attorney james",
        "asn as133618",
        "javascript",
        "unknown",
        "url analysis",
        "unknown url",
        "url http",
        "v3 serial",
        "http",
        "as40528 icann",
        "as44273 host",
        "data center",
        "hosting",
        "vps",
        "reverse dns"
      ],
      "references": [
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "103.224.182.253 [Command and Control]",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 77,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 359,
        "URL": 218,
        "SSLCertFingerprint": 2,
        "domain": 1932,
        "email": 12,
        "hostname": 528
      },
      "indicator_count": 3209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "782 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b8086a651e881715b3fc47",
      "name": "Hidden Tear BruteForcer",
      "description": "",
      "modified": "2024-02-27T06:04:19.663000",
      "created": "2024-01-29T20:19:54.173000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "url https",
        "iocs",
        "filehashsha1",
        "next",
        "x509v3",
        "key",
        "windows",
        "write",
        "whois ssl",
        "whois whois",
        "win32",
        "198-46-194-153-host.colocrossing.com",
        "a domains",
        "a nxdomain",
        "aaaa",
        "accept",
        "adapter driver",
        "address",
        "address domain",
        "algorithm",
        "all octoseek",
        "cookie",
        "copy",
        "core",
        "domain names",
        "domain",
        "dnssec",
        "discord",
        "whois record",
        "cyberstalking",
        "d417n",
        "timestamp",
        "data",
        "subject",
        "cyberstalking",
        "creation date",
        "ipv4",
        "ip address",
        "http identifier",
        "hostname",
        "historical ssl",
        "highly targeted",
        "high level",
        "high",
        "hiddentear",
        "gmtn",
        "germany unknown",
        "location first",
        "ip files",
        "files",
        "false files",
        "eu data",
        "entries",
        "download encrypt",
        "encrypt",
        "download",
        "contacted",
        "communicating",
        "coinminer",
        "code",
        "cobalt strike",
        "cname",
        "click",
        "ca issuers",
        "issuers",
        "as133618",
        "as24940",
        "hetzner",
        "as26710",
        "icann",
        "as36352",
        "as24940 hetzner",
        "asn as133618",
        "as26710 icann",
        "apple as8075",
        "as47846",
        "as47995",
        "key algorithm",
        "united",
        "name",
        "type",
        "tsara brashears",
        "trojan",
        "key identifier",
        "key info",
        "land use",
        "link location",
        "united tls web",
        "tls web",
        "log id",
        "malvertizing",
        "malware",
        "http",
        "meekserver",
        "meta",
        "metasploit",
        "admin",
        "subject",
        "ransomware",
        "stop ransomware",
        "certificate status",
        "metro",
        "moved",
        "name servers",
        "netsupport rat",
        "number",
        "nxdomain",
        "passive dns",
        "servers",
        "server",
        "pegasus",
        "pingback",
        "submit",
        "ransom",
        "raspberry robin",
        "subject public",
        "subject key",
        "subject billing",
        "pdf broadcom",
        "pulse pulses",
        "pulse submit",
        "read c",
        "record value",
        "redacted referrer",
        "regbinary",
        "regdword",
        "registrant fax",
        "registrar",
        "registrar abuse",
        "registry domain",
        "registrar of",
        "registry policy",
        "regsetvalueexa",
        "regsetvalueexw",
        "show",
        "showing",
        "search",
        "urls",
        "script",
        "script domains",
        "scan endpoints",
        "russia unknown",
        "reverse dns",
        "resolutions",
        "nids",
        "related nids",
        "as39494 jsc",
        "body",
        "attorney james",
        "asn as133618",
        "javascript",
        "unknown",
        "url analysis",
        "unknown url",
        "url http",
        "v3 serial",
        "http",
        "as40528 icann",
        "as44273 host",
        "data center",
        "hosting",
        "vps",
        "reverse dns"
      ],
      "references": [
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "103.224.182.253 [Command and Control]",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b60b85453c45eca795034d",
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 77,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 359,
        "URL": 218,
        "SSLCertFingerprint": 2,
        "domain": 1932,
        "email": 12,
        "hostname": 528
      },
      "indicator_count": 3209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "782 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b3fe6c4cd0f5158eb18692",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader,",
      "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA. Contact made. Physical records. Client: Brashears. https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/ 1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376 https://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/ https://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html TEL:Trojan:Win32/BazaarLoader 987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7https://www.joesandbox.com/analysis/1311477\nTarget: Critical Risk. In person contact made. Fraud services offered. \nThis is crazy.",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-26T18:48:12.433000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1509,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4239,
        "domain": 3480,
        "hostname": 2466,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 15854,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b47501fcbc39983f098723",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-27T03:14:09.392000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b3fe6c4cd0f5158eb18692",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1509,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4239,
        "domain": 3480,
        "hostname": 2466,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 15854,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b47524b1ec6b5c783a832e",
      "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-27T03:14:44.070000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as3356 level",
        "as15133 verizon",
        "as22822",
        "as20446",
        "cname",
        "honeypot",
        "read c",
        "regsetvalueexa",
        "regdword",
        "as29789",
        "moved",
        "morphex",
        "cryp",
        "susp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b3fb6752ac464268b971b1",
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1530,
        "FileHash-MD5": 2428,
        "FileHash-SHA1": 2136,
        "FileHash-SHA256": 5239,
        "domain": 3740,
        "hostname": 2560,
        "CVE": 5,
        "email": 19,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 17661,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80982381b53c66f0dd1e1",
      "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-29T20:24:34.644000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as3356 level",
        "as15133 verizon",
        "as22822",
        "as20446",
        "cname",
        "honeypot",
        "read c",
        "regsetvalueexa",
        "regdword",
        "as29789",
        "moved",
        "morphex",
        "cryp",
        "susp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b47524b1ec6b5c783a832e",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1530,
        "FileHash-MD5": 2428,
        "FileHash-SHA1": 2136,
        "FileHash-SHA256": 5239,
        "domain": 3740,
        "hostname": 2560,
        "CVE": 5,
        "email": 19,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 17661,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "benefitsofcloves.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "benefitsofcloves.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776630060.549814
}