{
  "type": "Domain",
  "indicator": "equalhers.net",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/equalhers.net",
    "alexa": "http://www.alexa.com/siteinfo/equalhers.net",
    "indicator": "equalhers.net",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 2187327302,
      "indicator": "equalhers.net",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "65c7b86fa120d19bbc88f367",
          "name": "Hijacker",
          "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
          "modified": "2024-03-11T17:01:59.026000",
          "created": "2024-02-10T17:54:55.243000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "tsara brashears",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "high level",
            "hackers",
            "hacktool",
            "download",
            "malware",
            "crypto",
            "hijacker",
            "monitoring",
            "installer",
            "tofsee",
            "domains domains",
            "domains files",
            "files files",
            "script",
            "kgs0",
            "kls0",
            "relic",
            "iframe",
            "pe32 executable",
            "ms windows",
            "intel",
            "win16 ne",
            "os2 executable",
            "generic windos",
            "executable",
            "dos executable",
            "generic",
            "rticon neutral",
            "info compiler",
            "products id",
            "header intel",
            "name md5",
            "contained",
            "type",
            "language",
            "ico rtgroupicon",
            "neutral",
            "first",
            "utc submissions",
            "submitters",
            "company limited",
            "computer",
            "amazonaes",
            "china telecom",
            "group",
            "csc corporate",
            "domains",
            "malware spreading evader",
            "cnc",
            "malvertizing",
            "milehighmedia",
            "trojandropper",
            "moved",
            "passive dns",
            "urls",
            "as14576",
            "backdoor",
            "scan endpoints",
            "all octoseek",
            "ipv4",
            "pulse pulses",
            "trojan",
            "encrypt",
            "body",
            "date",
            "date hash",
            "avast avg",
            "mtb may",
            "kratona",
            "threat",
            "paste",
            "iocs",
            "analyze",
            "hostnames",
            "urls https",
            "script urls",
            "united",
            "meta",
            "unknown",
            "emails",
            "name servers",
            "search",
            "as62597 nsone",
            "a domains",
            "as397241",
            "media",
            "next",
            "december",
            "unlocker",
            "threat round",
            "apple ios",
            "apple phone",
            "project",
            "blister",
            "agent tesla",
            "open",
            "execution",
            "videos",
            "strong",
            "porn videos",
            "watch",
            "daddy",
            "free",
            "top rated",
            "most viewed",
            "cancel anytime",
            "views",
            "play",
            "black",
            "enjoy",
            "czech",
            "hunk",
            "virtool",
            "cryp",
            "creation date",
            "otx telemetry",
            "expiration date",
            "servers",
            "status",
            "win32",
            "showing",
            "domain",
            "nxdomain",
            "as8075",
            "shell code",
            "threat",
            "cyber espionage",
            "cyber stalking",
            "danger",
            "critical",
            "attack",
            "treats",
            "as15169 google",
            "aaaa",
            "record value",
            "error",
            "entries",
            "hostname",
            "url http",
            "http",
            "files domain",
            "files related",
            "shinjiru msc",
            "sdn bhd",
            "dnssec",
            "protect",
            "as54455 madeit",
            "phishing",
            "backdoor",
            "contextualizing",
            "elevated exposure",
            "malvertizing",
            "ransom",
            "msil",
            "hackers for hire",
            "hashes",
            "http method",
            "get http",
            "http requests",
            "get dns",
            "ip traffic",
            "memory pattern",
            "pattern ips",
            "@emreimer",
            "iextract2",
            "cp cyber",
            "denver",
            "security",
            "siem compliance",
            "skip",
            "cybersecurity",
            "larimer st",
            "suite",
            "resources cyber",
            "risk assessment",
            "bill",
            "mind",
            "delaware",
            "pa",
            "arizona",
            "colorado",
            "stalkers",
            "deuteronomy 28:7",
            "hitmen"
          ],
          "references": [
            "honey.exe",
            "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
            "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
            "CS Sigma Rules: Python Initiated Connection by frack113",
            "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
            "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
            "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
            "api.login.live.com",
            "http://appleid.icloud.com-website33.org/",
            "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
            "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
            "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
            "message.htm.com",
            "http://pornhub.com/gay/video/search",
            "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
            "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "W32.Sality.PE",
              "display_name": "W32.Sality.PE",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Virus.Win32.Virut.q",
              "display_name": "Virus.Win32.Virut.q",
              "target": null
            },
            {
              "id": "VirTool",
              "display_name": "VirTool",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32",
              "display_name": "TrojanDropper:Win32",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "TA0001",
              "name": "Initial Access",
              "display_name": "TA0001 - Initial Access"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "TA0034",
              "name": "Impact",
              "display_name": "TA0034 - Impact"
            },
            {
              "id": "TA0040",
              "name": "Impact",
              "display_name": "TA0040 - Impact"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.002",
              "name": "File Transfer Protocols",
              "display_name": "T1071.002 - File Transfer Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1415",
              "name": "URL Scheme Hijacking",
              "display_name": "T1415 - URL Scheme Hijacking"
            },
            {
              "id": "T1122",
              "name": "Component Object Model Hijacking",
              "display_name": "T1122 - Component Object Model Hijacking"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 54,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 6303,
            "FileHash-MD5": 215,
            "FileHash-SHA1": 192,
            "FileHash-SHA256": 2663,
            "domain": 2673,
            "hostname": 2686,
            "CVE": 2,
            "email": 16
          },
          "indicator_count": 14750,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "769 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65944a8149f2479b2fbc6cd1",
          "name": "Relic",
          "description": "Malicious redirect to BotNet malvertizing of a business affecting both .command YouTube distribution. YouTube encoded logins. Hacker attack, geo tracking, passwords crack, decryption, C2. Retaliation. Found in referenced Twitter link shared  with me.",
          "modified": "2024-02-01T14:01:46.735000",
          "created": "2024-01-02T17:40:17.890000",
          "tags": [
            "ioc search",
            "new ioc",
            "teams api",
            "contact",
            "threat analyzer",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers nel",
            "maxage5184000",
            "name verdict",
            "falcon sandbox",
            "whois record",
            "ssl certificate",
            "tsara brashears",
            "whois whois",
            "historical ssl",
            "contacted",
            "highly targeted",
            "hackers",
            "botnet",
            "apple ios",
            "malicious",
            "hacktool",
            "quasar",
            "download",
            "malware",
            "relic",
            "monitoring",
            "installer",
            "tofsee",
            "getprocaddress",
            "indicator",
            "prefetch8",
            "mitre att",
            "ck id",
            "show technique",
            "ck matrix",
            "united",
            "file",
            "pattern match",
            "path",
            "date",
            "win64",
            "factory",
            "model",
            "comspec",
            "hybrid",
            "general",
            "click",
            "strings",
            "patch",
            "song culture",
            "tulach"
          ],
          "references": [
            "rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker",
            "https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d",
            "https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,",
            "https://twitter.com/sheriffspurlock?lang=en",
            "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8",
            "http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru",
            "nr-data.net [Apple Private Data Collection]",
            "init.ess.apple.com [backdoor, malicious script, access via media]",
            "https://stackabuse.com/assets/images/apple",
            "https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err",
            "location-icloud.com",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign]",
            "mailtrack.io [tracking VirusTotal graphs, link trace back]",
            "http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=\u00aeion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes",
            "https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=",
            "https://pin.it/ [faux Pinterest for TB]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [",
            "114.114.114.114 [ Tulach Malware IP]",
            "13.107.136.8  [ Tulach Malware IP redirect]",
            "http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe]",
            "http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior]",
            "http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_",
            "http://114.114.114.114/ipw.ps1",
            "194.245.148.189 [CnC]",
            "https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/",
            "http://109.206.241.129/666bins/666.mpsl",
            "http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2",
            "143.244.50.213 |169.150.249.162  [malware_hosting]",
            "http://watchhers.net/index.php [malware spreader]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration\t0\t  Domain twitter.com No Expiration\t0\t  Hostname www.pornhub.com No Expiration\t0\t  URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration\t0\t  URL",
            "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
            "xred.mooo.com [pornhub trojan]",
            "https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious]",
            "http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\\george",
            "https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking]"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Tofsee",
              "display_name": "Tofsee",
              "target": null
            },
            {
              "id": "Quasar RAT",
              "display_name": "Quasar RAT",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Comspec",
              "display_name": "Comspec",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1083",
              "name": "File and Directory Discovery",
              "display_name": "T1083 - File and Directory Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1106",
              "name": "Native API",
              "display_name": "T1106 - Native API"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1546",
              "name": "Event Triggered Execution",
              "display_name": "T1546 - Event Triggered Execution"
            },
            {
              "id": "T1588",
              "name": "Obtain Capabilities",
              "display_name": "T1588 - Obtain Capabilities"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1041",
              "name": "Exfiltration Over C2 Channel",
              "display_name": "T1041 - Exfiltration Over C2 Channel"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 25,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 8049,
            "FileHash-MD5": 388,
            "FileHash-SHA1": 212,
            "FileHash-SHA256": 7062,
            "domain": 4401,
            "hostname": 2653,
            "CVE": 2,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 22769,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "808 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://appleid.icloud.com-website33.org/",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=",
        "https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "location-icloud.com",
        "http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru",
        "http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://watchhers.net/index.php [malware spreader]",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign]",
        "http://pornhub.com/gay/video/search",
        "honey.exe",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "194.245.148.189 [CnC]",
        "xred.mooo.com [pornhub trojan]",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\\george",
        "http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe]",
        "114.114.114.114 [ Tulach Malware IP]",
        "http://114.114.114.114/ipw.ps1",
        "https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "13.107.136.8  [ Tulach Malware IP redirect]",
        "https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious]",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "https://stackabuse.com/assets/images/apple",
        "143.244.50.213 |169.150.249.162  [malware_hosting]",
        "rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker",
        "http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=\u00aeion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes",
        "init.ess.apple.com [backdoor, malicious script, access via media]",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration\t0\t  Domain twitter.com No Expiration\t0\t  Hostname www.pornhub.com No Expiration\t0\t  URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration\t0\t  URL",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [",
        "message.htm.com",
        "mailtrack.io [tracking VirusTotal graphs, link trace back]",
        "https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/",
        "http://109.206.241.129/666bins/666.mpsl",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "https://pin.it/ [faux Pinterest for TB]",
        "https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err",
        "nr-data.net [Apple Private Data Collection]",
        "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8",
        "http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_",
        "https://twitter.com/sheriffspurlock?lang=en",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking]",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "api.login.live.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Hacktool",
            "Trojandropper:win32",
            "W32.sality.pe",
            "Virtool",
            "Quasar rat",
            "Trojanspy",
            "Relic",
            "Comspec",
            "Tulach",
            "Tofsee",
            "Virus.win32.virut.q"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "65c7b86fa120d19bbc88f367",
      "name": "Hijacker",
      "description": "Hackers hired to humiliate, threaten,steal data, evidence, recordings , spy and intimidate.",
      "modified": "2024-03-11T17:01:59.026000",
      "created": "2024-02-10T17:54:55.243000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "tsara brashears",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "high level",
        "hackers",
        "hacktool",
        "download",
        "malware",
        "crypto",
        "hijacker",
        "monitoring",
        "installer",
        "tofsee",
        "domains domains",
        "domains files",
        "files files",
        "script",
        "kgs0",
        "kls0",
        "relic",
        "iframe",
        "pe32 executable",
        "ms windows",
        "intel",
        "win16 ne",
        "os2 executable",
        "generic windos",
        "executable",
        "dos executable",
        "generic",
        "rticon neutral",
        "info compiler",
        "products id",
        "header intel",
        "name md5",
        "contained",
        "type",
        "language",
        "ico rtgroupicon",
        "neutral",
        "first",
        "utc submissions",
        "submitters",
        "company limited",
        "computer",
        "amazonaes",
        "china telecom",
        "group",
        "csc corporate",
        "domains",
        "malware spreading evader",
        "cnc",
        "malvertizing",
        "milehighmedia",
        "trojandropper",
        "moved",
        "passive dns",
        "urls",
        "as14576",
        "backdoor",
        "scan endpoints",
        "all octoseek",
        "ipv4",
        "pulse pulses",
        "trojan",
        "encrypt",
        "body",
        "date",
        "date hash",
        "avast avg",
        "mtb may",
        "kratona",
        "threat",
        "paste",
        "iocs",
        "analyze",
        "hostnames",
        "urls https",
        "script urls",
        "united",
        "meta",
        "unknown",
        "emails",
        "name servers",
        "search",
        "as62597 nsone",
        "a domains",
        "as397241",
        "media",
        "next",
        "december",
        "unlocker",
        "threat round",
        "apple ios",
        "apple phone",
        "project",
        "blister",
        "agent tesla",
        "open",
        "execution",
        "videos",
        "strong",
        "porn videos",
        "watch",
        "daddy",
        "free",
        "top rated",
        "most viewed",
        "cancel anytime",
        "views",
        "play",
        "black",
        "enjoy",
        "czech",
        "hunk",
        "virtool",
        "cryp",
        "creation date",
        "otx telemetry",
        "expiration date",
        "servers",
        "status",
        "win32",
        "showing",
        "domain",
        "nxdomain",
        "as8075",
        "shell code",
        "threat",
        "cyber espionage",
        "cyber stalking",
        "danger",
        "critical",
        "attack",
        "treats",
        "as15169 google",
        "aaaa",
        "record value",
        "error",
        "entries",
        "hostname",
        "url http",
        "http",
        "files domain",
        "files related",
        "shinjiru msc",
        "sdn bhd",
        "dnssec",
        "protect",
        "as54455 madeit",
        "phishing",
        "backdoor",
        "contextualizing",
        "elevated exposure",
        "malvertizing",
        "ransom",
        "msil",
        "hackers for hire",
        "hashes",
        "http method",
        "get http",
        "http requests",
        "get dns",
        "ip traffic",
        "memory pattern",
        "pattern ips",
        "@emreimer",
        "iextract2",
        "cp cyber",
        "denver",
        "security",
        "siem compliance",
        "skip",
        "cybersecurity",
        "larimer st",
        "suite",
        "resources cyber",
        "risk assessment",
        "bill",
        "mind",
        "delaware",
        "pa",
        "arizona",
        "colorado",
        "stalkers",
        "deuteronomy 28:7",
        "hitmen"
      ],
      "references": [
        "honey.exe",
        "0001c8afa9ca148752e1439140fadb6571b27f455ad1474d85625bcddfb63550",
        "CS Sigma Rules: Suspicious Remote Thread Created by Perez Diego (@darkquassar), oscd.community",
        "CS Sigma Rules: Python Initiated Connection by frack113",
        "CS Sigma Rules: Use Remove-Item to Delete File by frack113",
        "CS Sigma Rules: Suspicious Userinit Child Process by Florian Roth (rule), Samir Bousseaden (idea)",
        "Relationship: http://www.cpmfun.com/go.php?i=Zml0sXNlQhR0gRzjdXpLNlz4&p=71408&s=1&m=1&ua=mozilla/5.0+(linux;+android+4.4.2;+ast21+build/kvt49l)+",
        "api.login.live.com",
        "http://appleid.icloud.com-website33.org/",
        "https://www.milehighmedia.com/legal/2257 [phishing \u2022 Brazzers porn]",
        "FileHash-SHA256 c030b0a1be8745d192f45.159.189.105743b3c4f4094f33507a5904c184c8db0bde1a91efccb5  [tracking]",
        "http://45.159.189.105/bot/regex [Tracking Tsara Brashears involves in person following and or harassment as well]",
        "message.htm.com",
        "http://pornhub.com/gay/video/search",
        "CnC IP's: 206.189.61.126 \u2022 217.74.65.23 \u2022 46.8.8.100 \u2022 64.190.63.111",
        "stop following, stalking, hacking, talking, modifying, hijacking, threatening, contacting, sending people to harass target, threats",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "W32.Sality.PE",
          "display_name": "W32.Sality.PE",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Virus.Win32.Virut.q",
          "display_name": "Virus.Win32.Virut.q",
          "target": null
        },
        {
          "id": "VirTool",
          "display_name": "VirTool",
          "target": null
        },
        {
          "id": "TrojanDropper:Win32",
          "display_name": "TrojanDropper:Win32",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "TA0001",
          "name": "Initial Access",
          "display_name": "TA0001 - Initial Access"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "TA0034",
          "name": "Impact",
          "display_name": "TA0034 - Impact"
        },
        {
          "id": "TA0040",
          "name": "Impact",
          "display_name": "TA0040 - Impact"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.002",
          "name": "File Transfer Protocols",
          "display_name": "T1071.002 - File Transfer Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1415",
          "name": "URL Scheme Hijacking",
          "display_name": "T1415 - URL Scheme Hijacking"
        },
        {
          "id": "T1122",
          "name": "Component Object Model Hijacking",
          "display_name": "T1122 - Component Object Model Hijacking"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 54,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 6303,
        "FileHash-MD5": 215,
        "FileHash-SHA1": 192,
        "FileHash-SHA256": 2663,
        "domain": 2673,
        "hostname": 2686,
        "CVE": 2,
        "email": 16
      },
      "indicator_count": 14750,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "769 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65944a8149f2479b2fbc6cd1",
      "name": "Relic",
      "description": "Malicious redirect to BotNet malvertizing of a business affecting both .command YouTube distribution. YouTube encoded logins. Hacker attack, geo tracking, passwords crack, decryption, C2. Retaliation. Found in referenced Twitter link shared  with me.",
      "modified": "2024-02-01T14:01:46.735000",
      "created": "2024-01-02T17:40:17.890000",
      "tags": [
        "ioc search",
        "new ioc",
        "teams api",
        "contact",
        "threat analyzer",
        "threat",
        "paste",
        "iocs",
        "urls https",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers nel",
        "maxage5184000",
        "name verdict",
        "falcon sandbox",
        "whois record",
        "ssl certificate",
        "tsara brashears",
        "whois whois",
        "historical ssl",
        "contacted",
        "highly targeted",
        "hackers",
        "botnet",
        "apple ios",
        "malicious",
        "hacktool",
        "quasar",
        "download",
        "malware",
        "relic",
        "monitoring",
        "installer",
        "tofsee",
        "getprocaddress",
        "indicator",
        "prefetch8",
        "mitre att",
        "ck id",
        "show technique",
        "ck matrix",
        "united",
        "file",
        "pattern match",
        "path",
        "date",
        "win64",
        "factory",
        "model",
        "comspec",
        "hybrid",
        "general",
        "click",
        "strings",
        "patch",
        "song culture",
        "tulach"
      ],
      "references": [
        "rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru [phishing] SongCulture.comm& YouTube redirected by hacker",
        "https://hybrid-analysis.com/sample/3f1b1621818b3cfef7c58d8c3e382932a5a817579dffe8fbefc4cf6fdb8fc21d",
        "https://www.virustotal.com/gui/url/4657cd9117ad26288f2af98767de164d9af64e9c22e3eda9580766688ec38652/community",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/,",
        "https://twitter.com/sheriffspurlock?lang=en",
        "https://hybrid-analysis.com/sample/a728fc352e13fa39c7490ddcfff86b0919b3de6ea5786cf48b22095e0607bde9/6593b386f70b45c7c70419c8",
        "http://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru",
        "nr-data.net [Apple Private Data Collection]",
        "init.ess.apple.com [backdoor, malicious script, access via media]",
        "https://stackabuse.com/assets/images/apple",
        "https://apple.find-tracking.us/?id=jit./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./error./err",
        "location-icloud.com",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Tracking| Botnet Campaign]",
        "mailtrack.io [tracking VirusTotal graphs, link trace back]",
        "http://rawlucky.com/submit/prizepicker/iq?devicemodel=iPhone&carrier=\u00aeion=Baghdad&brand=Apple&browser=AlohaBrowserMobile&prize=300k&u=track.bawiwia.com&isp=EarthlinkTelecommunicationsEquipmentTradingServicesDmcc&ts=29900ce7-726c-4c9f-b0c3-21ff2f859648&country=IQ&click_id=woot0oed65crk85u2oe4vubu&partner=2423996&skip=yes",
        "https://aheadofthegame.uk/about?utm_campaign=You%E2%80%99re%20nearly%20there!&utm_medium=email&utm_source=Eloqua&elqTrackId=e6385dd142e445f48aa17b4544780841&elq=0db2557254194121b23f3bec84f42097&elqaid=4059&elqat=1&elqCampaignId=",
        "https://pin.it/ [faux Pinterest for TB]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS Password Cracker [",
        "114.114.114.114 [ Tulach Malware IP]",
        "13.107.136.8  [ Tulach Malware IP redirect]",
        "http://114.114.114.114:9421/proxycontrolwarn/ [Tulach cnc | probe]",
        "http://114.114.114.114/d?dn=sinastorage.com [ storage of targeted individuals on and offline Behavior]",
        "http://114.114.114.114:7777/c/msdownload/update/others/2022/01/29136388_",
        "http://114.114.114.114/ipw.ps1",
        "194.245.148.189 [CnC]",
        "https://stackabuse.com/generating-command-line-interfaces-cli-with-fire-in-python/",
        "http://109.206.241.129/666bins/666.mpsl",
        "http://designspaceblog.com/?mystique=jquery_init&ver=2.4.2",
        "143.244.50.213 |169.150.249.162  [malware_hosting]",
        "http://watchhers.net/index.php [malware spreader]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian No Expiration\t0\t  Domain twitter.com No Expiration\t0\t  Hostname www.pornhub.com No Expiration\t0\t  URL https://www.milehighmedia.com/en/Charlie-Dean/pornstar/49512 No Expiration\t0\t  URL",
        "https://www.milehighmedia.com/en/pornstar/milehighmedia/Justin-Hunt/51017",
        "xred.mooo.com [pornhub trojan]",
        "https://twitter.com/PORNO_SEXYBABES [ malvertizing, contextualizing, malicious]",
        "http://45.159.189.105/bot/online?key=7ee57b1f6d4aff08f9755119b18cf0754b677addcb6a3063066112b10a357a8e&guid=DESKTOP-B0T93D6\\george",
        "https://otx.alienvault.com/indicator/url/https://www.hostinger.com/?REFERRALCODE=1ROCKY77 [ DGA parking]"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Tofsee",
          "display_name": "Tofsee",
          "target": null
        },
        {
          "id": "Quasar RAT",
          "display_name": "Quasar RAT",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Comspec",
          "display_name": "Comspec",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1083",
          "name": "File and Directory Discovery",
          "display_name": "T1083 - File and Directory Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1106",
          "name": "Native API",
          "display_name": "T1106 - Native API"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1546",
          "name": "Event Triggered Execution",
          "display_name": "T1546 - Event Triggered Execution"
        },
        {
          "id": "T1588",
          "name": "Obtain Capabilities",
          "display_name": "T1588 - Obtain Capabilities"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1041",
          "name": "Exfiltration Over C2 Channel",
          "display_name": "T1041 - Exfiltration Over C2 Channel"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 25,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 8049,
        "FileHash-MD5": 388,
        "FileHash-SHA1": 212,
        "FileHash-SHA256": 7062,
        "domain": 4401,
        "hostname": 2653,
        "CVE": 2,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 22769,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "808 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "equalhers.net",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "equalhers.net",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776647479.1507268
}