{ "type": "Domain", "indicator": "fd-pellets.store", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/fd-pellets.store", "alexa": "http://www.alexa.com/siteinfo/fd-pellets.store", "indicator": "fd-pellets.store", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3411324235, "indicator": "fd-pellets.store", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 8, "pulses": [ { "id": "691e558f06d5a5653da55983", "name": "NightEagle", "description": "", "modified": "2025-12-19T23:01:25.230000", "created": "2025-11-19T23:41:03.013000", "tags": [ "apt" ], "references": [], "public": 1, "adversary": "APT-Q-95", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 564, "hostname": 300 }, "indicator_count": 864, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "164 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a81314a587dca8a7e075", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "", "modified": "2023-12-06T16:57:55.292000", "created": "2023-12-06T16:57:55.292000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1407, "hostname": 557, "domain": 226, "FileHash-MD5": 860, "FileHash-SHA1": 488, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a80d15fdb40571638038", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "", "modified": "2023-12-06T16:57:49.914000", "created": "2023-12-06T16:57:49.914000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1407, "hostname": 557, "domain": 226, "FileHash-MD5": 860, "FileHash-SHA1": 488, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708a434c8bf557c17688e0", "name": "This is SPYWARE - Stealth Persistent Obfuscated Evolved over min 7 years", "description": "", "modified": "2023-12-06T14:50:43.331000", "created": "2023-12-06T14:50:43.331000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2041, "domain": 1552, "URL": 3523, "hostname": 2430, "CVE": 1, "FileHash-MD5": 11, "FileHash-SHA1": 3 }, "indicator_count": 9561, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6520e6e8396ce5b825a4edb9", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "Botnet Command and Control \nCobalt Strike\nMisc Attack\nHidden users\nTargets: network, communication, devices, url, music publishing company, artists, owner, associates, advertising, visibility, reputations, digital profile.\nCountry origination: United States", "modified": "2023-11-06T03:00:36.709000", "created": "2023-10-07T05:04:40.671000", "tags": [ "noname057", "song culture", "brashears music", "culture", "tsara lynn", "falcon sandbox", "brashears song", "nights", "kedence", "service", "sandbox", "cool", "music", "secure", "httponly", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "united", "flag", "contacted", "emotet", "NSIS", "trellian", "apple", "apk", "os", "ios", "android", "google", "Google search", "dns", "query", "poisoning", "hacking", "injection", "login", "logon", "phishing", "scanning_host", "VM", "file query", "detect", "windir", "api call", "api", "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call", "\"iexplore.exe\" trying to touch file", "attack", "target", "jeffrey", "reimer", "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v", "suricata", "alert", "cyber threat", "dpt", "porn", "pixelrz", "dead", "hifi", "track", "jeffrey reimer dpt", "redirect", "pattern match", "tbmisch", "contentlength", "mcfunction", "ck id", "t1071", "mitre att", "ck matrix", "drops", "content reputation", "malware", "malvertizing", "misc attack", "mitre", "file access", "files marked clean", "evasive", "cisco umbrella", "safe site", "site", "windows nt", "file", "network related", "https webserver", "getpost", "get search", "geckohost", "jpeg image", "jfif", "png image", "gif image", "binary file", "t1105", "show technique", "click", "blacklist", "generic malware", "DNS Requests", "persistence", "gmt0600", "programfiles", "filename", "indexed", "network", "hosts process", "openurl c", "prefetch2 name", "ssl certificate", "whois record", "threat roundup", "execution", "march", "july", "communicating", "october", "september", "referrer", "june", "april", "august", "copy", "goldfinder", "sibot", "hacktool", "february", "skynet", "malicious", "download", "malware", "relic", "monitoring", "installer", "project", "core", "lumma stealer", "metro", "Anonymizer", "virut", "scanning ip's", "Cobalt Strike", "keybase", "spam", "anonymisation services", "malicious host", "Botnet Command and Control", "Phishing - Mr.Looquer", "covid19 scam", "social engineering", "Jumpseller phishing", "phishing: Amazon.com", "unauthorized scanning of hosts", "phishing huntington bank", "malicious url", "malicious server", "Threats200220200050", "ntp open resolver", "blackshades", "infostealer", "rat", "infinity", "msil", "adware", "adload", "gamarue", "pua", "keyloggers", "browser malware", "resolutions", "whois whois", "historical ssl", "subdomains", "whois siblings", "bradesco", "paypal phishing", "bad traffic", "Yandex", "hidden users" ], "references": [ "https://www.hybrid-analysis.com/sample/", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "Research and Data analysis", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer No Expiration http://pixelrz.com/lists/keywords/tsara-brashears-dead", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "DNS Server - Public-dns.info", "Autonomous System", "AS13414 Twitter Inc", "AS32934 Facebook Inc", "AS15133 MCI Communications Services Inc d b a Verizon Business", "AS13335 - Cloudflare, Inc. - United States", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "https://amp.hifiporn.cc/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati" ], "public": 1, "adversary": "[Miscellaneous, Unnamed]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Gen:Variant.Zusy", "display_name": "Gen:Variant.Zusy", "target": null }, { "id": "Gen:Trojan.Heur", "display_name": "Gen:Trojan.Heur", "target": null }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "GoldFinder - S0597", "display_name": "GoldFinder - S0597", "target": null }, { "id": "BlackShades Crypter", "display_name": "BlackShades Crypter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Media", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 860, "FileHash-SHA1": 488, "FileHash-SHA256": 1407, "domain": 226, "hostname": 557, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "938 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6520e93e8cf8f83a2ccfd46b", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "Botnet Command and Control \nCobalt Strike\nMisc Attack\nHidden users\nTargets: network, url, music publishing company, artists, owner, associates, advertising, visibility, reputations, digital profile.\nCountry origination: United States", "modified": "2023-11-06T03:00:36.709000", "created": "2023-10-07T05:14:38.342000", "tags": [ "noname057", "song culture", "brashears music", "culture", "tsara lynn", "falcon sandbox", "brashears song", "nights", "kedence", "service", "sandbox", "cool", "music", "secure", "httponly", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "united", "flag", "contacted", "emotet", "NSIS", "trellian", "apple", "apk", "os", "ios", "android", "google", "Google search", "dns", "query", "poisoning", "hacking", "injection", "login", "logon", "phishing", "scanning_host", "VM", "file query", "detect", "windir", "api call", "api", "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call", "\"iexplore.exe\" trying to touch file", "attack", "target", "jeffrey", "reimer", "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v", "suricata", "alert", "cyber threat", "dpt", "porn", "pixelrz", "dead", "hifi", "track", "jeffrey reimer dpt", "redirect", "pattern match", "tbmisch", "contentlength", "mcfunction", "ck id", "t1071", "mitre att", "ck matrix", "drops", "content reputation", "malware", "malvertizing", "misc attack", "mitre", "file access", "files marked clean", "evasive", "cisco umbrella", "safe site", "site", "windows nt", "file", "network related", "https webserver", "getpost", "get search", "geckohost", "jpeg image", "jfif", "png image", "gif image", "binary file", "t1105", "show technique", "click", "blacklist", "generic malware", "DNS Requests", "persistence", "gmt0600", "programfiles", "filename", "indexed", "network", "hosts process", "openurl c", "prefetch2 name", "ssl certificate", "whois record", "threat roundup", "execution", "march", "july", "communicating", "october", "september", "referrer", "june", "april", "august", "copy", "goldfinder", "sibot", "hacktool", "february", "skynet", "malicious", "download", "malware", "relic", "monitoring", "installer", "project", "core", "lumma stealer", "metro", "Anonymizer", "virut", "scanning ip's", "Cobalt Strike", "keybase", "spam", "anonymisation services", "malicious host", "Botnet Command and Control", "Phishing - Mr.Looquer", "covid19 scam", "social engineering", "Jumpseller phishing", "phishing: Amazon.com", "unauthorized scanning of hosts", "phishing huntington bank", "malicious url", "malicious server", "Threats200220200050", "ntp open resolver", "blackshades", "infostealer", "rat", "infinity", "msil", "adware", "adload", "gamarue", "pua", "keyloggers", "browser malware", "resolutions", "whois whois", "historical ssl", "subdomains", "whois siblings", "bradesco", "paypal phishing", "bad traffic", "Yandex", "hidden users" ], "references": [ "https://www.hybrid-analysis.com/sample/", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "Research and Data analysis", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "DNS Server - Public-dns.info", "Autonomous System", "AS13414 Twitter Inc", "AS32934 Facebook Inc", "AS15133 MCI Communications Services Inc d b a Verizon Business", "AS13335 - Cloudflare, Inc. - United States", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "wTools", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke" ], "public": 1, "adversary": "[Miscellaneous, Unnamed]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Gen:Variant.Zusy", "display_name": "Gen:Variant.Zusy", "target": null }, { "id": "Gen:Trojan.Heur", "display_name": "Gen:Trojan.Heur", "target": null }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "GoldFinder - S0597", "display_name": "GoldFinder - S0597", "target": null }, { "id": "BlackShades Crypter", "display_name": "BlackShades Crypter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Media", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 860, "FileHash-SHA1": 488, "FileHash-SHA256": 1407, "domain": 226, "hostname": 557, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "938 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f1dd94c3c9a46abe24f02", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "", "modified": "2023-11-06T03:00:36.709000", "created": "2023-10-30T03:07:05.227000", "tags": [ "noname057", "song culture", "brashears music", "culture", "tsara lynn", "falcon sandbox", "brashears song", "nights", "kedence", "service", "sandbox", "cool", "music", "secure", "httponly", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "united", "flag", "contacted", "emotet", "NSIS", "trellian", "apple", "apk", "os", "ios", "android", "google", "Google search", "dns", "query", "poisoning", "hacking", "injection", "login", "logon", "phishing", "scanning_host", "VM", "file query", "detect", "windir", "api call", "api", "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call", "\"iexplore.exe\" trying to touch file", "attack", "target", "jeffrey", "reimer", "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v", "suricata", "alert", "cyber threat", "dpt", "porn", "pixelrz", "dead", "hifi", "track", "jeffrey reimer dpt", "redirect", "pattern match", "tbmisch", "contentlength", "mcfunction", "ck id", "t1071", "mitre att", "ck matrix", "drops", "content reputation", "malware", "malvertizing", "misc attack", "mitre", "file access", "files marked clean", "evasive", "cisco umbrella", "safe site", "site", "windows nt", "file", "network related", "https webserver", "getpost", "get search", "geckohost", "jpeg image", "jfif", "png image", "gif image", "binary file", "t1105", "show technique", "click", "blacklist", "generic malware", "DNS Requests", "persistence", "gmt0600", "programfiles", "filename", "indexed", "network", "hosts process", "openurl c", "prefetch2 name", "ssl certificate", "whois record", "threat roundup", "execution", "march", "july", "communicating", "october", "september", "referrer", "june", "april", "august", "copy", "goldfinder", "sibot", "hacktool", "february", "skynet", "malicious", "download", "malware", "relic", "monitoring", "installer", "project", "core", "lumma stealer", "metro", "Anonymizer", "virut", "scanning ip's", "Cobalt Strike", "keybase", "spam", "anonymisation services", "malicious host", "Botnet Command and Control", "Phishing - Mr.Looquer", "covid19 scam", "social engineering", "Jumpseller phishing", "phishing: Amazon.com", "unauthorized scanning of hosts", "phishing huntington bank", "malicious url", "malicious server", "Threats200220200050", "ntp open resolver", "blackshades", "infostealer", "rat", "infinity", "msil", "adware", "adload", "gamarue", "pua", "keyloggers", "browser malware", "resolutions", "whois whois", "historical ssl", "subdomains", "whois siblings", "bradesco", "paypal phishing", "bad traffic", "Yandex", "hidden users" ], "references": [ "https://www.hybrid-analysis.com/sample/", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "Research and Data analysis", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "DNS Server - Public-dns.info", "Autonomous System", "AS13414 Twitter Inc", "AS32934 Facebook Inc", "AS15133 MCI Communications Services Inc d b a Verizon Business", "AS13335 - Cloudflare, Inc. - United States", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "wTools", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke" ], "public": 1, "adversary": "[Miscellaneous, Unnamed]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Gen:Variant.Zusy", "display_name": "Gen:Variant.Zusy", "target": null }, { "id": "Gen:Trojan.Heur", "display_name": "Gen:Trojan.Heur", "target": null }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "GoldFinder - S0597", "display_name": "GoldFinder - S0597", "target": null }, { "id": "BlackShades Crypter", "display_name": "BlackShades Crypter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Media", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": "6520e93e8cf8f83a2ccfd46b", "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 860, "FileHash-SHA1": 488, "FileHash-SHA256": 1407, "domain": 226, "hostname": 557, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "938 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62449fc038a68f81313fb10a", "name": "This is SPYWARE - Stealth Persistent Obfuscated Evolved over min 7 years", "description": "", "modified": "2022-04-29T00:05:19.794000", "created": "2022-03-30T18:21:52.956000", "tags": [ "\u7f51\u76d8", "\u767e\u5ea6\u7f51\u76d8", "\u767e\u5ea6\u4e91", "\u7f51\u7edcu\u76d8", "\u7f51\u7edc\u786c\u76d8", "\u514d\u8d39\u7f51\u76d8", "\u7f51\u76d8\u4e0b\u8f7d", "\u7f51\u76d8\u8d44\u6e90", "\u540c\u6b65", "\u4e91\u5b58\u50a8", "\u5916\u94fe\u5206\u4eab", "\u79bb\u7ebf\u4e0b\u8f7d", "windows android", "2022", "baidu", "bccwp", "a018", "bb12", "nmclfl1 https", "kvt49l" ], "references": [ "http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT-file_sharing&policy=Z2xvYmFsLWN1c3RvbS00N2Y0NzlkYy1kNmVlLTQ3MjMtOTljMy1jODhmODk4YTJjNDQ=;&view=NDdmNDc5ZGMtZDZlZS00NzIzLTk5YzMtYzg4Zjg5OGEyYzQ0;&originalUrl=aHR0cDovL3Bhbi5iYWlkdS5jb20v", "http://cybertran.baidu.com/download#pan" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3523, "hostname": 2430, "FileHash-SHA256": 2041, "domain": 1552, "CVE": 1, "FileHash-MD5": 11, "FileHash-SHA1": 3 }, "indicator_count": 9561, "is_author": false, "is_subscribing": null, "subscriber_count": 404, "modified_text": "1494 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "Autonomous System", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "Research and Data analysis", "AS15133 MCI Communications Services Inc d b a Verizon Business", "wTools", "AS32934 Facebook Inc", "AS13335 - Cloudflare, Inc. - United States", "http://cybertran.baidu.com/download#pan", "https://amp.hifiporn.cc/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "DNS Server - Public-dns.info", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer No Expiration http://pixelrz.com/lists/keywords/tsara-brashears-dead", "AS13414 Twitter Inc", "http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT-file_sharing&policy=Z2xvYmFsLWN1c3RvbS00N2Y0NzlkYy1kNmVlLTQ3MjMtOTljMy1jODhmODk4YTJjNDQ=;&view=NDdmNDc5ZGMtZDZlZS00NzIzLTk5YzMtYzg4Zjg5OGEyYzQ0;&originalUrl=aHR0cDovL3Bhbi5iYWlkdS5jb20v", "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/", "https://www.hybrid-analysis.com/sample/", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "[Miscellaneous, Unnamed]", "APT-Q-95" ], "malware_families": [ "Virut", "Gen:variant.zusy", "Lumma stealer", "Generic.malware", "Emotet - s0367", "Cobalt strike", "Blackshades crypter", "Gen:trojan.heur", "Goldfinder - s0597" ], "industries": [ "Media", "Technology", "Telecommunications" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 8, "pulses": [ { "id": "691e558f06d5a5653da55983", "name": "NightEagle", "description": "", "modified": "2025-12-19T23:01:25.230000", "created": "2025-11-19T23:41:03.013000", "tags": [ "apt" ], "references": [], "public": 1, "adversary": "APT-Q-95", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "skocherhan", "id": "249290", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 564, "hostname": 300 }, "indicator_count": 864, "is_author": false, "is_subscribing": null, "subscriber_count": 185, "modified_text": "164 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": false, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a81314a587dca8a7e075", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "", "modified": "2023-12-06T16:57:55.292000", "created": "2023-12-06T16:57:55.292000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1407, "hostname": 557, "domain": 226, "FileHash-MD5": 860, "FileHash-SHA1": 488, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6570a80d15fdb40571638038", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "", "modified": "2023-12-06T16:57:49.914000", "created": "2023-12-06T16:57:49.914000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1407, "hostname": 557, "domain": 226, "FileHash-MD5": 860, "FileHash-SHA1": 488, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708a434c8bf557c17688e0", "name": "This is SPYWARE - Stealth Persistent Obfuscated Evolved over min 7 years", "description": "", "modified": "2023-12-06T14:50:43.331000", "created": "2023-12-06T14:50:43.331000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2041, "domain": 1552, "URL": 3523, "hostname": 2430, "CVE": 1, "FileHash-MD5": 11, "FileHash-SHA1": 3 }, "indicator_count": 9561, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "908 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6520e6e8396ce5b825a4edb9", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "Botnet Command and Control \nCobalt Strike\nMisc Attack\nHidden users\nTargets: network, communication, devices, url, music publishing company, artists, owner, associates, advertising, visibility, reputations, digital profile.\nCountry origination: United States", "modified": "2023-11-06T03:00:36.709000", "created": "2023-10-07T05:04:40.671000", "tags": [ "noname057", "song culture", "brashears music", "culture", "tsara lynn", "falcon sandbox", "brashears song", "nights", "kedence", "service", "sandbox", "cool", "music", "secure", "httponly", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "united", "flag", "contacted", "emotet", "NSIS", "trellian", "apple", "apk", "os", "ios", "android", "google", "Google search", "dns", "query", "poisoning", "hacking", "injection", "login", "logon", "phishing", "scanning_host", "VM", "file query", "detect", "windir", "api call", "api", "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call", "\"iexplore.exe\" trying to touch file", "attack", "target", "jeffrey", "reimer", "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v", "suricata", "alert", "cyber threat", "dpt", "porn", "pixelrz", "dead", "hifi", "track", "jeffrey reimer dpt", "redirect", "pattern match", "tbmisch", "contentlength", "mcfunction", "ck id", "t1071", "mitre att", "ck matrix", "drops", "content reputation", "malware", "malvertizing", "misc attack", "mitre", "file access", "files marked clean", "evasive", "cisco umbrella", "safe site", "site", "windows nt", "file", "network related", "https webserver", "getpost", "get search", "geckohost", "jpeg image", "jfif", "png image", "gif image", "binary file", "t1105", "show technique", "click", "blacklist", "generic malware", "DNS Requests", "persistence", "gmt0600", "programfiles", "filename", "indexed", "network", "hosts process", "openurl c", "prefetch2 name", "ssl certificate", "whois record", "threat roundup", "execution", "march", "july", "communicating", "october", "september", "referrer", "june", "april", "august", "copy", "goldfinder", "sibot", "hacktool", "february", "skynet", "malicious", "download", "malware", "relic", "monitoring", "installer", "project", "core", "lumma stealer", "metro", "Anonymizer", "virut", "scanning ip's", "Cobalt Strike", "keybase", "spam", "anonymisation services", "malicious host", "Botnet Command and Control", "Phishing - Mr.Looquer", "covid19 scam", "social engineering", "Jumpseller phishing", "phishing: Amazon.com", "unauthorized scanning of hosts", "phishing huntington bank", "malicious url", "malicious server", "Threats200220200050", "ntp open resolver", "blackshades", "infostealer", "rat", "infinity", "msil", "adware", "adload", "gamarue", "pua", "keyloggers", "browser malware", "resolutions", "whois whois", "historical ssl", "subdomains", "whois siblings", "bradesco", "paypal phishing", "bad traffic", "Yandex", "hidden users" ], "references": [ "https://www.hybrid-analysis.com/sample/", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "Research and Data analysis", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer No Expiration http://pixelrz.com/lists/keywords/tsara-brashears-dead", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "DNS Server - Public-dns.info", "Autonomous System", "AS13414 Twitter Inc", "AS32934 Facebook Inc", "AS15133 MCI Communications Services Inc d b a Verizon Business", "AS13335 - Cloudflare, Inc. - United States", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "https://amp.hifiporn.cc/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "http://pixelrz.com/lists/keywords/jeffrey-reimer-shot-dead-walgreens/", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati" ], "public": 1, "adversary": "[Miscellaneous, Unnamed]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Gen:Variant.Zusy", "display_name": "Gen:Variant.Zusy", "target": null }, { "id": "Gen:Trojan.Heur", "display_name": "Gen:Trojan.Heur", "target": null }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "GoldFinder - S0597", "display_name": "GoldFinder - S0597", "target": null }, { "id": "BlackShades Crypter", "display_name": "BlackShades Crypter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Media", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 860, "FileHash-SHA1": 488, "FileHash-SHA256": 1407, "domain": 226, "hostname": 557, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 229, "modified_text": "938 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6520e93e8cf8f83a2ccfd46b", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "Botnet Command and Control \nCobalt Strike\nMisc Attack\nHidden users\nTargets: network, url, music publishing company, artists, owner, associates, advertising, visibility, reputations, digital profile.\nCountry origination: United States", "modified": "2023-11-06T03:00:36.709000", "created": "2023-10-07T05:14:38.342000", "tags": [ "noname057", "song culture", "brashears music", "culture", "tsara lynn", "falcon sandbox", "brashears song", "nights", "kedence", "service", "sandbox", "cool", "music", "secure", "httponly", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "united", "flag", "contacted", "emotet", "NSIS", "trellian", "apple", "apk", "os", "ios", "android", "google", "Google search", "dns", "query", "poisoning", "hacking", "injection", "login", "logon", "phishing", "scanning_host", "VM", "file query", "detect", "windir", "api call", "api", "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call", "\"iexplore.exe\" trying to touch file", "attack", "target", "jeffrey", "reimer", "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v", "suricata", "alert", "cyber threat", "dpt", "porn", "pixelrz", "dead", "hifi", "track", "jeffrey reimer dpt", "redirect", "pattern match", "tbmisch", "contentlength", "mcfunction", "ck id", "t1071", "mitre att", "ck matrix", "drops", "content reputation", "malware", "malvertizing", "misc attack", "mitre", "file access", "files marked clean", "evasive", "cisco umbrella", "safe site", "site", "windows nt", "file", "network related", "https webserver", "getpost", "get search", "geckohost", "jpeg image", "jfif", "png image", "gif image", "binary file", "t1105", "show technique", "click", "blacklist", "generic malware", "DNS Requests", "persistence", "gmt0600", "programfiles", "filename", "indexed", "network", "hosts process", "openurl c", "prefetch2 name", "ssl certificate", "whois record", "threat roundup", "execution", "march", "july", "communicating", "october", "september", "referrer", "june", "april", "august", "copy", "goldfinder", "sibot", "hacktool", "february", "skynet", "malicious", "download", "malware", "relic", "monitoring", "installer", "project", "core", "lumma stealer", "metro", "Anonymizer", "virut", "scanning ip's", "Cobalt Strike", "keybase", "spam", "anonymisation services", "malicious host", "Botnet Command and Control", "Phishing - Mr.Looquer", "covid19 scam", "social engineering", "Jumpseller phishing", "phishing: Amazon.com", "unauthorized scanning of hosts", "phishing huntington bank", "malicious url", "malicious server", "Threats200220200050", "ntp open resolver", "blackshades", "infostealer", "rat", "infinity", "msil", "adware", "adload", "gamarue", "pua", "keyloggers", "browser malware", "resolutions", "whois whois", "historical ssl", "subdomains", "whois siblings", "bradesco", "paypal phishing", "bad traffic", "Yandex", "hidden users" ], "references": [ "https://www.hybrid-analysis.com/sample/", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "Research and Data analysis", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "DNS Server - Public-dns.info", "Autonomous System", "AS13414 Twitter Inc", "AS32934 Facebook Inc", "AS15133 MCI Communications Services Inc d b a Verizon Business", "AS13335 - Cloudflare, Inc. - United States", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "wTools", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke" ], "public": 1, "adversary": "[Miscellaneous, Unnamed]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Gen:Variant.Zusy", "display_name": "Gen:Variant.Zusy", "target": null }, { "id": "Gen:Trojan.Heur", "display_name": "Gen:Trojan.Heur", "target": null }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "GoldFinder - S0597", "display_name": "GoldFinder - S0597", "target": null }, { "id": "BlackShades Crypter", "display_name": "BlackShades Crypter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Media", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 29, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 1, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 860, "FileHash-SHA1": 488, "FileHash-SHA256": 1407, "domain": 226, "hostname": 557, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "938 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "653f1dd94c3c9a46abe24f02", "name": "Blackshades | Remote attacks | Malicious Google Search | DNS Requests", "description": "", "modified": "2023-11-06T03:00:36.709000", "created": "2023-10-30T03:07:05.227000", "tags": [ "noname057", "song culture", "brashears music", "culture", "tsara lynn", "falcon sandbox", "brashears song", "nights", "kedence", "service", "sandbox", "cool", "music", "secure", "httponly", "http response", "final url", "serving ip", "address", "status code", "body length", "kb body", "sha256", "misc attack", "et tor", "known tor", "relayrouter", "exit", "node traffic", "united", "flag", "contacted", "emotet", "NSIS", "trellian", "apple", "apk", "os", "ios", "android", "google", "Google search", "dns", "query", "poisoning", "hacking", "injection", "login", "logon", "phishing", "scanning_host", "VM", "file query", "detect", "windir", "api call", "api", "\"%WINDIR%\\System32\\vm3dum_loader.dll\" source API Call", "\"iexplore.exe\" trying to touch file", "attack", "target", "jeffrey", "reimer", "details \"iexplore.exe\" trying to touch file \"%WINDIR%\\System32\\v", "suricata", "alert", "cyber threat", "dpt", "porn", "pixelrz", "dead", "hifi", "track", "jeffrey reimer dpt", "redirect", "pattern match", "tbmisch", "contentlength", "mcfunction", "ck id", "t1071", "mitre att", "ck matrix", "drops", "content reputation", "malware", "malvertizing", "misc attack", "mitre", "file access", "files marked clean", "evasive", "cisco umbrella", "safe site", "site", "windows nt", "file", "network related", "https webserver", "getpost", "get search", "geckohost", "jpeg image", "jfif", "png image", "gif image", "binary file", "t1105", "show technique", "click", "blacklist", "generic malware", "DNS Requests", "persistence", "gmt0600", "programfiles", "filename", "indexed", "network", "hosts process", "openurl c", "prefetch2 name", "ssl certificate", "whois record", "threat roundup", "execution", "march", "july", "communicating", "october", "september", "referrer", "june", "april", "august", "copy", "goldfinder", "sibot", "hacktool", "february", "skynet", "malicious", "download", "malware", "relic", "monitoring", "installer", "project", "core", "lumma stealer", "metro", "Anonymizer", "virut", "scanning ip's", "Cobalt Strike", "keybase", "spam", "anonymisation services", "malicious host", "Botnet Command and Control", "Phishing - Mr.Looquer", "covid19 scam", "social engineering", "Jumpseller phishing", "phishing: Amazon.com", "unauthorized scanning of hosts", "phishing huntington bank", "malicious url", "malicious server", "Threats200220200050", "ntp open resolver", "blackshades", "infostealer", "rat", "infinity", "msil", "adware", "adload", "gamarue", "pua", "keyloggers", "browser malware", "resolutions", "whois whois", "historical ssl", "subdomains", "whois siblings", "bradesco", "paypal phishing", "bad traffic", "Yandex", "hidden users" ], "references": [ "https://www.hybrid-analysis.com/sample/", "https://www.google.com/search?q=tsara+brashears&tbm=isch&chips=q:tsara+brashears", "Research and Data analysis", "http://pixelrz.com/lists/keywords/tsara-brashears-assaulted-by-jeffrey-reimer", "http://pixelrz.com/lists/keywords/tsara-brashears", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "DNS Server - Public-dns.info", "Autonomous System", "AS13414 Twitter Inc", "AS32934 Facebook Inc", "AS15133 MCI Communications Services Inc d b a Verizon Business", "AS13335 - Cloudflare, Inc. - United States", "http://pixelrz.com/lists/keywords/tsara-brashears-jeffrey-reimer-porn", "wTools", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expirati", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-", "https://amp.mypornvid.fun/videos/2/SLFGMWoQaCU/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video- No Expiration\t0\t URL https://hifiporn.pw/xxx/1/white-dpt-jeffrey-r https://archive.ph/o/jEaWf/https:/mypornvid.pw/videos/13/8thhcwahoYI/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tsara-brashears-jeffrey-reimer-porn/' No Expiration\t0\t URL http://pixelrz.com/lists/%20keywords/tshttp://pixelrz.com/lists/ke" ], "public": 1, "adversary": "[Miscellaneous, Unnamed]", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Generic.Malware", "display_name": "Generic.Malware", "target": null }, { "id": "Gen:Variant.Zusy", "display_name": "Gen:Variant.Zusy", "target": null }, { "id": "Gen:Trojan.Heur", "display_name": "Gen:Trojan.Heur", "target": null }, { "id": "Virut", "display_name": "Virut", "target": null }, { "id": "Cobalt Strike", "display_name": "Cobalt Strike", "target": null }, { "id": "Emotet - S0367", "display_name": "Emotet - S0367", "target": null }, { "id": "Lumma Stealer", "display_name": "Lumma Stealer", "target": null }, { "id": "GoldFinder - S0597", "display_name": "GoldFinder - S0597", "target": null }, { "id": "BlackShades Crypter", "display_name": "BlackShades Crypter", "target": null } ], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1059.007", "name": "JavaScript", "display_name": "T1059.007 - JavaScript" }, { "id": "T1105", "name": "Ingress Tool Transfer", "display_name": "T1105 - Ingress Tool Transfer" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1071.004", "name": "DNS", "display_name": "T1071.004 - DNS" }, { "id": "T1071.001", "name": "Web Protocols", "display_name": "T1071.001 - Web Protocols" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1410", "name": "Network Traffic Capture or Redirection", "display_name": "T1410 - Network Traffic Capture or Redirection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" }, { "id": "TA0004", "name": "Privilege Escalation", "display_name": "TA0004 - Privilege Escalation" }, { "id": "TA0005", "name": "Defense Evasion", "display_name": "TA0005 - Defense Evasion" }, { "id": "TA0006", "name": "Credential Access", "display_name": "TA0006 - Credential Access" }, { "id": "TA0003", "name": "Persistence", "display_name": "TA0003 - Persistence" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" } ], "industries": [ "Media", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": "6520e93e8cf8f83a2ccfd46b", "export_count": 19, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 860, "FileHash-SHA1": 488, "FileHash-SHA256": 1407, "domain": 226, "hostname": 557, "URL": 589 }, "indicator_count": 4127, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "938 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "62449fc038a68f81313fb10a", "name": "This is SPYWARE - Stealth Persistent Obfuscated Evolved over min 7 years", "description": "", "modified": "2022-04-29T00:05:19.794000", "created": "2022-03-30T18:21:52.956000", "tags": [ "\u7f51\u76d8", "\u767e\u5ea6\u7f51\u76d8", "\u767e\u5ea6\u4e91", "\u7f51\u7edcu\u76d8", "\u7f51\u7edc\u786c\u76d8", "\u514d\u8d39\u7f51\u76d8", "\u7f51\u76d8\u4e0b\u8f7d", "\u7f51\u76d8\u8d44\u6e90", "\u540c\u6b65", "\u4e91\u5b58\u50a8", "\u5916\u94fe\u5206\u4eab", "\u79bb\u7ebf\u4e0b\u8f7d", "windows android", "2022", "baidu", "bccwp", "a018", "bb12", "nmclfl1 https", "kvt49l" ], "references": [ "http://blockpage.bt.com/pcstaticpage/blocked.html?list=BT-file_sharing&policy=Z2xvYmFsLWN1c3RvbS00N2Y0NzlkYy1kNmVlLTQ3MjMtOTljMy1jODhmODk4YTJjNDQ=;&view=NDdmNDc5ZGMtZDZlZS00NzIzLTk5YzMtYzg4Zjg5OGEyYzQ0;&originalUrl=aHR0cDovL3Bhbi5iYWlkdS5jb20v", "http://cybertran.baidu.com/download#pan" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 12, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "dorkingbeauty1", "id": "80137", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 3523, "hostname": 2430, "FileHash-SHA256": 2041, "domain": 1552, "CVE": 1, "FileHash-MD5": 11, "FileHash-SHA1": 3 }, "indicator_count": 9561, "is_author": false, "is_subscribing": null, "subscriber_count": 404, "modified_text": "1494 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "fd-pellets.store", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "fd-pellets.store", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780355482.2503614 }