{
  "type": "Domain",
  "indicator": "gabplot.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/gabplot.com",
    "alexa": "http://www.alexa.com/siteinfo/gabplot.com",
    "indicator": "gabplot.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3216842600,
      "indicator": "gabplot.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 10,
      "pulses": [
        {
          "id": "69e2cc9ebd63c32d9c0392c6",
          "name": "Hidden Tear BruteForcer Clone Credit OctoSeek",
          "description": "",
          "modified": "2026-04-18T00:13:18.484000",
          "created": "2026-04-18T00:13:18.484000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "url https",
            "iocs",
            "filehashsha1",
            "next",
            "x509v3",
            "key",
            "windows",
            "write",
            "whois ssl",
            "whois whois",
            "win32",
            "198-46-194-153-host.colocrossing.com",
            "a domains",
            "a nxdomain",
            "aaaa",
            "accept",
            "adapter driver",
            "address",
            "address domain",
            "algorithm",
            "all octoseek",
            "cookie",
            "copy",
            "core",
            "domain names",
            "domain",
            "dnssec",
            "discord",
            "whois record",
            "cyberstalking",
            "d417n",
            "timestamp",
            "data",
            "subject",
            "cyberstalking",
            "creation date",
            "ipv4",
            "ip address",
            "http identifier",
            "hostname",
            "historical ssl",
            "highly targeted",
            "high level",
            "high",
            "hiddentear",
            "gmtn",
            "germany unknown",
            "location first",
            "ip files",
            "files",
            "false files",
            "eu data",
            "entries",
            "download encrypt",
            "encrypt",
            "download",
            "contacted",
            "communicating",
            "coinminer",
            "code",
            "cobalt strike",
            "cname",
            "click",
            "ca issuers",
            "issuers",
            "as133618",
            "as24940",
            "hetzner",
            "as26710",
            "icann",
            "as36352",
            "as24940 hetzner",
            "asn as133618",
            "as26710 icann",
            "apple as8075",
            "as47846",
            "as47995",
            "key algorithm",
            "united",
            "name",
            "type",
            "tsara brashears",
            "trojan",
            "key identifier",
            "key info",
            "land use",
            "link location",
            "united tls web",
            "tls web",
            "log id",
            "malvertizing",
            "malware",
            "http",
            "meekserver",
            "meta",
            "metasploit",
            "admin",
            "subject",
            "ransomware",
            "stop ransomware",
            "certificate status",
            "metro",
            "moved",
            "name servers",
            "netsupport rat",
            "number",
            "nxdomain",
            "passive dns",
            "servers",
            "server",
            "pegasus",
            "pingback",
            "submit",
            "ransom",
            "raspberry robin",
            "subject public",
            "subject key",
            "subject billing",
            "pdf broadcom",
            "pulse pulses",
            "pulse submit",
            "read c",
            "record value",
            "redacted referrer",
            "regbinary",
            "regdword",
            "registrant fax",
            "registrar",
            "registrar abuse",
            "registry domain",
            "registrar of",
            "registry policy",
            "regsetvalueexa",
            "regsetvalueexw",
            "show",
            "showing",
            "search",
            "urls",
            "script",
            "script domains",
            "scan endpoints",
            "russia unknown",
            "reverse dns",
            "resolutions",
            "nids",
            "related nids",
            "as39494 jsc",
            "body",
            "attorney james",
            "asn as133618",
            "javascript",
            "unknown",
            "url analysis",
            "unknown url",
            "url http",
            "v3 serial",
            "http",
            "as40528 icann",
            "as44273 host",
            "data center",
            "hosting",
            "vps",
            "reverse dns"
          ],
          "references": [
            "deviceinbox.com [Malware Hosting - Pegasus]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
            "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
            "103.224.182.253 [Command and Control]",
            "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b60b85453c45eca795034d",
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 77,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 359,
            "URL": 218,
            "SSLCertFingerprint": 2,
            "domain": 1932,
            "email": 12,
            "hostname": 528
          },
          "indicator_count": 3209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 47,
          "modified_text": "1 day ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b3fb6752ac464268b971b1",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA.\nContact made. Physical records. Client: Brashears.\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/\n1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376\nhttps://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/\nhttps://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html\nTEL:Trojan:Win32/BazaarLoader\n987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7",
          "modified": "2024-09-05T07:02:20.491000",
          "created": "2024-01-26T18:35:19.690000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2401,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5377,
            "domain": 3794,
            "hostname": 2763,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 18927,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b85df45cc3d3fd07139ea9",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
          "description": "",
          "modified": "2024-09-05T06:38:09.443000",
          "created": "2024-01-30T02:24:52.774000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b47501fcbc39983f098723",
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 2390,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4357,
            "domain": 3534,
            "hostname": 2670,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17111,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b60b85453c45eca795034d",
          "name": "Hidden Tear BruteForcer",
          "description": "\u2022 The Hidden Tear BruteForcer is a program created by Michael Gillespie that can be used to brute force the password for ransomware infections. A ransomware-like file crypter sample which can be modified for specific purposes. Features. Uses AES algorithm to encrypt files. Can be downloaded for free for anyone to download in GitHub. Many cyber criminals, lawyers, investigators and governments use this project.\n\u2022 Raspberry Robin is an activity cluster spread by external drives that leverages Windows Installer.",
          "modified": "2024-02-27T06:04:19.663000",
          "created": "2024-01-28T08:08:37.586000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "url https",
            "iocs",
            "filehashsha1",
            "next",
            "x509v3",
            "key",
            "windows",
            "write",
            "whois ssl",
            "whois whois",
            "win32",
            "198-46-194-153-host.colocrossing.com",
            "a domains",
            "a nxdomain",
            "aaaa",
            "accept",
            "adapter driver",
            "address",
            "address domain",
            "algorithm",
            "all octoseek",
            "cookie",
            "copy",
            "core",
            "domain names",
            "domain",
            "dnssec",
            "discord",
            "whois record",
            "cyberstalking",
            "d417n",
            "timestamp",
            "data",
            "subject",
            "cyberstalking",
            "creation date",
            "ipv4",
            "ip address",
            "http identifier",
            "hostname",
            "historical ssl",
            "highly targeted",
            "high level",
            "high",
            "hiddentear",
            "gmtn",
            "germany unknown",
            "location first",
            "ip files",
            "files",
            "false files",
            "eu data",
            "entries",
            "download encrypt",
            "encrypt",
            "download",
            "contacted",
            "communicating",
            "coinminer",
            "code",
            "cobalt strike",
            "cname",
            "click",
            "ca issuers",
            "issuers",
            "as133618",
            "as24940",
            "hetzner",
            "as26710",
            "icann",
            "as36352",
            "as24940 hetzner",
            "asn as133618",
            "as26710 icann",
            "apple as8075",
            "as47846",
            "as47995",
            "key algorithm",
            "united",
            "name",
            "type",
            "tsara brashears",
            "trojan",
            "key identifier",
            "key info",
            "land use",
            "link location",
            "united tls web",
            "tls web",
            "log id",
            "malvertizing",
            "malware",
            "http",
            "meekserver",
            "meta",
            "metasploit",
            "admin",
            "subject",
            "ransomware",
            "stop ransomware",
            "certificate status",
            "metro",
            "moved",
            "name servers",
            "netsupport rat",
            "number",
            "nxdomain",
            "passive dns",
            "servers",
            "server",
            "pegasus",
            "pingback",
            "submit",
            "ransom",
            "raspberry robin",
            "subject public",
            "subject key",
            "subject billing",
            "pdf broadcom",
            "pulse pulses",
            "pulse submit",
            "read c",
            "record value",
            "redacted referrer",
            "regbinary",
            "regdword",
            "registrant fax",
            "registrar",
            "registrar abuse",
            "registry domain",
            "registrar of",
            "registry policy",
            "regsetvalueexa",
            "regsetvalueexw",
            "show",
            "showing",
            "search",
            "urls",
            "script",
            "script domains",
            "scan endpoints",
            "russia unknown",
            "reverse dns",
            "resolutions",
            "nids",
            "related nids",
            "as39494 jsc",
            "body",
            "attorney james",
            "asn as133618",
            "javascript",
            "unknown",
            "url analysis",
            "unknown url",
            "url http",
            "v3 serial",
            "http",
            "as40528 icann",
            "as44273 host",
            "data center",
            "hosting",
            "vps",
            "reverse dns"
          ],
          "references": [
            "deviceinbox.com [Malware Hosting - Pegasus]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
            "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
            "103.224.182.253 [Command and Control]",
            "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 77,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 359,
            "URL": 218,
            "SSLCertFingerprint": 2,
            "domain": 1932,
            "email": 12,
            "hostname": 528
          },
          "indicator_count": 3209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "782 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8086a651e881715b3fc47",
          "name": "Hidden Tear BruteForcer",
          "description": "",
          "modified": "2024-02-27T06:04:19.663000",
          "created": "2024-01-29T20:19:54.173000",
          "tags": [
            "no expiration",
            "domain",
            "hostname",
            "expiration",
            "filehashsha256",
            "ipv4",
            "url http",
            "url https",
            "iocs",
            "filehashsha1",
            "next",
            "x509v3",
            "key",
            "windows",
            "write",
            "whois ssl",
            "whois whois",
            "win32",
            "198-46-194-153-host.colocrossing.com",
            "a domains",
            "a nxdomain",
            "aaaa",
            "accept",
            "adapter driver",
            "address",
            "address domain",
            "algorithm",
            "all octoseek",
            "cookie",
            "copy",
            "core",
            "domain names",
            "domain",
            "dnssec",
            "discord",
            "whois record",
            "cyberstalking",
            "d417n",
            "timestamp",
            "data",
            "subject",
            "cyberstalking",
            "creation date",
            "ipv4",
            "ip address",
            "http identifier",
            "hostname",
            "historical ssl",
            "highly targeted",
            "high level",
            "high",
            "hiddentear",
            "gmtn",
            "germany unknown",
            "location first",
            "ip files",
            "files",
            "false files",
            "eu data",
            "entries",
            "download encrypt",
            "encrypt",
            "download",
            "contacted",
            "communicating",
            "coinminer",
            "code",
            "cobalt strike",
            "cname",
            "click",
            "ca issuers",
            "issuers",
            "as133618",
            "as24940",
            "hetzner",
            "as26710",
            "icann",
            "as36352",
            "as24940 hetzner",
            "asn as133618",
            "as26710 icann",
            "apple as8075",
            "as47846",
            "as47995",
            "key algorithm",
            "united",
            "name",
            "type",
            "tsara brashears",
            "trojan",
            "key identifier",
            "key info",
            "land use",
            "link location",
            "united tls web",
            "tls web",
            "log id",
            "malvertizing",
            "malware",
            "http",
            "meekserver",
            "meta",
            "metasploit",
            "admin",
            "subject",
            "ransomware",
            "stop ransomware",
            "certificate status",
            "metro",
            "moved",
            "name servers",
            "netsupport rat",
            "number",
            "nxdomain",
            "passive dns",
            "servers",
            "server",
            "pegasus",
            "pingback",
            "submit",
            "ransom",
            "raspberry robin",
            "subject public",
            "subject key",
            "subject billing",
            "pdf broadcom",
            "pulse pulses",
            "pulse submit",
            "read c",
            "record value",
            "redacted referrer",
            "regbinary",
            "regdword",
            "registrant fax",
            "registrar",
            "registrar abuse",
            "registry domain",
            "registrar of",
            "registry policy",
            "regsetvalueexa",
            "regsetvalueexw",
            "show",
            "showing",
            "search",
            "urls",
            "script",
            "script domains",
            "scan endpoints",
            "russia unknown",
            "reverse dns",
            "resolutions",
            "nids",
            "related nids",
            "as39494 jsc",
            "body",
            "attorney james",
            "asn as133618",
            "javascript",
            "unknown",
            "url analysis",
            "unknown url",
            "url http",
            "v3 serial",
            "http",
            "as40528 icann",
            "as44273 host",
            "data center",
            "hosting",
            "vps",
            "reverse dns"
          ],
          "references": [
            "deviceinbox.com [Malware Hosting - Pegasus]",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
            "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
            "103.224.182.253 [Command and Control]",
            "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Australia"
          ],
          "malware_families": [
            {
              "id": "HiddenTear",
              "display_name": "HiddenTear",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": "65b60b85453c45eca795034d",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 77,
            "FileHash-SHA1": 81,
            "FileHash-SHA256": 359,
            "URL": 218,
            "SSLCertFingerprint": 2,
            "domain": 1932,
            "email": 12,
            "hostname": 528
          },
          "indicator_count": 3209,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "782 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b3fe6c4cd0f5158eb18692",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader,",
          "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA. Contact made. Physical records. Client: Brashears. https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/ 1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376 https://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/ https://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html TEL:Trojan:Win32/BazaarLoader 987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7https://www.joesandbox.com/analysis/1311477\nTarget: Critical Risk. In person contact made. Fraud services offered. \nThis is crazy.",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-26T18:48:12.433000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1509,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4239,
            "domain": 3480,
            "hostname": 2466,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 15854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 231,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b47501fcbc39983f098723",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-27T03:14:09.392000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b3fe6c4cd0f5158eb18692",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1509,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4239,
            "domain": 3480,
            "hostname": 2466,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 15854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b47524b1ec6b5c783a832e",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-27T03:14:44.070000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b3fb6752ac464268b971b1",
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1530,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5239,
            "domain": 3740,
            "hostname": 2560,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17661,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b80982381b53c66f0dd1e1",
          "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-01-29T20:24:34.644000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as3356 level",
            "as15133 verizon",
            "as22822",
            "as20446",
            "cname",
            "honeypot",
            "read c",
            "regsetvalueexa",
            "regdword",
            "as29789",
            "moved",
            "morphex",
            "cryp",
            "susp"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b47524b1ec6b5c783a832e",
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1530,
            "FileHash-MD5": 2428,
            "FileHash-SHA1": 2136,
            "FileHash-SHA256": 5239,
            "domain": 3740,
            "hostname": 2560,
            "CVE": 5,
            "email": 19,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 17661,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 232,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be8dde8544d0b022b4c464",
          "name": "Honeypot | https://jbplegal com/ | Cyber espionage  | Emotet ",
          "description": "",
          "modified": "2024-02-25T17:03:29.232000",
          "created": "2024-02-03T19:02:54.507000",
          "tags": [
            "no expiration",
            "filehashsha1",
            "filehashmd5",
            "filehashsha256",
            "url http",
            "ipv4",
            "iocs",
            "url https",
            "next",
            "scan endpoints",
            "expiration",
            "domain",
            "pdf report",
            "pcap",
            "all scoreblue",
            "hostname",
            "tagwearable",
            "email",
            "united",
            "as46562",
            "unknown",
            "as213120",
            "search",
            "creation date",
            "dnssec",
            "showing",
            "entries",
            "as32400 hostway",
            "encrypt",
            "status",
            "date",
            "passive dns",
            "urls",
            "record value",
            "apache",
            "pragma",
            "body",
            "as9009 m247",
            "pulse pulses",
            "files",
            "hosting",
            "location new",
            "as58955 bangmod",
            "pulse submit",
            "url analysis",
            "reverse dns",
            "all search",
            "otx scoreblue",
            "http",
            "ip address",
            "related nids",
            "filehash",
            "sha256",
            "av detections",
            "ids detections",
            "yara detections",
            "alerts",
            "analysis date",
            "june",
            "copy",
            "aaaa",
            "a domains",
            "address",
            "div div",
            "span span",
            "span h2",
            "a li",
            "lucky guy",
            "span",
            "customer",
            "location united",
            "cookie",
            "as54113",
            "xamzexpires300",
            "hstr",
            "github pages",
            "request id",
            "accept",
            "win64",
            "found",
            "show",
            "win32",
            "related pulses",
            "sea x",
            "cache",
            "dynamicloader",
            "targetname",
            "pe32",
            "intel",
            "ms windows",
            "yara rule",
            "high",
            "write",
            "bruteforce",
            "location china",
            "asn as45090",
            "cobalt strike",
            "internet",
            "iana",
            "whois lookups",
            "city",
            "los angeles",
            "orgabusephone",
            "orgid",
            "iana ref",
            "net192",
            "net1920000",
            "ssl cert",
            "ssl certificate",
            "tlsv1 apr",
            "cobaltstrike",
            "default",
            "read",
            "trojan",
            "ghost rat",
            "webtoolbar",
            "nanocore rat",
            "gamehack",
            "redlinestealer",
            "installcore",
            "installbrain",
            "emotet",
            "tofsee",
            "bradesco",
            "agent tesla",
            "trojanspy",
            "suppobox",
            "occamy",
            "dnspionage",
            "stealer",
            "malware",
            "no entries",
            "entries found",
            "delete",
            "found pe",
            "stus",
            "cnus",
            "tlsv1",
            "as20940",
            "as16625 akamai",
            "asnone united",
            "emails",
            "microsoft way",
            "as8075",
            "united kingdom",
            "aaaa nxdomain",
            "a nxdomain",
            "nxdomain",
            "as8068",
            "as14061",
            "whitelisted",
            "as16276",
            "script urls",
            "name servers",
            "meta",
            "as43317 fishnet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Brazil",
            "Netherlands",
            "Romania",
            "Russian Federation",
            "Japan"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1040",
              "name": "Network Sniffing",
              "display_name": "T1040 - Network Sniffing"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b85df45cc3d3fd07139ea9",
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 1509,
            "FileHash-MD5": 2213,
            "FileHash-SHA1": 1921,
            "FileHash-SHA256": 4239,
            "domain": 3480,
            "hostname": 2466,
            "CVE": 5,
            "email": 17,
            "SSLCertFingerprint": 4
          },
          "indicator_count": 15854,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "784 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "103.224.182.253 [Command and Control]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Hiddentear"
          ],
          "industries": [
            "Civil society"
          ]
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 10,
  "pulses": [
    {
      "id": "69e2cc9ebd63c32d9c0392c6",
      "name": "Hidden Tear BruteForcer Clone Credit OctoSeek",
      "description": "",
      "modified": "2026-04-18T00:13:18.484000",
      "created": "2026-04-18T00:13:18.484000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "url https",
        "iocs",
        "filehashsha1",
        "next",
        "x509v3",
        "key",
        "windows",
        "write",
        "whois ssl",
        "whois whois",
        "win32",
        "198-46-194-153-host.colocrossing.com",
        "a domains",
        "a nxdomain",
        "aaaa",
        "accept",
        "adapter driver",
        "address",
        "address domain",
        "algorithm",
        "all octoseek",
        "cookie",
        "copy",
        "core",
        "domain names",
        "domain",
        "dnssec",
        "discord",
        "whois record",
        "cyberstalking",
        "d417n",
        "timestamp",
        "data",
        "subject",
        "cyberstalking",
        "creation date",
        "ipv4",
        "ip address",
        "http identifier",
        "hostname",
        "historical ssl",
        "highly targeted",
        "high level",
        "high",
        "hiddentear",
        "gmtn",
        "germany unknown",
        "location first",
        "ip files",
        "files",
        "false files",
        "eu data",
        "entries",
        "download encrypt",
        "encrypt",
        "download",
        "contacted",
        "communicating",
        "coinminer",
        "code",
        "cobalt strike",
        "cname",
        "click",
        "ca issuers",
        "issuers",
        "as133618",
        "as24940",
        "hetzner",
        "as26710",
        "icann",
        "as36352",
        "as24940 hetzner",
        "asn as133618",
        "as26710 icann",
        "apple as8075",
        "as47846",
        "as47995",
        "key algorithm",
        "united",
        "name",
        "type",
        "tsara brashears",
        "trojan",
        "key identifier",
        "key info",
        "land use",
        "link location",
        "united tls web",
        "tls web",
        "log id",
        "malvertizing",
        "malware",
        "http",
        "meekserver",
        "meta",
        "metasploit",
        "admin",
        "subject",
        "ransomware",
        "stop ransomware",
        "certificate status",
        "metro",
        "moved",
        "name servers",
        "netsupport rat",
        "number",
        "nxdomain",
        "passive dns",
        "servers",
        "server",
        "pegasus",
        "pingback",
        "submit",
        "ransom",
        "raspberry robin",
        "subject public",
        "subject key",
        "subject billing",
        "pdf broadcom",
        "pulse pulses",
        "pulse submit",
        "read c",
        "record value",
        "redacted referrer",
        "regbinary",
        "regdword",
        "registrant fax",
        "registrar",
        "registrar abuse",
        "registry domain",
        "registrar of",
        "registry policy",
        "regsetvalueexa",
        "regsetvalueexw",
        "show",
        "showing",
        "search",
        "urls",
        "script",
        "script domains",
        "scan endpoints",
        "russia unknown",
        "reverse dns",
        "resolutions",
        "nids",
        "related nids",
        "as39494 jsc",
        "body",
        "attorney james",
        "asn as133618",
        "javascript",
        "unknown",
        "url analysis",
        "unknown url",
        "url http",
        "v3 serial",
        "http",
        "as40528 icann",
        "as44273 host",
        "data center",
        "hosting",
        "vps",
        "reverse dns"
      ],
      "references": [
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "103.224.182.253 [Command and Control]",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b60b85453c45eca795034d",
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 77,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 359,
        "URL": 218,
        "SSLCertFingerprint": 2,
        "domain": 1932,
        "email": 12,
        "hostname": 528
      },
      "indicator_count": 3209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 47,
      "modified_text": "1 day ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b3fb6752ac464268b971b1",
      "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
      "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA.\nContact made. Physical records. Client: Brashears.\nhttps://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/\n1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376\nhttps://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/\nhttps://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html\nTEL:Trojan:Win32/BazaarLoader\n987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7",
      "modified": "2024-09-05T07:02:20.491000",
      "created": "2024-01-26T18:35:19.690000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as3356 level",
        "as15133 verizon",
        "as22822",
        "as20446",
        "cname",
        "honeypot",
        "read c",
        "regsetvalueexa",
        "regdword",
        "as29789",
        "moved",
        "morphex",
        "cryp",
        "susp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2401,
        "FileHash-MD5": 2428,
        "FileHash-SHA1": 2136,
        "FileHash-SHA256": 5377,
        "domain": 3794,
        "hostname": 2763,
        "CVE": 5,
        "email": 19,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 18927,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b85df45cc3d3fd07139ea9",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
      "description": "",
      "modified": "2024-09-05T06:38:09.443000",
      "created": "2024-01-30T02:24:52.774000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b47501fcbc39983f098723",
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 2390,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4357,
        "domain": 3534,
        "hostname": 2670,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 17111,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b60b85453c45eca795034d",
      "name": "Hidden Tear BruteForcer",
      "description": "\u2022 The Hidden Tear BruteForcer is a program created by Michael Gillespie that can be used to brute force the password for ransomware infections. A ransomware-like file crypter sample which can be modified for specific purposes. Features. Uses AES algorithm to encrypt files. Can be downloaded for free for anyone to download in GitHub. Many cyber criminals, lawyers, investigators and governments use this project.\n\u2022 Raspberry Robin is an activity cluster spread by external drives that leverages Windows Installer.",
      "modified": "2024-02-27T06:04:19.663000",
      "created": "2024-01-28T08:08:37.586000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "url https",
        "iocs",
        "filehashsha1",
        "next",
        "x509v3",
        "key",
        "windows",
        "write",
        "whois ssl",
        "whois whois",
        "win32",
        "198-46-194-153-host.colocrossing.com",
        "a domains",
        "a nxdomain",
        "aaaa",
        "accept",
        "adapter driver",
        "address",
        "address domain",
        "algorithm",
        "all octoseek",
        "cookie",
        "copy",
        "core",
        "domain names",
        "domain",
        "dnssec",
        "discord",
        "whois record",
        "cyberstalking",
        "d417n",
        "timestamp",
        "data",
        "subject",
        "cyberstalking",
        "creation date",
        "ipv4",
        "ip address",
        "http identifier",
        "hostname",
        "historical ssl",
        "highly targeted",
        "high level",
        "high",
        "hiddentear",
        "gmtn",
        "germany unknown",
        "location first",
        "ip files",
        "files",
        "false files",
        "eu data",
        "entries",
        "download encrypt",
        "encrypt",
        "download",
        "contacted",
        "communicating",
        "coinminer",
        "code",
        "cobalt strike",
        "cname",
        "click",
        "ca issuers",
        "issuers",
        "as133618",
        "as24940",
        "hetzner",
        "as26710",
        "icann",
        "as36352",
        "as24940 hetzner",
        "asn as133618",
        "as26710 icann",
        "apple as8075",
        "as47846",
        "as47995",
        "key algorithm",
        "united",
        "name",
        "type",
        "tsara brashears",
        "trojan",
        "key identifier",
        "key info",
        "land use",
        "link location",
        "united tls web",
        "tls web",
        "log id",
        "malvertizing",
        "malware",
        "http",
        "meekserver",
        "meta",
        "metasploit",
        "admin",
        "subject",
        "ransomware",
        "stop ransomware",
        "certificate status",
        "metro",
        "moved",
        "name servers",
        "netsupport rat",
        "number",
        "nxdomain",
        "passive dns",
        "servers",
        "server",
        "pegasus",
        "pingback",
        "submit",
        "ransom",
        "raspberry robin",
        "subject public",
        "subject key",
        "subject billing",
        "pdf broadcom",
        "pulse pulses",
        "pulse submit",
        "read c",
        "record value",
        "redacted referrer",
        "regbinary",
        "regdword",
        "registrant fax",
        "registrar",
        "registrar abuse",
        "registry domain",
        "registrar of",
        "registry policy",
        "regsetvalueexa",
        "regsetvalueexw",
        "show",
        "showing",
        "search",
        "urls",
        "script",
        "script domains",
        "scan endpoints",
        "russia unknown",
        "reverse dns",
        "resolutions",
        "nids",
        "related nids",
        "as39494 jsc",
        "body",
        "attorney james",
        "asn as133618",
        "javascript",
        "unknown",
        "url analysis",
        "unknown url",
        "url http",
        "v3 serial",
        "http",
        "as40528 icann",
        "as44273 host",
        "data center",
        "hosting",
        "vps",
        "reverse dns"
      ],
      "references": [
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "103.224.182.253 [Command and Control]",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 77,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 359,
        "URL": 218,
        "SSLCertFingerprint": 2,
        "domain": 1932,
        "email": 12,
        "hostname": 528
      },
      "indicator_count": 3209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "782 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b8086a651e881715b3fc47",
      "name": "Hidden Tear BruteForcer",
      "description": "",
      "modified": "2024-02-27T06:04:19.663000",
      "created": "2024-01-29T20:19:54.173000",
      "tags": [
        "no expiration",
        "domain",
        "hostname",
        "expiration",
        "filehashsha256",
        "ipv4",
        "url http",
        "url https",
        "iocs",
        "filehashsha1",
        "next",
        "x509v3",
        "key",
        "windows",
        "write",
        "whois ssl",
        "whois whois",
        "win32",
        "198-46-194-153-host.colocrossing.com",
        "a domains",
        "a nxdomain",
        "aaaa",
        "accept",
        "adapter driver",
        "address",
        "address domain",
        "algorithm",
        "all octoseek",
        "cookie",
        "copy",
        "core",
        "domain names",
        "domain",
        "dnssec",
        "discord",
        "whois record",
        "cyberstalking",
        "d417n",
        "timestamp",
        "data",
        "subject",
        "cyberstalking",
        "creation date",
        "ipv4",
        "ip address",
        "http identifier",
        "hostname",
        "historical ssl",
        "highly targeted",
        "high level",
        "high",
        "hiddentear",
        "gmtn",
        "germany unknown",
        "location first",
        "ip files",
        "files",
        "false files",
        "eu data",
        "entries",
        "download encrypt",
        "encrypt",
        "download",
        "contacted",
        "communicating",
        "coinminer",
        "code",
        "cobalt strike",
        "cname",
        "click",
        "ca issuers",
        "issuers",
        "as133618",
        "as24940",
        "hetzner",
        "as26710",
        "icann",
        "as36352",
        "as24940 hetzner",
        "asn as133618",
        "as26710 icann",
        "apple as8075",
        "as47846",
        "as47995",
        "key algorithm",
        "united",
        "name",
        "type",
        "tsara brashears",
        "trojan",
        "key identifier",
        "key info",
        "land use",
        "link location",
        "united tls web",
        "tls web",
        "log id",
        "malvertizing",
        "malware",
        "http",
        "meekserver",
        "meta",
        "metasploit",
        "admin",
        "subject",
        "ransomware",
        "stop ransomware",
        "certificate status",
        "metro",
        "moved",
        "name servers",
        "netsupport rat",
        "number",
        "nxdomain",
        "passive dns",
        "servers",
        "server",
        "pegasus",
        "pingback",
        "submit",
        "ransom",
        "raspberry robin",
        "subject public",
        "subject key",
        "subject billing",
        "pdf broadcom",
        "pulse pulses",
        "pulse submit",
        "read c",
        "record value",
        "redacted referrer",
        "regbinary",
        "regdword",
        "registrant fax",
        "registrar",
        "registrar abuse",
        "registry domain",
        "registrar of",
        "registry policy",
        "regsetvalueexa",
        "regsetvalueexw",
        "show",
        "showing",
        "search",
        "urls",
        "script",
        "script domains",
        "scan endpoints",
        "russia unknown",
        "reverse dns",
        "resolutions",
        "nids",
        "related nids",
        "as39494 jsc",
        "body",
        "attorney james",
        "asn as133618",
        "javascript",
        "unknown",
        "url analysis",
        "unknown url",
        "url http",
        "v3 serial",
        "http",
        "as40528 icann",
        "as44273 host",
        "data center",
        "hosting",
        "vps",
        "reverse dns"
      ],
      "references": [
        "deviceinbox.com [Malware Hosting - Pegasus]",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [UPX_BA, phishing, prism.exe]",
        "hedontwantyoubitch.com [hawaianairlineswifi.com DNS: honoringel]",
        "103.224.182.253 [Command and Control]",
        "198.46.194.153  [scanning host] | 198-46-194-153-host.colocrossing.com -reverse dns"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Australia"
      ],
      "malware_families": [
        {
          "id": "HiddenTear",
          "display_name": "HiddenTear",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": "65b60b85453c45eca795034d",
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 77,
        "FileHash-SHA1": 81,
        "FileHash-SHA256": 359,
        "URL": 218,
        "SSLCertFingerprint": 2,
        "domain": 1932,
        "email": 12,
        "hostname": 528
      },
      "indicator_count": 3209,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "782 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b3fe6c4cd0f5158eb18692",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader,",
      "description": "Found periphery.m (moderate sized dump) Targets Tsara Brashears Several staffed law offices based on Colorado, USA. Contact made. Physical records. Client: Brashears. https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/Trojan.Win32.REDCAP.MCRK/ 1c597b7c7934ef03eb0def0b64655dd79abe08567ff3053761e5516064a43376 https://otx.alienvault.com/malware/TEL:Trojan:Win32%2FBazaarLoader!MTB/ https://www.trendmicro.com/en_ph/research/21/k/bazarloader-adds-compromised-installers-iso-to-arrival-delivery-vectors.html TEL:Trojan:Win32/BazaarLoader 987204ca82337f0a3f28097a5d66d5f3ecb11d43d82f67cd753d0bf2ce40b7a7https://www.joesandbox.com/analysis/1311477\nTarget: Critical Risk. In person contact made. Fraud services offered. \nThis is crazy.",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-26T18:48:12.433000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1509,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4239,
        "domain": 3480,
        "hostname": 2466,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 15854,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 231,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b47501fcbc39983f098723",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage | DynamicLoader",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-27T03:14:09.392000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b3fe6c4cd0f5158eb18692",
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1509,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4239,
        "domain": 3480,
        "hostname": 2466,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 15854,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b47524b1ec6b5c783a832e",
      "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-27T03:14:44.070000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as3356 level",
        "as15133 verizon",
        "as22822",
        "as20446",
        "cname",
        "honeypot",
        "read c",
        "regsetvalueexa",
        "regdword",
        "as29789",
        "moved",
        "morphex",
        "cryp",
        "susp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b3fb6752ac464268b971b1",
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1530,
        "FileHash-MD5": 2428,
        "FileHash-SHA1": 2136,
        "FileHash-SHA256": 5239,
        "domain": 3740,
        "hostname": 2560,
        "CVE": 5,
        "email": 19,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 17661,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b80982381b53c66f0dd1e1",
      "name": "BazaarLoader | REDCAP | https://jbplegal com/ | Cyber espionage",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-01-29T20:24:34.644000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as3356 level",
        "as15133 verizon",
        "as22822",
        "as20446",
        "cname",
        "honeypot",
        "read c",
        "regsetvalueexa",
        "regdword",
        "as29789",
        "moved",
        "morphex",
        "cryp",
        "susp"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b47524b1ec6b5c783a832e",
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1530,
        "FileHash-MD5": 2428,
        "FileHash-SHA1": 2136,
        "FileHash-SHA256": 5239,
        "domain": 3740,
        "hostname": 2560,
        "CVE": 5,
        "email": 19,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 17661,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 232,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65be8dde8544d0b022b4c464",
      "name": "Honeypot | https://jbplegal com/ | Cyber espionage  | Emotet ",
      "description": "",
      "modified": "2024-02-25T17:03:29.232000",
      "created": "2024-02-03T19:02:54.507000",
      "tags": [
        "no expiration",
        "filehashsha1",
        "filehashmd5",
        "filehashsha256",
        "url http",
        "ipv4",
        "iocs",
        "url https",
        "next",
        "scan endpoints",
        "expiration",
        "domain",
        "pdf report",
        "pcap",
        "all scoreblue",
        "hostname",
        "tagwearable",
        "email",
        "united",
        "as46562",
        "unknown",
        "as213120",
        "search",
        "creation date",
        "dnssec",
        "showing",
        "entries",
        "as32400 hostway",
        "encrypt",
        "status",
        "date",
        "passive dns",
        "urls",
        "record value",
        "apache",
        "pragma",
        "body",
        "as9009 m247",
        "pulse pulses",
        "files",
        "hosting",
        "location new",
        "as58955 bangmod",
        "pulse submit",
        "url analysis",
        "reverse dns",
        "all search",
        "otx scoreblue",
        "http",
        "ip address",
        "related nids",
        "filehash",
        "sha256",
        "av detections",
        "ids detections",
        "yara detections",
        "alerts",
        "analysis date",
        "june",
        "copy",
        "aaaa",
        "a domains",
        "address",
        "div div",
        "span span",
        "span h2",
        "a li",
        "lucky guy",
        "span",
        "customer",
        "location united",
        "cookie",
        "as54113",
        "xamzexpires300",
        "hstr",
        "github pages",
        "request id",
        "accept",
        "win64",
        "found",
        "show",
        "win32",
        "related pulses",
        "sea x",
        "cache",
        "dynamicloader",
        "targetname",
        "pe32",
        "intel",
        "ms windows",
        "yara rule",
        "high",
        "write",
        "bruteforce",
        "location china",
        "asn as45090",
        "cobalt strike",
        "internet",
        "iana",
        "whois lookups",
        "city",
        "los angeles",
        "orgabusephone",
        "orgid",
        "iana ref",
        "net192",
        "net1920000",
        "ssl cert",
        "ssl certificate",
        "tlsv1 apr",
        "cobaltstrike",
        "default",
        "read",
        "trojan",
        "ghost rat",
        "webtoolbar",
        "nanocore rat",
        "gamehack",
        "redlinestealer",
        "installcore",
        "installbrain",
        "emotet",
        "tofsee",
        "bradesco",
        "agent tesla",
        "trojanspy",
        "suppobox",
        "occamy",
        "dnspionage",
        "stealer",
        "malware",
        "no entries",
        "entries found",
        "delete",
        "found pe",
        "stus",
        "cnus",
        "tlsv1",
        "as20940",
        "as16625 akamai",
        "asnone united",
        "emails",
        "microsoft way",
        "as8075",
        "united kingdom",
        "aaaa nxdomain",
        "a nxdomain",
        "nxdomain",
        "as8068",
        "as14061",
        "whitelisted",
        "as16276",
        "script urls",
        "name servers",
        "meta",
        "as43317 fishnet"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Brazil",
        "Netherlands",
        "Romania",
        "Russian Federation",
        "Japan"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1040",
          "name": "Network Sniffing",
          "display_name": "T1040 - Network Sniffing"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65b85df45cc3d3fd07139ea9",
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 1509,
        "FileHash-MD5": 2213,
        "FileHash-SHA1": 1921,
        "FileHash-SHA256": 4239,
        "domain": 3480,
        "hostname": 2466,
        "CVE": 5,
        "email": 17,
        "SSLCertFingerprint": 4
      },
      "indicator_count": 15854,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "784 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "gabplot.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "gabplot.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629596.9345882
}