{
  "type": "Domain",
  "indicator": "googleapi.at",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/googleapi.at",
    "alexa": "http://www.alexa.com/siteinfo/googleapi.at",
    "indicator": "googleapi.at",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3140111720,
      "indicator": "googleapi.at",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 23,
      "pulses": [
        {
          "id": "69a9e7c572b8411d126215a6",
          "name": "@scoreblue callback clone",
          "description": "",
          "modified": "2026-03-06T05:11:18.020000",
          "created": "2026-03-05T20:29:57.169000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a052c4160dbd76054f8a",
          "export_count": 1,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "msudosos",
            "id": "381696",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3267,
            "domain": 1459,
            "hostname": 1268,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9172,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 50,
          "modified_text": "45 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65aab954f5f03a1f2906b39c",
          "name": "Zerobot",
          "description": "",
          "modified": "2024-10-12T07:01:26.973000",
          "created": "2024-01-19T18:03:00.966000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65aa168aeddea4851fc47cc3",
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 123,
            "FileHash-SHA1": 123,
            "FileHash-SHA256": 2498,
            "domain": 1600,
            "hostname": 2749,
            "URL": 6303,
            "CVE": 1
          },
          "indicator_count": 13397,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "555 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65aa168aeddea4851fc47cc3",
          "name": "Zerobot & Skynet",
          "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
          "modified": "2024-03-23T01:01:38.014000",
          "created": "2024-01-19T06:28:26.343000",
          "tags": [
            "ssl certificate",
            "whois record",
            "referrer",
            "historical ssl",
            "resolutions",
            "whois whois",
            "communicating",
            "subdomains",
            "contacted",
            "c1on",
            "cmdwget http",
            "metro",
            "zerobot",
            "execution",
            "skynet",
            "june"
          ],
          "references": [
            "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "ZeroBot",
              "display_name": "ZeroBot",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 13,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 78,
            "FileHash-SHA1": 78,
            "FileHash-SHA256": 2290,
            "domain": 1491,
            "hostname": 2611,
            "URL": 5879,
            "CVE": 8
          },
          "indicator_count": 12435,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "759 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d0a9c7f1b04296d9b0d803",
          "name": "History Killer Pro Injection deleting VirusTotal & OTX.AlienVault Pulses",
          "description": "",
          "modified": "2024-03-18T04:01:27.756000",
          "created": "2024-02-17T12:42:47.334000",
          "tags": [
            "contacted",
            "execution",
            "january",
            "september",
            "whois record",
            "resolutions",
            "communicating",
            "roundup",
            "highly targeted",
            "phishing",
            "quasar",
            "malware",
            "open",
            "threat roundup",
            "referrer",
            "remote",
            "kimsuky",
            "passive dns",
            "urls",
            "dive domains",
            "creation date",
            "search",
            "record value",
            "date",
            "united",
            "scan endpoints",
            "all scoreblue",
            "unknown",
            "body",
            "brian sabey",
            "hall render",
            "reinsurance",
            "state",
            "danger",
            "threat",
            "critical",
            "crypthashdata",
            "read c",
            "tcmiheijkmutcix",
            "entries",
            "show",
            "t1055",
            "intel",
            "ms windows",
            "delphi",
            "win32",
            "copy",
            "write",
            "injection",
            "zusy",
            "neojit",
            "cyber stalking",
            "worker",
            "inject",
            "illegal",
            "tampering",
            "hijacker",
            "delete",
            "ret hat",
            "stalker",
            "shadow",
            "quasi"
          ],
          "references": [
            "www.historykillerpro.com",
            "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
            "http://sniper.debugger.ru",
            "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Variant.Zusy.572 Checkin",
              "display_name": "Variant.Zusy.572 Checkin",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Neojit.A",
              "display_name": "TrojanDownloader:Win32/Neojit.A",
              "target": "/malware/TrojanDownloader:Win32/Neojit.A"
            },
            {
              "id": "Win32:Delf-SES\\ [Trj]",
              "display_name": "Win32:Delf-SES\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1372316",
              "display_name": "Win.Trojan.Agent-1372316",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65d053a935bf99f5263deb57",
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1915,
            "FileHash-MD5": 437,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 3054,
            "domain": 987,
            "URL": 5902,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 12732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "763 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65d053a935bf99f5263deb57",
          "name": "History Killer Pro Injection deleting virustotal & otx.alienvault Pulses",
          "description": "History killer pro, is being used to delete and modify virustotal nodes and 41 otx.alienvault pulses. Junk data is being used to fill in missing pulses.\nTargeted: 1 callmeDoris  several scoreblue (sometimes I clone pulses) Octoseek.  \npulses.\nHallrender, Metro by T-Mobile, https://myaccount.uscis.gov/, Esurance,  40 pule reports are regarding Tsara Brashears cyber bully campaign which attacked the corporates mentioned except 2 AIG and Hallrender attackers. 100's of other modifications, deletions by another tool affecting several users.",
          "modified": "2024-03-18T04:01:27.756000",
          "created": "2024-02-17T06:35:21.666000",
          "tags": [
            "contacted",
            "execution",
            "january",
            "september",
            "whois record",
            "resolutions",
            "communicating",
            "roundup",
            "highly targeted",
            "phishing",
            "quasar",
            "malware",
            "open",
            "threat roundup",
            "referrer",
            "remote",
            "kimsuky",
            "passive dns",
            "urls",
            "dive domains",
            "creation date",
            "search",
            "record value",
            "date",
            "united",
            "scan endpoints",
            "all scoreblue",
            "unknown",
            "body",
            "brian sabey",
            "hall render",
            "reinsurance",
            "state",
            "danger",
            "threat",
            "critical",
            "crypthashdata",
            "read c",
            "tcmiheijkmutcix",
            "entries",
            "show",
            "t1055",
            "intel",
            "ms windows",
            "delphi",
            "win32",
            "copy",
            "write",
            "injection",
            "zusy",
            "neojit",
            "cyber stalking",
            "worker",
            "inject",
            "illegal",
            "tampering",
            "hijacker",
            "delete",
            "ret hat",
            "stalker",
            "shadow",
            "quasi"
          ],
          "references": [
            "www.historykillerpro.com",
            "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
            "http://sniper.debugger.ru",
            "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
            "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Variant.Zusy.572 Checkin",
              "display_name": "Variant.Zusy.572 Checkin",
              "target": null
            },
            {
              "id": "TrojanDownloader:Win32/Neojit.A",
              "display_name": "TrojanDownloader:Win32/Neojit.A",
              "target": "/malware/TrojanDownloader:Win32/Neojit.A"
            },
            {
              "id": "Win32:Delf-SES\\ [Trj]",
              "display_name": "Win32:Delf-SES\\ [Trj]",
              "target": null
            },
            {
              "id": "Win.Trojan.Agent-1372316",
              "display_name": "Win.Trojan.Agent-1372316",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1094",
              "name": "Custom Command and Control Protocol",
              "display_name": "T1094 - Custom Command and Control Protocol"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1915,
            "FileHash-MD5": 437,
            "FileHash-SHA1": 435,
            "FileHash-SHA256": 3054,
            "domain": 987,
            "URL": 5902,
            "email": 1,
            "CVE": 1
          },
          "indicator_count": 12732,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "763 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d302007152543202bac",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:20.375000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 310,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 229,
          "modified_text": "779 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0d2518a7ef9bb17df1b9",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:29:09.832000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "779 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cfda433eb05bde3827b",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:29.606000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "779 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65bc0cf9b0dac1aa7f9046cf",
          "name": "WannaCry",
          "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
          "modified": "2024-03-02T21:02:32.756000",
          "created": "2024-02-01T21:28:25.092000",
          "tags": [
            "contacted",
            "tsara brashears",
            "urls url",
            "files",
            "pegasus",
            "domains",
            "cellbrite",
            "targets sa",
            "survivor",
            "apple ios",
            "execution",
            "lockbit",
            "malware",
            "core",
            "awful",
            "hacktool",
            "crypto",
            "ransomexx",
            "quasar",
            "asyncrat",
            "bot network",
            "loader",
            "ransomware",
            "wannacry",
            "cryptor",
            "encoder",
            "compiler",
            "win32 dll",
            "pe32",
            "intel",
            "ms windows",
            "ms visual",
            "win32 dynamic",
            "link library",
            "win16 ne",
            "pe32 compiler",
            "vs98",
            "contained",
            "w english",
            "info compiler",
            "products",
            "header intel",
            "name md5",
            "type",
            "language",
            "overlay",
            "as133618",
            "unknown",
            "cname",
            "united",
            "germany unknown",
            "ukraine unknown",
            "ireland unknown",
            "virgin islands",
            "as47846",
            "as39084 rinet",
            "date",
            "encrypt",
            "next",
            "microsoft visual c++ v6.0",
            "as133618 trellian pty. limited",
            "dynamicloader",
            "high",
            "t1063",
            "yara rule",
            "medium",
            "spoofs",
            "high security",
            "software",
            "discovery",
            "attempts",
            "april",
            "dropper",
            "reads self",
            "bots",
            "connect",
            "botnet",
            "sabey",
            "libel",
            "menacing",
            "brother sabey",
            "as15169 google",
            "aaaa",
            "search",
            "name servers",
            "as29182 jsc",
            "russia unknown",
            "found",
            "error"
          ],
          "references": [
            "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
            "cellebrite.com | enterprise.cellebrite.com",
            "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
            "deviceinbox.com",
            "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
            "c1a99e3bde9bad27e463c32b96311312.virus",
            "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
            "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
            "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
            "CS IDS rule: (port_scan) TCP filtered portsweep",
            "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
            "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
            "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
            "Trojan:Win32/WannaCry.350",
            "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
            "angebot.staude.de",
            "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
            "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears/",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
            "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
          ],
          "public": 1,
          "adversary": "NSO Group - Pegasus",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan:Win32/WannaCry.350",
              "display_name": "Trojan:Win32/WannaCry.350",
              "target": "/malware/Trojan:Win32/WannaCry.350"
            }
          ],
          "attack_ids": [
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1584.005",
              "name": "Botnet",
              "display_name": "T1584.005 - Botnet"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 67,
            "FileHash-SHA1": 62,
            "FileHash-SHA256": 2864,
            "domain": 1401,
            "URL": 5523,
            "hostname": 1766,
            "FilePath": 1,
            "CVE": 2,
            "email": 5
          },
          "indicator_count": 11691,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "779 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8a056f2c1f16d391175b0",
          "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
          "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T07:08:06.711000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65c970b55f5040aee8c91a55",
          "name": "Callback Phishing Campaign | Pegasus",
          "description": "",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-02-12T01:13:25.034000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a05a0b9ebf8d916f0a6d",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65be8c8b8997508722c642ee",
          "name": "Phishing Campaign | Pegasus ",
          "description": "",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-02-03T18:57:15.475000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a05a0b9ebf8d916f0a6d",
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b9716ef65566497546a7b1",
          "name": "Callback Phishing Campaign | Pegasus | https://safebae.org/",
          "description": "",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T22:00:14.725000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65b8a05a0b9ebf8d916f0a6d",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8a05a0b9ebf8d916f0a6d",
          "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
          "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T07:08:10.072000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b8a052c4160dbd76054f8a",
          "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
          "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
          "modified": "2024-02-29T04:00:48.424000",
          "created": "2024-01-30T07:08:02.918000",
          "tags": [
            "acceptencoding",
            "http response",
            "final url",
            "ip address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers xcache",
            "wp engine",
            "threat",
            "paste",
            "iocs",
            "urls https",
            "samples",
            "contacted",
            "apple",
            "ssl certificate",
            "whois record",
            "contacted",
            "historical ssl",
            "referrer",
            "execution",
            "tsara brashears",
            "apple ios",
            "historical",
            "communicating",
            "copy",
            "attack",
            "njrat",
            "ransomware",
            "hacktool",
            "metro",
            "malicious",
            "crypto",
            "installer",
            "awful",
            "startpage",
            "callback phishing",
            "safebae",
            "catherine daisy coleman",
            "pegasus",
            "nso",
            "kb font",
            "january",
            "http",
            "resource path",
            "size",
            "type mimetype",
            "primary request",
            "kb document",
            "general full",
            "url http",
            "low risk",
            "sucuri firewall",
            "malware found",
            "site",
            "unknown",
            "low security",
            "risk",
            "website malware",
            "security no",
            "protect",
            "html internet",
            "html document",
            "unicode text",
            "utf8 text",
            "no data",
            "tag count",
            "sample summary",
            "sample",
            "detection list",
            "blacklist",
            "count blacklist",
            "tag tag",
            "anchor hrefs",
            "wordpress",
            "html info",
            "title safebae",
            "anyone else",
            "meta tags",
            "wpbakery page",
            "builder",
            "slider plugin",
            "script tags",
            "passive dns",
            "urls",
            "a nxdomain",
            "scan endpoints",
            "all scoreblue",
            "hostname",
            "pulse pulses",
            "files",
            "domain",
            "files ip",
            "united",
            "status",
            "as13768 aptum",
            "date",
            "moved",
            "creation date",
            "search",
            "record value",
            "body",
            "log id",
            "gmtn",
            "go daddy",
            "authority",
            "tls web",
            "arizona",
            "scottsdale",
            "ca issuers",
            "false",
            "as30148 sucuri",
            "a domains",
            "gmt content",
            "ipv4",
            "win64",
            "back",
            "linux mint",
            "hacking",
            "brian sabey",
            "tracking",
            "hallrender",
            "staging",
            "dns",
            "network",
            "control",
            "bazar"
          ],
          "references": [
            "https://safebae.org/",
            "www.hallrender.com",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
            "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
            "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
            "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
            "s3.amazonaws.com [ metro T-Mobile spyware porn]",
            "9.6.zip - SQLi",
            "dns.trackgroup.net",
            "nr-data.net [Apple Private Data Collection]",
            "scripting-sandbox-dns.bunny.net",
            "http://www.01tracks.com/happy-customers",
            "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
            "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
            "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
            "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
            "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
            "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
            "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
            "deadlyexploits.com | deadlysymbol.com |",
            "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Callback Phishing",
              "display_name": "Callback Phishing",
              "target": null
            },
            {
              "id": "Ransomware",
              "display_name": "Ransomware",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Pegasus",
              "display_name": "Pegasus",
              "target": null
            },
            {
              "id": "NjRAT",
              "display_name": "NjRAT",
              "target": null
            },
            {
              "id": "BazarCall",
              "display_name": "BazarCall",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1029",
              "name": "Scheduled Transfer",
              "display_name": "T1029 - Scheduled Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2802,
            "URL": 3266,
            "domain": 1458,
            "hostname": 1265,
            "FileHash-MD5": 227,
            "FileHash-SHA1": 144,
            "CVE": 2,
            "email": 1,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 9167,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "781 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b865697c59050da541247f",
          "name": "Tags auto populated in original Threat Network pulse missing",
          "description": "",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-30T02:56:41.045000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "785 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b86568e1eaace7d9f062b4",
          "name": "Tags auto populated in original Threat Network pulse missing",
          "description": "",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-30T02:56:40.484000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "785 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b474c9c9bed0cdd00a9480",
          "name": "Spyware | Ransomware | Threat & Direct Search Network | Trellian",
          "description": "",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-27T03:13:13.978000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "65b4624c5bb71879020ceb1c",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "785 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b4624c5bb71879020ceb1c",
          "name": "Spyware | Ransomware | Direct Search Network | Trellian",
          "description": "Large, hard to believe fraudulent threat network. Fraud services from private investigators to attorneys. Social engineering by phone, email, sponsored advertising, malvertizing, remote attacks. tracking, in person, emails, surveys, text, ongoing espionage campaigns, info stealing, cyber attacks, arrange in person meetings , identified as 'gang stalking' by detective, service staging. Very real. Bad actors take advantage of targets devices installing  overlays on windows,android. iOS. Targets can only see what adversary wants seen.\n\nLarge threat network in Colorado and abroad.\nScreenshot: https://otx.alienvault.com/otxapi/indicators/url/screenshot/http://1redirc.com/r2.php\nCouldn't submit 1st pulse. contacted, spyware, phishing,trojan, registrar abuse",
          "modified": "2024-02-26T01:04:33.201000",
          "created": "2024-01-27T01:54:20.513000",
          "tags": [
            "no expiration",
            "expiration",
            "url https",
            "filehashmd5",
            "ipv4",
            "filehashsha1",
            "filehashsha256",
            "domain",
            "url http",
            "iocs",
            "next",
            "hostname",
            "scan endpoints",
            "all scoreblue",
            "pdf report",
            "pcap"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 3010,
            "FileHash-MD5": 1902,
            "FileHash-SHA1": 1467,
            "FileHash-SHA256": 2664,
            "domain": 1195,
            "hostname": 1802,
            "email": 27,
            "SSLCertFingerprint": 9
          },
          "indicator_count": 12076,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "785 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a836104ede1963b0502042",
          "name": "Not even Google",
          "description": "https://shadow.googlecnapps.cn\njoshuajenkinslaw.com",
          "modified": "2024-02-16T17:02:44.115000",
          "created": "2024-01-17T20:18:24.316000",
          "tags": [
            "ssl certificate",
            "threat roundup",
            "whois record",
            "march",
            "october",
            "contacted",
            "july",
            "april",
            "june",
            "roundup",
            "august",
            "copy",
            "execution",
            "plugx",
            "goldfinder",
            "sibot",
            "hacktool",
            "february",
            "ransomexx",
            "ermac",
            "emotet",
            "agent tesla",
            "nokoyawa"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1315,
            "URL": 1384,
            "domain": 327,
            "hostname": 516,
            "FileHash-MD5": 19,
            "FileHash-SHA1": 19
          },
          "indicator_count": 3580,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "794 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a46bc0233456a762af207a",
          "name": "https://www.google.com/sorry/index?continue= MITRE TI566 & Phishing Mr.Looquer   [by StreamMiningExPublic]",
          "description": "",
          "modified": "2024-01-14T23:18:24.510000",
          "created": "2024-01-14T23:18:24.510000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6570a05816a2ac8b0bd23522",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 932,
            "domain": 407,
            "URL": 1058,
            "email": 5,
            "hostname": 505,
            "FileHash-MD5": 46,
            "FileHash-SHA1": 6,
            "CIDR": 2
          },
          "indicator_count": 2961,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "827 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a05816a2ac8b0bd23522",
          "name": "https://www.google.com/sorry/index?continue= MITRE TI566 & Phishing Mr.Looquer",
          "description": "",
          "modified": "2023-12-06T16:24:56.063000",
          "created": "2023-12-06T16:24:56.063000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 932,
            "domain": 407,
            "URL": 1058,
            "email": 5,
            "hostname": 505,
            "FileHash-MD5": 46,
            "FileHash-SHA1": 6,
            "CIDR": 2
          },
          "indicator_count": 2961,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "866 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "64e155d6aee2be3e9e807fcc",
          "name": "https://www.google.com/sorry/index?continue= MITRE TI566 & Phishing Mr.Looquer",
          "description": "I am remotely attacked. Nothing new. Usual suspects. They are quite good at annoying me. \nVery Malicious. Phishing. Mr.Looquer. \n\nMy device has a renewed life. This device is controlled by 'US' now.\nApparently my IT technician will not let me remove their remotely installed app from my device. \n172.217.14.196\nALF:Backdoor:MSIL/Noancooe.KA\nALF:E5.SpikeAex.rhh_mcv\nALF:HeraklezEval:BrowserModifier:Win32/Foniad\nALF:HeraklezEval:PUA:Win32/4Shared\nALF:HeraklezEval:PUA:Win32/PCSpeedCat\n\nIDS Detections\nPossible Zeus GameOver Connectivity Check\nWin32/Enosch.A gtalk connectivity check\nMedfos Connectivity Check\nWin32/Multibar.EA Variant PUP Google Connectivity Check\nToolbar Download\nW32/MoonLight.worm User-Agent (HellSpawn)\nSuspicious User-Agent HTTP Client\nUser-Agent (Mozilla) - Possible Spyware Related\nObserved Suspicious UA (AdvancedInstaller)\nNullsoft Mozilla UA (NSISDL)\n..",
          "modified": "2023-09-19T02:02:31.116000",
          "created": "2023-08-19T23:52:54.581000",
          "tags": [
            "thu jul",
            "thu aug",
            "wed oct",
            "thu may",
            "wed jul",
            "tue oct",
            "thu sep",
            "mon may",
            "tue jan",
            "sat oct",
            "malware",
            "team",
            "soar",
            "service",
            "overview ip",
            "address"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 16,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1578,
            "domain": 921,
            "hostname": 1130,
            "URL": 2358,
            "FileHash-MD5": 50,
            "FileHash-SHA1": 10,
            "email": 6,
            "CIDR": 2
          },
          "indicator_count": 6055,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "944 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "www.historykillerpro.com",
        "deadlyexploits.com | deadlysymbol.com |",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "angebot.staude.de",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "http://sniper.debugger.ru",
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/",
        "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
        "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com",
        "s3.amazonaws.com [ metro T-Mobile spyware porn]",
        "https://safebae.org/",
        "dns.trackgroup.net",
        "Trojan:Win32/WannaCry.350",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "http://www.01tracks.com/happy-customers",
        "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
        "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
        "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
        "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "scripting-sandbox-dns.bunny.net",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "nr-data.net [Apple Private Data Collection]",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "deviceinbox.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "www.hallrender.com",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "cellebrite.com | enterprise.cellebrite.com",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "9.6.zip - SQLi",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [
            "NSO Group - Pegasus"
          ],
          "malware_families": [
            "Variant.zusy.572 checkin",
            "Zerobot",
            "Trojandownloader:win32/neojit.a",
            "Win.trojan.agent-1372316",
            "Hacktool",
            "Trojan:win32/wannacry.350",
            "Bazarcall",
            "Callback phishing",
            "Skynet",
            "Win32:delf-ses\\ [trj]",
            "Njrat",
            "Pegasus",
            "Ransomware"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 23,
  "pulses": [
    {
      "id": "69a9e7c572b8411d126215a6",
      "name": "@scoreblue callback clone",
      "description": "",
      "modified": "2026-03-06T05:11:18.020000",
      "created": "2026-03-05T20:29:57.169000",
      "tags": [
        "acceptencoding",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers xcache",
        "wp engine",
        "threat",
        "paste",
        "iocs",
        "urls https",
        "samples",
        "contacted",
        "apple",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "referrer",
        "execution",
        "tsara brashears",
        "apple ios",
        "historical",
        "communicating",
        "copy",
        "attack",
        "njrat",
        "ransomware",
        "hacktool",
        "metro",
        "malicious",
        "crypto",
        "installer",
        "awful",
        "startpage",
        "callback phishing",
        "safebae",
        "catherine daisy coleman",
        "pegasus",
        "nso",
        "kb font",
        "january",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "kb document",
        "general full",
        "url http",
        "low risk",
        "sucuri firewall",
        "malware found",
        "site",
        "unknown",
        "low security",
        "risk",
        "website malware",
        "security no",
        "protect",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "no data",
        "tag count",
        "sample summary",
        "sample",
        "detection list",
        "blacklist",
        "count blacklist",
        "tag tag",
        "anchor hrefs",
        "wordpress",
        "html info",
        "title safebae",
        "anyone else",
        "meta tags",
        "wpbakery page",
        "builder",
        "slider plugin",
        "script tags",
        "passive dns",
        "urls",
        "a nxdomain",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "united",
        "status",
        "as13768 aptum",
        "date",
        "moved",
        "creation date",
        "search",
        "record value",
        "body",
        "log id",
        "gmtn",
        "go daddy",
        "authority",
        "tls web",
        "arizona",
        "scottsdale",
        "ca issuers",
        "false",
        "as30148 sucuri",
        "a domains",
        "gmt content",
        "ipv4",
        "win64",
        "back",
        "linux mint",
        "hacking",
        "brian sabey",
        "tracking",
        "hallrender",
        "staging",
        "dns",
        "network",
        "control",
        "bazar"
      ],
      "references": [
        "https://safebae.org/",
        "www.hallrender.com",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
        "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
        "s3.amazonaws.com [ metro T-Mobile spyware porn]",
        "9.6.zip - SQLi",
        "dns.trackgroup.net",
        "nr-data.net [Apple Private Data Collection]",
        "scripting-sandbox-dns.bunny.net",
        "http://www.01tracks.com/happy-customers",
        "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
        "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
        "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
        "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
        "deadlyexploits.com | deadlysymbol.com |",
        "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Callback Phishing",
          "display_name": "Callback Phishing",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "BazarCall",
          "display_name": "BazarCall",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1029",
          "name": "Scheduled Transfer",
          "display_name": "T1029 - Scheduled Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65b8a052c4160dbd76054f8a",
      "export_count": 1,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "msudosos",
        "id": "381696",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2802,
        "URL": 3267,
        "domain": 1459,
        "hostname": 1268,
        "FileHash-MD5": 227,
        "FileHash-SHA1": 144,
        "CVE": 2,
        "email": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9172,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 50,
      "modified_text": "45 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65aab954f5f03a1f2906b39c",
      "name": "Zerobot",
      "description": "",
      "modified": "2024-10-12T07:01:26.973000",
      "created": "2024-01-19T18:03:00.966000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "whois whois",
        "communicating",
        "subdomains",
        "contacted",
        "c1on",
        "cmdwget http",
        "metro",
        "zerobot",
        "execution",
        "skynet",
        "june"
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ZeroBot",
          "display_name": "ZeroBot",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65aa168aeddea4851fc47cc3",
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 123,
        "FileHash-SHA1": 123,
        "FileHash-SHA256": 2498,
        "domain": 1600,
        "hostname": 2749,
        "URL": 6303,
        "CVE": 1
      },
      "indicator_count": 13397,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "555 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65aa168aeddea4851fc47cc3",
      "name": "Zerobot & Skynet",
      "description": "Zerobot is a new botnet written in the Go programming language. It communicates via the WebSocket protocol",
      "modified": "2024-03-23T01:01:38.014000",
      "created": "2024-01-19T06:28:26.343000",
      "tags": [
        "ssl certificate",
        "whois record",
        "referrer",
        "historical ssl",
        "resolutions",
        "whois whois",
        "communicating",
        "subdomains",
        "contacted",
        "c1on",
        "cmdwget http",
        "metro",
        "zerobot",
        "execution",
        "skynet",
        "june"
      ],
      "references": [
        "https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities Source"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "ZeroBot",
          "display_name": "ZeroBot",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 13,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 78,
        "FileHash-SHA1": 78,
        "FileHash-SHA256": 2290,
        "domain": 1491,
        "hostname": 2611,
        "URL": 5879,
        "CVE": 8
      },
      "indicator_count": 12435,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "759 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d0a9c7f1b04296d9b0d803",
      "name": "History Killer Pro Injection deleting VirusTotal & OTX.AlienVault Pulses",
      "description": "",
      "modified": "2024-03-18T04:01:27.756000",
      "created": "2024-02-17T12:42:47.334000",
      "tags": [
        "contacted",
        "execution",
        "january",
        "september",
        "whois record",
        "resolutions",
        "communicating",
        "roundup",
        "highly targeted",
        "phishing",
        "quasar",
        "malware",
        "open",
        "threat roundup",
        "referrer",
        "remote",
        "kimsuky",
        "passive dns",
        "urls",
        "dive domains",
        "creation date",
        "search",
        "record value",
        "date",
        "united",
        "scan endpoints",
        "all scoreblue",
        "unknown",
        "body",
        "brian sabey",
        "hall render",
        "reinsurance",
        "state",
        "danger",
        "threat",
        "critical",
        "crypthashdata",
        "read c",
        "tcmiheijkmutcix",
        "entries",
        "show",
        "t1055",
        "intel",
        "ms windows",
        "delphi",
        "win32",
        "copy",
        "write",
        "injection",
        "zusy",
        "neojit",
        "cyber stalking",
        "worker",
        "inject",
        "illegal",
        "tampering",
        "hijacker",
        "delete",
        "ret hat",
        "stalker",
        "shadow",
        "quasi"
      ],
      "references": [
        "www.historykillerpro.com",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "http://sniper.debugger.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Variant.Zusy.572 Checkin",
          "display_name": "Variant.Zusy.572 Checkin",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Neojit.A",
          "display_name": "TrojanDownloader:Win32/Neojit.A",
          "target": "/malware/TrojanDownloader:Win32/Neojit.A"
        },
        {
          "id": "Win32:Delf-SES\\ [Trj]",
          "display_name": "Win32:Delf-SES\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1372316",
          "display_name": "Win.Trojan.Agent-1372316",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "65d053a935bf99f5263deb57",
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1915,
        "FileHash-MD5": 437,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 3054,
        "domain": 987,
        "URL": 5902,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 12732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "763 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65d053a935bf99f5263deb57",
      "name": "History Killer Pro Injection deleting virustotal & otx.alienvault Pulses",
      "description": "History killer pro, is being used to delete and modify virustotal nodes and 41 otx.alienvault pulses. Junk data is being used to fill in missing pulses.\nTargeted: 1 callmeDoris  several scoreblue (sometimes I clone pulses) Octoseek.  \npulses.\nHallrender, Metro by T-Mobile, https://myaccount.uscis.gov/, Esurance,  40 pule reports are regarding Tsara Brashears cyber bully campaign which attacked the corporates mentioned except 2 AIG and Hallrender attackers. 100's of other modifications, deletions by another tool affecting several users.",
      "modified": "2024-03-18T04:01:27.756000",
      "created": "2024-02-17T06:35:21.666000",
      "tags": [
        "contacted",
        "execution",
        "january",
        "september",
        "whois record",
        "resolutions",
        "communicating",
        "roundup",
        "highly targeted",
        "phishing",
        "quasar",
        "malware",
        "open",
        "threat roundup",
        "referrer",
        "remote",
        "kimsuky",
        "passive dns",
        "urls",
        "dive domains",
        "creation date",
        "search",
        "record value",
        "date",
        "united",
        "scan endpoints",
        "all scoreblue",
        "unknown",
        "body",
        "brian sabey",
        "hall render",
        "reinsurance",
        "state",
        "danger",
        "threat",
        "critical",
        "crypthashdata",
        "read c",
        "tcmiheijkmutcix",
        "entries",
        "show",
        "t1055",
        "intel",
        "ms windows",
        "delphi",
        "win32",
        "copy",
        "write",
        "injection",
        "zusy",
        "neojit",
        "cyber stalking",
        "worker",
        "inject",
        "illegal",
        "tampering",
        "hijacker",
        "delete",
        "ret hat",
        "stalker",
        "shadow",
        "quasi"
      ],
      "references": [
        "www.historykillerpro.com",
        "https://otx.alienvault.com/indicator/hostname/ww25.historykillerpro.com",
        "http://sniper.debugger.ru",
        "Remote sharing: https://otx.alienvault.com/otxapi/indicators/file/screenshot/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "Inject & attack: https://otx.alienvault.com/indicator/file/dd846d74613d6285125886d35abb1bd261a5fc1b6bc0ba6e28e881f73dba23b7",
        "M. Brian Sabey Hall Render , Denver, Co | Frankfurt, Germany"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Variant.Zusy.572 Checkin",
          "display_name": "Variant.Zusy.572 Checkin",
          "target": null
        },
        {
          "id": "TrojanDownloader:Win32/Neojit.A",
          "display_name": "TrojanDownloader:Win32/Neojit.A",
          "target": "/malware/TrojanDownloader:Win32/Neojit.A"
        },
        {
          "id": "Win32:Delf-SES\\ [Trj]",
          "display_name": "Win32:Delf-SES\\ [Trj]",
          "target": null
        },
        {
          "id": "Win.Trojan.Agent-1372316",
          "display_name": "Win.Trojan.Agent-1372316",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1094",
          "name": "Custom Command and Control Protocol",
          "display_name": "T1094 - Custom Command and Control Protocol"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1915,
        "FileHash-MD5": 437,
        "FileHash-SHA1": 435,
        "FileHash-SHA256": 3054,
        "domain": 987,
        "URL": 5902,
        "email": 1,
        "CVE": 1
      },
      "indicator_count": 12732,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "763 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d302007152543202bac",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:20.375000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 310,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 229,
      "modified_text": "779 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0d2518a7ef9bb17df1b9",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:29:09.832000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "779 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cfda433eb05bde3827b",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:29.606000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 16,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "779 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65bc0cf9b0dac1aa7f9046cf",
      "name": "WannaCry",
      "description": "WannaCry ransomware explained. WannaCry is an example of crypto ransomware, a type of malicious software (malware) used by cybercriminals to extort money",
      "modified": "2024-03-02T21:02:32.756000",
      "created": "2024-02-01T21:28:25.092000",
      "tags": [
        "contacted",
        "tsara brashears",
        "urls url",
        "files",
        "pegasus",
        "domains",
        "cellbrite",
        "targets sa",
        "survivor",
        "apple ios",
        "execution",
        "lockbit",
        "malware",
        "core",
        "awful",
        "hacktool",
        "crypto",
        "ransomexx",
        "quasar",
        "asyncrat",
        "bot network",
        "loader",
        "ransomware",
        "wannacry",
        "cryptor",
        "encoder",
        "compiler",
        "win32 dll",
        "pe32",
        "intel",
        "ms windows",
        "ms visual",
        "win32 dynamic",
        "link library",
        "win16 ne",
        "pe32 compiler",
        "vs98",
        "contained",
        "w english",
        "info compiler",
        "products",
        "header intel",
        "name md5",
        "type",
        "language",
        "overlay",
        "as133618",
        "unknown",
        "cname",
        "united",
        "germany unknown",
        "ukraine unknown",
        "ireland unknown",
        "virgin islands",
        "as47846",
        "as39084 rinet",
        "date",
        "encrypt",
        "next",
        "microsoft visual c++ v6.0",
        "as133618 trellian pty. limited",
        "dynamicloader",
        "high",
        "t1063",
        "yara rule",
        "medium",
        "spoofs",
        "high security",
        "software",
        "discovery",
        "attempts",
        "april",
        "dropper",
        "reads self",
        "bots",
        "connect",
        "botnet",
        "sabey",
        "libel",
        "menacing",
        "brother sabey",
        "as15169 google",
        "aaaa",
        "search",
        "name servers",
        "as29182 jsc",
        "russia unknown",
        "found",
        "error"
      ],
      "references": [
        "https://www.instagram.com/unipegasus_infotech_solutions/?hl=en (dang)",
        "cellebrite.com | enterprise.cellebrite.com",
        "http://pegasus.diskel.co.uk/ | china.pegasus-idc.com | imap.pegasustech.ne",
        "deviceinbox.com",
        "671425187f3ec0da502d2e6b760de93661c1cf5381f81d21c64c6015fbcde2b3",
        "c1a99e3bde9bad27e463c32b96311312.virus",
        "CS Yara rule:WannaCry_Ransomware from ruleset crime_wannacry by Florian Roth (Nextron Systems) (with the help of binar.ly)",
        "CS Yara rule:SUSP_Imphash_Mar23_2 from ruleset gen_imphash_detection by Arnim Rupp (https://github.com/ruppde)",
        "CS IDS rule: (icmp4) ICMP destination unreachable communication administratively prohibited",
        "CS IDS rule: (port_scan) TCP filtered portsweep",
        "CS IDS rule: (stream_tcp) data sent on stream after TCP reset received",
        "CS IDS rule: ET DROP Spamhaus DROP Listed Traffic Inbound group 14",
        "CS Sigma Rule: Creation of an Executable by an Executable by frack113",
        "Trojan:Win32/WannaCry.350",
        "https://www.sweetheartvideo.com/tsara-brashears/ [Bot Network]",
        "angebot.staude.de",
        "https://otx.alienvault.com/indicator/file/1b7a83a7a35418afa60e88eabcb9fd5a8689700bba20dadb5fbad4e197ce1f1e",
        "https://cura360.com/foldawheel-phoenix-fully-powered-standing-wheelchair?utm_source=google&utm_medium=PLA&gad_source=1&gclid=EAIaIQobChMIw92wtdnigwMVhV9HAR126wDrEAQYASABEgJ_aPD_BwE",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears/",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://pin.it/ [Pinterest BotNetwork for Pegasus]",
        "http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/xetetorobezaj.pdf [redirect] http://joshuajenkinslaw.com/uploads/1/3/0/6/130639888/"
      ],
      "public": 1,
      "adversary": "NSO Group - Pegasus",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan:Win32/WannaCry.350",
          "display_name": "Trojan:Win32/WannaCry.350",
          "target": "/malware/Trojan:Win32/WannaCry.350"
        }
      ],
      "attack_ids": [
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1584.005",
          "name": "Botnet",
          "display_name": "T1584.005 - Botnet"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 67,
        "FileHash-SHA1": 62,
        "FileHash-SHA256": 2864,
        "domain": 1401,
        "URL": 5523,
        "hostname": 1766,
        "FilePath": 1,
        "CVE": 2,
        "email": 5
      },
      "indicator_count": 11691,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "779 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b8a056f2c1f16d391175b0",
      "name": "Callback Phishing Campaign | Pegasus |  Callback Phishing | https://safebae.org/",
      "description": "Multiple ransomware groups have adopted the  BazarCall callback phishing technique a sophisticated scam; to gain initial access to victims' networks\nCallback phishing is a  relying on a multi-stage process, exploiting trust to manipulate victims into divulging sensitive information or. At its core, callback phishing is a sophisticated social engineering tactic that triggers an emotional reaction from a victim and compels them to engage.\n\nStrange alleged tribute website appears to target Tsara Brashears. The alleged SA victims name is Catherine 'Daisy' Coleman name isn't part infrastructure. Malicious",
      "modified": "2024-02-29T04:00:48.424000",
      "created": "2024-01-30T07:08:06.711000",
      "tags": [
        "acceptencoding",
        "http response",
        "final url",
        "ip address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers xcache",
        "wp engine",
        "threat",
        "paste",
        "iocs",
        "urls https",
        "samples",
        "contacted",
        "apple",
        "ssl certificate",
        "whois record",
        "contacted",
        "historical ssl",
        "referrer",
        "execution",
        "tsara brashears",
        "apple ios",
        "historical",
        "communicating",
        "copy",
        "attack",
        "njrat",
        "ransomware",
        "hacktool",
        "metro",
        "malicious",
        "crypto",
        "installer",
        "awful",
        "startpage",
        "callback phishing",
        "safebae",
        "catherine daisy coleman",
        "pegasus",
        "nso",
        "kb font",
        "january",
        "http",
        "resource path",
        "size",
        "type mimetype",
        "primary request",
        "kb document",
        "general full",
        "url http",
        "low risk",
        "sucuri firewall",
        "malware found",
        "site",
        "unknown",
        "low security",
        "risk",
        "website malware",
        "security no",
        "protect",
        "html internet",
        "html document",
        "unicode text",
        "utf8 text",
        "no data",
        "tag count",
        "sample summary",
        "sample",
        "detection list",
        "blacklist",
        "count blacklist",
        "tag tag",
        "anchor hrefs",
        "wordpress",
        "html info",
        "title safebae",
        "anyone else",
        "meta tags",
        "wpbakery page",
        "builder",
        "slider plugin",
        "script tags",
        "passive dns",
        "urls",
        "a nxdomain",
        "scan endpoints",
        "all scoreblue",
        "hostname",
        "pulse pulses",
        "files",
        "domain",
        "files ip",
        "united",
        "status",
        "as13768 aptum",
        "date",
        "moved",
        "creation date",
        "search",
        "record value",
        "body",
        "log id",
        "gmtn",
        "go daddy",
        "authority",
        "tls web",
        "arizona",
        "scottsdale",
        "ca issuers",
        "false",
        "as30148 sucuri",
        "a domains",
        "gmt content",
        "ipv4",
        "win64",
        "back",
        "linux mint",
        "hacking",
        "brian sabey",
        "tracking",
        "hallrender",
        "staging",
        "dns",
        "network",
        "control",
        "bazar"
      ],
      "references": [
        "https://safebae.org/",
        "www.hallrender.com",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-266x266.png",
        "http://files.geoffreyobrian.com/uploads/1/3/2/8/132814305/3473236.pdf",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/ [phishing/ links to Brashears browser Google.com.uy/clk malicious, links  for collection",
        "https://applemusic-spotlight.myunidays.com/US/en-US? [potential Apple pegasus media entrance]",
        "'https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [iOS password decryption| password unlocker]",
        "s3.amazonaws.com [ metro T-Mobile spyware porn]",
        "9.6.zip - SQLi",
        "dns.trackgroup.net",
        "nr-data.net [Apple Private Data Collection]",
        "scripting-sandbox-dns.bunny.net",
        "http://www.01tracks.com/happy-customers",
        "https://www.rallypoint.com/command-post/veterans-benefits-banking-program-integrates-with-vetcents-to-improve-veterans-financial-health?utm_source=dept_of_va&utm_medium=email&utm_campaign=vavetcents",
        "http://yabs.yandex.uz/count/DbMMoEMwcAa508C2CI72BLq00000EEu2G0980c2y26W2SBYTbz06W06CXPm9Y06nyBJ1CP01mldXrZ6O0S3OwEyok06sjOF85S01NDW1uiI14E01zEhV3-W1Q9W2bk3S1A02jCW1s082y0AM-kpb2_W2aF62vgN6kDNb0O03iD_Kq0-80-cvf8mEc0EweogW0mIe0mQm0mIm106u1Fy1w0J-jHRu1D660uW5qOO3a0MGuWkW1PPtg0MeOx05g6Eu1VN-0i05bP0Lo0N0hmNW1GNm1G6O1eBGhFCEe0Q-eG6e1jW2oGPlwQdYVheAOD46Rn4LqN-w2c3P1W000C2z0000gGTjZOZwJYhCDx07W82ODD070k07XWhn1wbhSBFKCwp6W0WAq0Y0WeI1nP20Xe01u0YQP80A0S4A00000000y3_O2WBW2e29UlWAWBKOgWiGasxIrMsD000sz7Ltouq50DaBROs8-aug",
        "remote.utorrent.com | pornhub.dev | lp.rallypoint.com",
        "https://rmy1o3xp-d182-v9.klinika-rekonstruktivnoj-kosmetologii-na-ulitse-lenina.ru/ [Twitter porno]",
        "https://www.hallrender.com/attorney/brian-sabey/Accept [Weird - defended Jeffrey Scott Reimer Tsara Brashears alleged assaulter[",
        "https://www.hallrender.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.hallrender.com%2Fattorney%2Fbrian-sabey%2F&",
        "https://www.hallrender.com/wp-content/uploads/2017/10/Sabey_Brian_web-406x406.png [offered Brashears settlement that month]",
        "deadlyexploits.com | deadlysymbol.com |",
        "amail.linuxmint.com | api1-live.linuxmint.com | Hostname apipackages.linuxmint.com | apollo-extra.linuxmint.com | apps.linuxmint.com | arc.linuxmint.com | archive.linuxmint.com | betaforums1.linuxmint.com Hostname blogs.linuxmint.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Callback Phishing",
          "display_name": "Callback Phishing",
          "target": null
        },
        {
          "id": "Ransomware",
          "display_name": "Ransomware",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Pegasus",
          "display_name": "Pegasus",
          "target": null
        },
        {
          "id": "NjRAT",
          "display_name": "NjRAT",
          "target": null
        },
        {
          "id": "BazarCall",
          "display_name": "BazarCall",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1029",
          "name": "Scheduled Transfer",
          "display_name": "T1029 - Scheduled Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2802,
        "URL": 3266,
        "domain": 1458,
        "hostname": 1265,
        "FileHash-MD5": 227,
        "FileHash-SHA1": 144,
        "CVE": 2,
        "email": 1,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 9167,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "781 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "googleapi.at",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "googleapi.at",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776735040.9463127
}