{
  "type": "Domain",
  "indicator": "helpwire.com",
  "general": {
    "sections": [
      "general",
      "geo",
      "url_list",
      "passive_dns",
      "malware",
      "whois",
      "http_scans"
    ],
    "whois": "http://whois.domaintools.com/helpwire.com",
    "alexa": "http://www.alexa.com/siteinfo/helpwire.com",
    "indicator": "helpwire.com",
    "type": "domain",
    "type_title": "Domain",
    "validation": [],
    "base_indicator": {
      "id": 3318012838,
      "indicator": "helpwire.com",
      "type": "domain",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "65a4885e735b9e8ba94805bc",
          "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
          "description": "",
          "modified": "2024-09-05T06:51:42.608000",
          "created": "2024-01-15T01:20:30.730000",
          "tags": [
            "execution",
            "whois record",
            "contacted",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "copy",
            "historical ssl",
            "referrer",
            "urls url",
            "icmp",
            "malicious",
            "installer",
            "problems",
            "collections",
            "report",
            "phishing",
            "service tool",
            "greatness",
            "threat network",
            "emotet",
            "magniber",
            "startpage",
            "attack",
            "banker",
            "keylogger",
            "namecheap inc",
            "com laude",
            "ltd dba",
            "cloudflare",
            "porkbun llc",
            "ii llc",
            "csc corporate",
            "domains",
            "computer",
            "company limited",
            "first",
            "cloudflarenet",
            "google",
            "amazon02",
            "akamaias",
            "telecom italia",
            "utc submissions",
            "microsoftcorpas",
            "indonesia",
            "beijing gu",
            "appleaustin",
            "sucurisec",
            "amazonaes",
            "limited",
            "tsara brashears",
            "pornhub",
            "thebrotherssabey",
            "then brothers sabey",
            "brian sabey",
            "apple",
            "icloud",
            "apple engineering",
            "soc",
            "hacker",
            "teams",
            "malvertizing",
            "cyberthreat",
            "cyber crime",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "ecc domain",
            "server ca",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "remote",
            "remote attacker",
            "benjamin",
            "worm",
            "trojan",
            "win32",
            "trojanspy",
            "ransomware",
            "command and control",
            "cnc",
            "c2",
            "stealer",
            "password",
            "apple unlocker",
            "pornographers",
            "cyber stalking",
            "revenge rat",
            "masquerading",
            "scanning host",
            "phishing",
            "dns",
            "network",
            "cobalt strike",
            "mitre attack",
            "metro hacker",
            "t-mobile hacker",
            "stalker",
            "social engineering",
            "et",
            "torrent trecker",
            "view",
            "duckdns",
            "blackhat",
            "data center",
            "tracking",
            "illegal",
            "malware scripting",
            "malware spreader",
            "network rat",
            "multiple botnetworks"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/",
            "acam-mdn.apple.com",
            "beacons.bcp.gvt.com",
            "cpcontacts.webcamara.online",
            "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
            "http://ti.hicloudcam.com",
            "http://alohatube.xyz/search/tsara-brashears",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://search.app.goo.gl/?ofl",
            "Worm:Win32/Benjamin",
            "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
            "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
            "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
            "applemusic-spotlight.myunidays.com",
            "nr-data.net",
            "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
            "blackhat.store",
            "api.telegram.org",
            "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Silk",
              "display_name": "Silk",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": "65a429795adf468b427a3c8b",
          "export_count": 23,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2469,
            "URL": 6038,
            "FileHash-MD5": 169,
            "FileHash-SHA1": 157,
            "FileHash-SHA256": 3922,
            "CIDR": 2,
            "hostname": 2787,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 15547,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "591 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "65a429795adf468b427a3c8b",
          "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
          "description": "Retaliation. Brian Sabey representing as an attorney and many other occupations contacted and socially engineered target. Uncertain of true name. Contacted 'alleged' SA assault victim. Made claims of representing a Jeffrey Scott Reimer DPT' alleged 'S' Assaulter.  Substantiated claims made with the twist of 'victim consented'. Mark Brian Sbabeys claims dismissed. Continues to hack, harass, intimidate target in every possible way. Hacking, monitoring, service, modification, phone contact, malicious texting, in person monitoring via colleagues, hacks into medical and medical billing centers, sells/leaks targets data on dark web.    Removed targets name from most pulses via  remote device access. Self whitelist. Everything he does is illegal.\n\nTarget not important enough to law enforcement.",
          "modified": "2024-02-13T17:04:19.437000",
          "created": "2024-01-14T18:35:37.757000",
          "tags": [
            "execution",
            "whois record",
            "contacted",
            "ssl certificate",
            "whois whois",
            "contacted urls",
            "copy",
            "historical ssl",
            "referrer",
            "urls url",
            "icmp",
            "malicious",
            "installer",
            "problems",
            "collections",
            "report",
            "phishing",
            "service tool",
            "greatness",
            "threat network",
            "emotet",
            "magniber",
            "startpage",
            "attack",
            "banker",
            "keylogger",
            "namecheap inc",
            "com laude",
            "ltd dba",
            "cloudflare",
            "porkbun llc",
            "ii llc",
            "csc corporate",
            "domains",
            "computer",
            "company limited",
            "first",
            "cloudflarenet",
            "google",
            "amazon02",
            "akamaias",
            "telecom italia",
            "utc submissions",
            "microsoftcorpas",
            "indonesia",
            "beijing gu",
            "appleaustin",
            "sucurisec",
            "amazonaes",
            "limited",
            "tsara brashears",
            "pornhub",
            "thebrotherssabey",
            "then brothers sabey",
            "brian sabey",
            "apple",
            "icloud",
            "apple engineering",
            "soc",
            "hacker",
            "teams",
            "malvertizing",
            "cyberthreat",
            "cyber crime",
            "data",
            "v3 serial",
            "number",
            "cgb stgreater",
            "ecc domain",
            "server ca",
            "subject public",
            "key info",
            "key algorithm",
            "ec oid",
            "remote",
            "remote attacker",
            "benjamin",
            "worm",
            "trojan",
            "win32",
            "trojanspy",
            "ransomware",
            "command and control",
            "cnc",
            "c2",
            "stealer",
            "password",
            "apple unlocker",
            "pornographers",
            "cyber stalking",
            "revenge rat",
            "masquerading",
            "scanning host",
            "phishing",
            "dns",
            "network",
            "cobalt strike",
            "mitre attack",
            "metro hacker",
            "t-mobile hacker",
            "stalker",
            "social engineering",
            "et",
            "torrent trecker",
            "view",
            "duckdns",
            "blackhat",
            "data center",
            "tracking",
            "illegal",
            "malware scripting",
            "malware spreader",
            "network rat",
            "multiple botnetworks"
          ],
          "references": [
            "https://thebrotherssabey.wordpress.com/",
            "acam-mdn.apple.com",
            "beacons.bcp.gvt.com",
            "cpcontacts.webcamara.online",
            "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
            "http://ti.hicloudcam.com",
            "http://alohatube.xyz/search/tsara-brashears",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://search.app.goo.gl/?ofl",
            "Worm:Win32/Benjamin",
            "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
            "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
            "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
            "applemusic-spotlight.myunidays.com",
            "nr-data.net",
            "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
            "blackhat.store",
            "api.telegram.org",
            "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Worm:Win32/Benjamin",
              "display_name": "Worm:Win32/Benjamin",
              "target": "/malware/Worm:Win32/Benjamin"
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "Tulach",
              "display_name": "Tulach",
              "target": null
            },
            {
              "id": "Silk",
              "display_name": "Silk",
              "target": null
            },
            {
              "id": "Sabey",
              "display_name": "Sabey",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 19,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 2462,
            "URL": 5950,
            "FileHash-MD5": 168,
            "FileHash-SHA1": 156,
            "FileHash-SHA256": 3901,
            "CIDR": 2,
            "hostname": 2766,
            "email": 2,
            "CVE": 1
          },
          "indicator_count": 15408,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "796 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        },
        {
          "id": "6510a2dd9c7acab85a26f978",
          "name": "Phishing sites 2023-09-24",
          "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains",
          "modified": "2023-10-24T20:02:37.137000",
          "created": "2023-09-24T20:58:05.025000",
          "tags": [
            "phishing"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "France"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "skocherhan",
            "id": "249290",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 10,
            "URL": 5,
            "domain": 37579,
            "hostname": 3238
          },
          "indicator_count": 40832,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 190,
          "modified_text": "908 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "domain",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "Worm:Win32/Benjamin",
        "http://ti.hicloudcam.com",
        "applemusic-spotlight.myunidays.com",
        "https://thebrotherssabey.wordpress.com/",
        "blackhat.store",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://search.app.goo.gl/?ofl",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "beacons.bcp.gvt.com",
        "nr-data.net",
        "acam-mdn.apple.com",
        "cpcontacts.webcamara.online"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": []
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Emotet",
            "Sabey",
            "#lowfi:siga:trojanspy:msil/keylogger",
            "Silk",
            "Worm:win32/benjamin",
            "Tulach"
          ],
          "industries": []
        }
      }
    },
    "false_positive": []
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "65a4885e735b9e8ba94805bc",
      "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
      "description": "",
      "modified": "2024-09-05T06:51:42.608000",
      "created": "2024-01-15T01:20:30.730000",
      "tags": [
        "execution",
        "whois record",
        "contacted",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "copy",
        "historical ssl",
        "referrer",
        "urls url",
        "icmp",
        "malicious",
        "installer",
        "problems",
        "collections",
        "report",
        "phishing",
        "service tool",
        "greatness",
        "threat network",
        "emotet",
        "magniber",
        "startpage",
        "attack",
        "banker",
        "keylogger",
        "namecheap inc",
        "com laude",
        "ltd dba",
        "cloudflare",
        "porkbun llc",
        "ii llc",
        "csc corporate",
        "domains",
        "computer",
        "company limited",
        "first",
        "cloudflarenet",
        "google",
        "amazon02",
        "akamaias",
        "telecom italia",
        "utc submissions",
        "microsoftcorpas",
        "indonesia",
        "beijing gu",
        "appleaustin",
        "sucurisec",
        "amazonaes",
        "limited",
        "tsara brashears",
        "pornhub",
        "thebrotherssabey",
        "then brothers sabey",
        "brian sabey",
        "apple",
        "icloud",
        "apple engineering",
        "soc",
        "hacker",
        "teams",
        "malvertizing",
        "cyberthreat",
        "cyber crime",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "ecc domain",
        "server ca",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "remote",
        "remote attacker",
        "benjamin",
        "worm",
        "trojan",
        "win32",
        "trojanspy",
        "ransomware",
        "command and control",
        "cnc",
        "c2",
        "stealer",
        "password",
        "apple unlocker",
        "pornographers",
        "cyber stalking",
        "revenge rat",
        "masquerading",
        "scanning host",
        "phishing",
        "dns",
        "network",
        "cobalt strike",
        "mitre attack",
        "metro hacker",
        "t-mobile hacker",
        "stalker",
        "social engineering",
        "et",
        "torrent trecker",
        "view",
        "duckdns",
        "blackhat",
        "data center",
        "tracking",
        "illegal",
        "malware scripting",
        "malware spreader",
        "network rat",
        "multiple botnetworks"
      ],
      "references": [
        "https://thebrotherssabey.wordpress.com/",
        "acam-mdn.apple.com",
        "beacons.bcp.gvt.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "http://ti.hicloudcam.com",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://search.app.goo.gl/?ofl",
        "Worm:Win32/Benjamin",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "applemusic-spotlight.myunidays.com",
        "nr-data.net",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "blackhat.store",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Silk",
          "display_name": "Silk",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": "65a429795adf468b427a3c8b",
      "export_count": 23,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2469,
        "URL": 6038,
        "FileHash-MD5": 169,
        "FileHash-SHA1": 157,
        "FileHash-SHA256": 3922,
        "CIDR": 2,
        "hostname": 2787,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 15547,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "591 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "65a429795adf468b427a3c8b",
      "name": "Apple | Worm:Win32/Benjamin | thebrotherssabey.com",
      "description": "Retaliation. Brian Sabey representing as an attorney and many other occupations contacted and socially engineered target. Uncertain of true name. Contacted 'alleged' SA assault victim. Made claims of representing a Jeffrey Scott Reimer DPT' alleged 'S' Assaulter.  Substantiated claims made with the twist of 'victim consented'. Mark Brian Sbabeys claims dismissed. Continues to hack, harass, intimidate target in every possible way. Hacking, monitoring, service, modification, phone contact, malicious texting, in person monitoring via colleagues, hacks into medical and medical billing centers, sells/leaks targets data on dark web.    Removed targets name from most pulses via  remote device access. Self whitelist. Everything he does is illegal.\n\nTarget not important enough to law enforcement.",
      "modified": "2024-02-13T17:04:19.437000",
      "created": "2024-01-14T18:35:37.757000",
      "tags": [
        "execution",
        "whois record",
        "contacted",
        "ssl certificate",
        "whois whois",
        "contacted urls",
        "copy",
        "historical ssl",
        "referrer",
        "urls url",
        "icmp",
        "malicious",
        "installer",
        "problems",
        "collections",
        "report",
        "phishing",
        "service tool",
        "greatness",
        "threat network",
        "emotet",
        "magniber",
        "startpage",
        "attack",
        "banker",
        "keylogger",
        "namecheap inc",
        "com laude",
        "ltd dba",
        "cloudflare",
        "porkbun llc",
        "ii llc",
        "csc corporate",
        "domains",
        "computer",
        "company limited",
        "first",
        "cloudflarenet",
        "google",
        "amazon02",
        "akamaias",
        "telecom italia",
        "utc submissions",
        "microsoftcorpas",
        "indonesia",
        "beijing gu",
        "appleaustin",
        "sucurisec",
        "amazonaes",
        "limited",
        "tsara brashears",
        "pornhub",
        "thebrotherssabey",
        "then brothers sabey",
        "brian sabey",
        "apple",
        "icloud",
        "apple engineering",
        "soc",
        "hacker",
        "teams",
        "malvertizing",
        "cyberthreat",
        "cyber crime",
        "data",
        "v3 serial",
        "number",
        "cgb stgreater",
        "ecc domain",
        "server ca",
        "subject public",
        "key info",
        "key algorithm",
        "ec oid",
        "remote",
        "remote attacker",
        "benjamin",
        "worm",
        "trojan",
        "win32",
        "trojanspy",
        "ransomware",
        "command and control",
        "cnc",
        "c2",
        "stealer",
        "password",
        "apple unlocker",
        "pornographers",
        "cyber stalking",
        "revenge rat",
        "masquerading",
        "scanning host",
        "phishing",
        "dns",
        "network",
        "cobalt strike",
        "mitre attack",
        "metro hacker",
        "t-mobile hacker",
        "stalker",
        "social engineering",
        "et",
        "torrent trecker",
        "view",
        "duckdns",
        "blackhat",
        "data center",
        "tracking",
        "illegal",
        "malware scripting",
        "malware spreader",
        "network rat",
        "multiple botnetworks"
      ],
      "references": [
        "https://thebrotherssabey.wordpress.com/",
        "acam-mdn.apple.com",
        "beacons.bcp.gvt.com",
        "cpcontacts.webcamara.online",
        "http://dreamsofspanking.com/scene/item/rosie-backlash-caning?utm_campaign=apr15",
        "http://ti.hicloudcam.com",
        "http://alohatube.xyz/search/tsara-brashears",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://search.app.goo.gl/?ofl",
        "Worm:Win32/Benjamin",
        "FileHash-SHA256\t00000254e6344d34a1e4ef157cb01d8b7efa65c22c996f9dfe85e7482c6c86ab",
        "FileHash-MD5\ted5c771224fbd6f9b2c0cf1e8cce09b5",
        "FileHash-SHA1\tf336b50f5cca2ddc0341e2c4001b419a830d27a5",
        "applemusic-spotlight.myunidays.com",
        "nr-data.net",
        "http://init.ess.apple.com/WebObjects/VCInit.woa/wa/getBag?ix=4",
        "blackhat.store",
        "api.telegram.org",
        "cobaltstrike4.tk | https://cobaltstrike4.tk:8443/include/template/isx.php"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Worm:Win32/Benjamin",
          "display_name": "Worm:Win32/Benjamin",
          "target": "/malware/Worm:Win32/Benjamin"
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "Tulach",
          "display_name": "Tulach",
          "target": null
        },
        {
          "id": "Silk",
          "display_name": "Silk",
          "target": null
        },
        {
          "id": "Sabey",
          "display_name": "Sabey",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 19,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 2462,
        "URL": 5950,
        "FileHash-MD5": 168,
        "FileHash-SHA1": 156,
        "FileHash-SHA256": 3901,
        "CIDR": 2,
        "hostname": 2766,
        "email": 2,
        "CVE": 1
      },
      "indicator_count": 15408,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "796 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    },
    {
      "id": "6510a2dd9c7acab85a26f978",
      "name": "Phishing sites 2023-09-24",
      "description": "https://github.com/olbat/ut1-blacklists/blob/master/blacklists/phishing/domains",
      "modified": "2023-10-24T20:02:37.137000",
      "created": "2023-09-24T20:58:05.025000",
      "tags": [
        "phishing"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "France"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 24,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "skocherhan",
        "id": "249290",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_249290/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 10,
        "URL": 5,
        "domain": 37579,
        "hostname": 3238
      },
      "indicator_count": 40832,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 190,
      "modified_text": "908 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "domain",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "helpwire.com",
    "type": "Domain"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "helpwire.com",
    "found": false,
    "verdict": "clean",
    "urls": [],
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776641892.663626
}