{
  "type": "URL",
  "indicator": "https://149.96.125.65:443",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://149.96.125.65:443",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3784119263,
      "indicator": "https://149.96.125.65:443",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 3,
      "pulses": [
        {
          "id": "660b176a98b0c92ba5a962bc",
          "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
          "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
          "modified": "2024-09-04T05:01:56.993000",
          "created": "2024-04-01T20:22:02.851000",
          "tags": [
            "BEC"
          ],
          "references": [
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
            "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
            "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
            "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
            "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
            "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
            "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "Canada",
            "United States of America",
            "Netherlands"
          ],
          "malware_families": [],
          "attack_ids": [],
          "industries": [
            "Education",
            "Technology",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Disable_Duck",
            "id": "244325",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 233,
            "FileHash-SHA1": 230,
            "FileHash-SHA256": 6703,
            "URL": 4450,
            "CIDR": 3,
            "domain": 6223,
            "hostname": 2863,
            "email": 7,
            "CVE": 53
          },
          "indicator_count": 20765,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 130,
          "modified_text": "634 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ad83180deb1186bb4f466",
          "name": "Carrotbat Malware | Stalker Suite |  gogglemaps.com",
          "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools, botnetwork \nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)",
          "modified": "2023-12-20T02:02:59.943000",
          "created": "2023-11-20T03:53:21.699000",
          "tags": [
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "tls web",
            "encrypt",
            "ca issuers",
            "f9970e",
            "bd6en timestamp",
            "a487132c3b",
            "false",
            "ssl certificate",
            "tsara brashears",
            "contacted",
            "referrer",
            "copy",
            "historical ssl",
            "collections",
            "password",
            "networks",
            "botnet campaign",
            "skynet",
            "fall",
            "hacktool",
            "malware",
            "critical",
            "relic",
            "monitoring",
            "attack",
            "hiddentear",
            "metro",
            "test",
            "detection list",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "temp",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "unknown",
            "meta",
            "span",
            "error",
            "refresh",
            "body",
            "generator",
            "look",
            "verify",
            "restart",
            "hybrid",
            "accept",
            "click",
            "strings",
            "tools",
            "whois record",
            "msgid10053",
            "msgid10051",
            "communicating",
            "anid",
            "execution",
            "null",
            "core",
            "installer",
            "threat roundup",
            "apple ios",
            "august",
            "highly targeted",
            "apple",
            "sqli dumper",
            "april",
            "february",
            "awful",
            "radar ineractive",
            "october",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "cisco umbrella",
            "site",
            "wormx",
            "malicious site",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "phishing site",
            "alexa",
            "phishing",
            "agent",
            "bank",
            "inmortal",
            "united",
            "cyber threat",
            "pony",
            "cnc zeus",
            "tracker",
            "cnc server",
            "covid19",
            "engineering",
            "http spammer",
            "host",
            "azorult",
            "asyncrat",
            "cobalt strike",
            "team",
            "hsbc",
            "noname057",
            "generic malware",
            "blacklist http",
            "malicious url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 815,
            "FileHash-SHA256": 3404,
            "SSLCertFingerprint": 2,
            "URL": 8938,
            "domain": 1195,
            "hostname": 2705,
            "FileHash-SHA1": 457,
            "CIDR": 7,
            "CVE": 3
          },
          "indicator_count": 17526,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "893 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ad8e83914549cd4658f8e",
          "name": "Radar Ineractive \u2022 Inmortal \u2022 HSBC.com",
          "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools,\nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)\nRadar Ineractive \u2022 Inmortal \u2022 HSBC.com",
          "modified": "2023-12-20T02:02:59.943000",
          "created": "2023-11-20T03:56:24.105000",
          "tags": [
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "tls web",
            "encrypt",
            "ca issuers",
            "f9970e",
            "bd6en timestamp",
            "a487132c3b",
            "false",
            "ssl certificate",
            "tsara brashears",
            "contacted",
            "referrer",
            "copy",
            "historical ssl",
            "collections",
            "password",
            "networks",
            "botnet campaign",
            "skynet",
            "fall",
            "hacktool",
            "malware",
            "critical",
            "relic",
            "monitoring",
            "attack",
            "hiddentear",
            "metro",
            "test",
            "detection list",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "temp",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "unknown",
            "meta",
            "span",
            "error",
            "refresh",
            "body",
            "generator",
            "look",
            "verify",
            "restart",
            "hybrid",
            "accept",
            "click",
            "strings",
            "tools",
            "whois record",
            "msgid10053",
            "msgid10051",
            "communicating",
            "anid",
            "execution",
            "null",
            "core",
            "installer",
            "threat roundup",
            "apple ios",
            "august",
            "highly targeted",
            "apple",
            "sqli dumper",
            "april",
            "february",
            "awful",
            "radar ineractive",
            "october",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "cisco umbrella",
            "site",
            "wormx",
            "malicious site",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "phishing site",
            "alexa",
            "phishing",
            "agent",
            "bank",
            "inmortal",
            "united",
            "cyber threat",
            "pony",
            "cnc zeus",
            "tracker",
            "cnc server",
            "covid19",
            "engineering",
            "http spammer",
            "host",
            "azorult",
            "asyncrat",
            "cobalt strike",
            "team",
            "hsbc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 815,
            "FileHash-SHA256": 3404,
            "SSLCertFingerprint": 2,
            "URL": 8938,
            "domain": 1194,
            "hostname": 2705,
            "FileHash-SHA1": 457,
            "CIDR": 7,
            "CVE": 3
          },
          "indicator_count": 17525,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "893 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Inmortal",
            "Hsbc",
            "Radar ineractive"
          ],
          "industries": [
            "Government",
            "Technology",
            "Education"
          ],
          "unique_indicators": 23763
        }
      }
    },
    "false_positive": [],
    "alexa": "",
    "whois": "http://whois.domaintools.com/149.96.125.65",
    "domain": "Unavailable",
    "hostname": "Unavailable"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 3,
  "pulses": [
    {
      "id": "660b176a98b0c92ba5a962bc",
      "name": "\"No Problems\" - UAlberta TLD (Confirmed TLD - 08.04.24) & Subdomain compromise",
      "description": "Basically the above\n\n\"No Problems\", \"We are Unhackable\", etc. etc. causing problems.",
      "modified": "2024-09-04T05:01:56.993000",
      "created": "2024-04-01T20:22:02.851000",
      "tags": [
        "BEC"
      ],
      "references": [
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/summary",
        "https://www.virustotal.com/gui/collection/b8a6d1fcd73207ba46eae6806b946c4b539f301e718f3fba21fa4e797d4b5783/iocs",
        "https://www.virustotal.com/graph/embed/gead337f35cdd4241b225b68ff0528a3834be5d60876745fa99254ff7f8a0df22?theme=dark",
        "https://www.virustotal.com/graph/embed/g1e31eca6803a433a9a33437d593a2bbdf979ff77c91340d1ab624d10dc8732b3?theme=dark",
        "https://dnstwist.it/#ea665d15-6507-4057-b2c9-18a2e546ee95",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.nanocore",
        "https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydoom",
        "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkgate"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "Canada",
        "United States of America",
        "Netherlands"
      ],
      "malware_families": [],
      "attack_ids": [],
      "industries": [
        "Education",
        "Technology",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Disable_Duck",
        "id": "244325",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 233,
        "FileHash-SHA1": 230,
        "FileHash-SHA256": 6703,
        "URL": 4450,
        "CIDR": 3,
        "domain": 6223,
        "hostname": 2863,
        "email": 7,
        "CVE": 53
      },
      "indicator_count": 20765,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 130,
      "modified_text": "634 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ad83180deb1186bb4f466",
      "name": "Carrotbat Malware | Stalker Suite |  gogglemaps.com",
      "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools, botnetwork \nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)",
      "modified": "2023-12-20T02:02:59.943000",
      "created": "2023-11-20T03:53:21.699000",
      "tags": [
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "tls web",
        "encrypt",
        "ca issuers",
        "f9970e",
        "bd6en timestamp",
        "a487132c3b",
        "false",
        "ssl certificate",
        "tsara brashears",
        "contacted",
        "referrer",
        "copy",
        "historical ssl",
        "collections",
        "password",
        "networks",
        "botnet campaign",
        "skynet",
        "fall",
        "hacktool",
        "malware",
        "critical",
        "relic",
        "monitoring",
        "attack",
        "hiddentear",
        "metro",
        "test",
        "detection list",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "temp",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "unknown",
        "meta",
        "span",
        "error",
        "refresh",
        "body",
        "generator",
        "look",
        "verify",
        "restart",
        "hybrid",
        "accept",
        "click",
        "strings",
        "tools",
        "whois record",
        "msgid10053",
        "msgid10051",
        "communicating",
        "anid",
        "execution",
        "null",
        "core",
        "installer",
        "threat roundup",
        "apple ios",
        "august",
        "highly targeted",
        "apple",
        "sqli dumper",
        "april",
        "february",
        "awful",
        "radar ineractive",
        "october",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist",
        "cisco umbrella",
        "site",
        "wormx",
        "malicious site",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "phishing site",
        "alexa",
        "phishing",
        "agent",
        "bank",
        "inmortal",
        "united",
        "cyber threat",
        "pony",
        "cnc zeus",
        "tracker",
        "cnc server",
        "covid19",
        "engineering",
        "http spammer",
        "host",
        "azorult",
        "asyncrat",
        "cobalt strike",
        "team",
        "hsbc",
        "noname057",
        "generic malware",
        "blacklist http",
        "malicious url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Radar Ineractive",
          "display_name": "Radar Ineractive",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 815,
        "FileHash-SHA256": 3404,
        "SSLCertFingerprint": 2,
        "URL": 8938,
        "domain": 1195,
        "hostname": 2705,
        "FileHash-SHA1": 457,
        "CIDR": 7,
        "CVE": 3
      },
      "indicator_count": 17526,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "893 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ad8e83914549cd4658f8e",
      "name": "Radar Ineractive \u2022 Inmortal \u2022 HSBC.com",
      "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools,\nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)\nRadar Ineractive \u2022 Inmortal \u2022 HSBC.com",
      "modified": "2023-12-20T02:02:59.943000",
      "created": "2023-11-20T03:56:24.105000",
      "tags": [
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "tls web",
        "encrypt",
        "ca issuers",
        "f9970e",
        "bd6en timestamp",
        "a487132c3b",
        "false",
        "ssl certificate",
        "tsara brashears",
        "contacted",
        "referrer",
        "copy",
        "historical ssl",
        "collections",
        "password",
        "networks",
        "botnet campaign",
        "skynet",
        "fall",
        "hacktool",
        "malware",
        "critical",
        "relic",
        "monitoring",
        "attack",
        "hiddentear",
        "metro",
        "test",
        "detection list",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "temp",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "unknown",
        "meta",
        "span",
        "error",
        "refresh",
        "body",
        "generator",
        "look",
        "verify",
        "restart",
        "hybrid",
        "accept",
        "click",
        "strings",
        "tools",
        "whois record",
        "msgid10053",
        "msgid10051",
        "communicating",
        "anid",
        "execution",
        "null",
        "core",
        "installer",
        "threat roundup",
        "apple ios",
        "august",
        "highly targeted",
        "apple",
        "sqli dumper",
        "april",
        "february",
        "awful",
        "radar ineractive",
        "october",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist",
        "cisco umbrella",
        "site",
        "wormx",
        "malicious site",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "phishing site",
        "alexa",
        "phishing",
        "agent",
        "bank",
        "inmortal",
        "united",
        "cyber threat",
        "pony",
        "cnc zeus",
        "tracker",
        "cnc server",
        "covid19",
        "engineering",
        "http spammer",
        "host",
        "azorult",
        "asyncrat",
        "cobalt strike",
        "team",
        "hsbc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Radar Ineractive",
          "display_name": "Radar Ineractive",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 815,
        "FileHash-SHA256": 3404,
        "SSLCertFingerprint": 2,
        "URL": 8938,
        "domain": 1194,
        "hostname": 2705,
        "FileHash-SHA1": 457,
        "CIDR": 7,
        "CVE": 3
      },
      "indicator_count": 17525,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "893 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://149.96.125.65:443",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://149.96.125.65:443",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780255650.5733383
}