{
  "type": "URL",
  "indicator": "https://299233.myspreadshop.de/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://299233.myspreadshop.de/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3782846821,
      "indicator": "https://299233.myspreadshop.de/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 6,
      "pulses": [
        {
          "id": "656aafd0e93efa420f74123c",
          "name": "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
          "description": "",
          "modified": "2024-10-12T01:00:47.836000",
          "created": "2023-12-02T04:17:20.189000",
          "tags": [
            "ssl certificate",
            "contacted",
            "threat roundup",
            "whois record",
            "communicating",
            "subdomains",
            "resolutions",
            "june",
            "july",
            "october",
            "august",
            "noname057",
            "generic malware",
            "ice fog",
            "tag count",
            "thu nov",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "first",
            "generic",
            "detection list",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "malware",
            "alexa",
            "malware site",
            "malicious site",
            "unsafe",
            "artemis",
            "fakealert",
            "exploit",
            "opencandy",
            "riskware",
            "genkryptik",
            "iframe",
            "tiggre",
            "presenoker",
            "agent",
            "conduit",
            "wacatac",
            "phishing",
            "redline stealer",
            "dropper",
            "cobalt strike",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "filetour",
            "cleaner",
            "installpack",
            "xrat",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "blacknet rat",
            "stealer",
            "maltiverse",
            "webtoolbar",
            "trojanspy",
            "united",
            "engineering",
            "cyber threat",
            "phishing site",
            "america",
            "emotet",
            "zbot",
            "malicious",
            "steam",
            "team",
            "indonesia",
            "miner",
            "ransomware",
            "ramnit",
            "pe resource",
            "historical ssl",
            "execution",
            "hacktool",
            "metasploit",
            "relic",
            "monitoring",
            "android",
            "skynet",
            "et",
            "anonymizer",
            "trojanx",
            "back",
            "laplasclipper",
            "win64",
            "trojan",
            "ghost rat",
            "suppobox",
            "asyncrat",
            "union",
            "samples",
            "blacklist",
            "malicious url",
            "hostname",
            "hostnames",
            "tsara brashears",
            "reinsurance",
            "pinnacol insurance",
            "industry and commerce",
            "state",
            "danger",
            "warning",
            "nr-data.net",
            "apple",
            "data.net",
            "asp.net",
            "domains",
            "hashes",
            "reverse dns",
            "general full",
            "resource",
            "software",
            "asn15169",
            "google",
            "url http",
            "server",
            "hash",
            "get h2",
            "main",
            "cookie",
            "thu dec",
            "germany",
            "frankfurt",
            "netherlands",
            "asn20446",
            "highwinds3",
            "page url",
            "search live",
            "api blog",
            "docs pricing",
            "tags",
            "november",
            "us summary",
            "http",
            "google safe",
            "browsing",
            "adware",
            "xtrat",
            "firehol",
            "microsoft",
            "control server",
            "services",
            "msil",
            "hiloti",
            "asn16509",
            "amazon02",
            "fastly",
            "asn54113",
            "prague",
            "login",
            "listen live",
            "centura health",
            "colorado jobs",
            "eeo public",
            "filing url",
            "blacklist https",
            "mimikatz",
            "beach research",
            "de indicators",
            "copyright",
            "gmbh version",
            "follow",
            "softcnapp",
            "philadelphia",
            "gamehack",
            "value",
            "line",
            "variables",
            "nreum",
            "postrelease",
            "url https",
            "security tls",
            "protocol h2",
            "name value",
            "scam",
            "gesponsert url",
            "outputldjh",
            "oid2",
            "uhis2",
            "uh1200",
            "uw1600",
            "uah1200",
            "uaw1600",
            "ucd24",
            "usd1",
            "utz60",
            "no data",
            "coinminer",
            "ip address",
            "exchange",
            "http attacker",
            "states",
            "jimburkedentistry",
            "leder-family",
            "adam lee",
            "erika lee",
            "malvertizing"
          ],
          "references": [
            "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
            "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
            "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
            "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
            "http://tracks.theleders.family",
            "photos.theleders.family",
            "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
            "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
            "http://mobtrack.trkclk.net",
            "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "nr-data.net",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "103.233.208.9                    (CNC IP)",
            "apex.jquery.com             (scammer | works for who?)",
            "api.useragentswitch.com",
            "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
            "dns.google                          (DNS client services - Doug Cole)",
            "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
            "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
            "apple-dns.net",
            "emails.redvue.com  (apple DNS w/amvima)",
            "142.250.180.4 (init.ess)",
            "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
            "freeimdatingsites.thomasdobo.eu",
            "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
            "https://urlscan.io/domain/maxwam.tk",
            "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "States",
              "display_name": "States",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6562908e28e6cdc237fbf8db",
          "export_count": 107,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1956,
            "FileHash-SHA1": 867,
            "FileHash-SHA256": 3895,
            "URL": 11195,
            "domain": 2959,
            "hostname": 3575,
            "CVE": 16,
            "SSLCertFingerprint": 1,
            "email": 1
          },
          "indicator_count": 24465,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 230,
          "modified_text": "555 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6562908e28e6cdc237fbf8db",
          "name": "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
          "description": "",
          "modified": "2023-12-26T00:03:03.925000",
          "created": "2023-11-26T00:25:50.529000",
          "tags": [
            "ssl certificate",
            "contacted",
            "threat roundup",
            "whois record",
            "communicating",
            "subdomains",
            "resolutions",
            "june",
            "july",
            "october",
            "august",
            "noname057",
            "generic malware",
            "ice fog",
            "tag count",
            "thu nov",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "first",
            "generic",
            "detection list",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "malware",
            "alexa",
            "malware site",
            "malicious site",
            "unsafe",
            "artemis",
            "fakealert",
            "exploit",
            "opencandy",
            "riskware",
            "genkryptik",
            "iframe",
            "tiggre",
            "presenoker",
            "agent",
            "conduit",
            "wacatac",
            "phishing",
            "redline stealer",
            "dropper",
            "cobalt strike",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "filetour",
            "cleaner",
            "installpack",
            "xrat",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "blacknet rat",
            "stealer",
            "maltiverse",
            "webtoolbar",
            "trojanspy",
            "united",
            "engineering",
            "cyber threat",
            "phishing site",
            "america",
            "emotet",
            "zbot",
            "malicious",
            "steam",
            "team",
            "indonesia",
            "miner",
            "ransomware",
            "ramnit",
            "pe resource",
            "historical ssl",
            "execution",
            "hacktool",
            "metasploit",
            "relic",
            "monitoring",
            "android",
            "skynet",
            "et",
            "anonymizer",
            "trojanx",
            "back",
            "laplasclipper",
            "win64",
            "trojan",
            "ghost rat",
            "suppobox",
            "asyncrat",
            "union",
            "samples",
            "blacklist",
            "malicious url",
            "hostname",
            "hostnames",
            "tsara brashears",
            "reinsurance",
            "pinnacol insurance",
            "industry and commerce",
            "state",
            "danger",
            "warning",
            "nr-data.net",
            "apple",
            "data.net",
            "asp.net",
            "domains",
            "hashes",
            "reverse dns",
            "general full",
            "resource",
            "software",
            "asn15169",
            "google",
            "url http",
            "server",
            "hash",
            "get h2",
            "main",
            "cookie",
            "thu dec",
            "germany",
            "frankfurt",
            "netherlands",
            "asn20446",
            "highwinds3",
            "page url",
            "search live",
            "api blog",
            "docs pricing",
            "tags",
            "november",
            "us summary",
            "http",
            "google safe",
            "browsing",
            "adware",
            "xtrat",
            "firehol",
            "microsoft",
            "control server",
            "services",
            "msil",
            "hiloti",
            "asn16509",
            "amazon02",
            "fastly",
            "asn54113",
            "prague",
            "login",
            "listen live",
            "centura health",
            "colorado jobs",
            "eeo public",
            "filing url",
            "blacklist https",
            "mimikatz",
            "beach research",
            "de indicators",
            "copyright",
            "gmbh version",
            "follow",
            "softcnapp",
            "philadelphia",
            "gamehack",
            "value",
            "line",
            "variables",
            "nreum",
            "postrelease",
            "url https",
            "security tls",
            "protocol h2",
            "name value",
            "scam",
            "gesponsert url",
            "outputldjh",
            "oid2",
            "uhis2",
            "uh1200",
            "uw1600",
            "uah1200",
            "uaw1600",
            "ucd24",
            "usd1",
            "utz60",
            "no data",
            "coinminer",
            "ip address",
            "exchange",
            "http attacker",
            "states",
            "jimburkedentistry",
            "leder-family",
            "adam lee",
            "erika lee",
            "malvertizing"
          ],
          "references": [
            "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
            "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
            "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
            "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
            "http://tracks.theleders.family",
            "photos.theleders.family",
            "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
            "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
            "http://mobtrack.trkclk.net",
            "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "nr-data.net",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "103.233.208.9                    (CNC IP)",
            "apex.jquery.com             (scammer | works for who?)",
            "api.useragentswitch.com",
            "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
            "dns.google                          (DNS client services - Doug Cole)",
            "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
            "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
            "apple-dns.net",
            "emails.redvue.com  (apple DNS w/amvima)",
            "142.250.180.4 (init.ess)",
            "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
            "freeimdatingsites.thomasdobo.eu",
            "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
            "https://urlscan.io/domain/maxwam.tk",
            "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "States",
              "display_name": "States",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1956,
            "FileHash-SHA1": 867,
            "FileHash-SHA256": 3751,
            "URL": 10878,
            "domain": 2914,
            "hostname": 3520,
            "CVE": 16
          },
          "indicator_count": 23902,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "846 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656aafce24b001cba328dcbc",
          "name": "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
          "description": "",
          "modified": "2023-12-26T00:03:03.925000",
          "created": "2023-12-02T04:17:18.188000",
          "tags": [
            "ssl certificate",
            "contacted",
            "threat roundup",
            "whois record",
            "communicating",
            "subdomains",
            "resolutions",
            "june",
            "july",
            "october",
            "august",
            "noname057",
            "generic malware",
            "ice fog",
            "tag count",
            "thu nov",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "first",
            "generic",
            "detection list",
            "blacklist http",
            "cisco umbrella",
            "site",
            "heur",
            "alexa top",
            "safe site",
            "million",
            "malware",
            "alexa",
            "malware site",
            "malicious site",
            "unsafe",
            "artemis",
            "fakealert",
            "exploit",
            "opencandy",
            "riskware",
            "genkryptik",
            "iframe",
            "tiggre",
            "presenoker",
            "agent",
            "conduit",
            "wacatac",
            "phishing",
            "redline stealer",
            "dropper",
            "cobalt strike",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "filetour",
            "cleaner",
            "installpack",
            "xrat",
            "fusioncore",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "bank",
            "download",
            "blacknet rat",
            "stealer",
            "maltiverse",
            "webtoolbar",
            "trojanspy",
            "united",
            "engineering",
            "cyber threat",
            "phishing site",
            "america",
            "emotet",
            "zbot",
            "malicious",
            "steam",
            "team",
            "indonesia",
            "miner",
            "ransomware",
            "ramnit",
            "pe resource",
            "historical ssl",
            "execution",
            "hacktool",
            "metasploit",
            "relic",
            "monitoring",
            "android",
            "skynet",
            "et",
            "anonymizer",
            "trojanx",
            "back",
            "laplasclipper",
            "win64",
            "trojan",
            "ghost rat",
            "suppobox",
            "asyncrat",
            "union",
            "samples",
            "blacklist",
            "malicious url",
            "hostname",
            "hostnames",
            "tsara brashears",
            "reinsurance",
            "pinnacol insurance",
            "industry and commerce",
            "state",
            "danger",
            "warning",
            "nr-data.net",
            "apple",
            "data.net",
            "asp.net",
            "domains",
            "hashes",
            "reverse dns",
            "general full",
            "resource",
            "software",
            "asn15169",
            "google",
            "url http",
            "server",
            "hash",
            "get h2",
            "main",
            "cookie",
            "thu dec",
            "germany",
            "frankfurt",
            "netherlands",
            "asn20446",
            "highwinds3",
            "page url",
            "search live",
            "api blog",
            "docs pricing",
            "tags",
            "november",
            "us summary",
            "http",
            "google safe",
            "browsing",
            "adware",
            "xtrat",
            "firehol",
            "microsoft",
            "control server",
            "services",
            "msil",
            "hiloti",
            "asn16509",
            "amazon02",
            "fastly",
            "asn54113",
            "prague",
            "login",
            "listen live",
            "centura health",
            "colorado jobs",
            "eeo public",
            "filing url",
            "blacklist https",
            "mimikatz",
            "beach research",
            "de indicators",
            "copyright",
            "gmbh version",
            "follow",
            "softcnapp",
            "philadelphia",
            "gamehack",
            "value",
            "line",
            "variables",
            "nreum",
            "postrelease",
            "url https",
            "security tls",
            "protocol h2",
            "name value",
            "scam",
            "gesponsert url",
            "outputldjh",
            "oid2",
            "uhis2",
            "uh1200",
            "uw1600",
            "uah1200",
            "uaw1600",
            "ucd24",
            "usd1",
            "utz60",
            "no data",
            "coinminer",
            "ip address",
            "exchange",
            "http attacker",
            "states",
            "jimburkedentistry",
            "leder-family",
            "adam lee",
            "erika lee",
            "malvertizing"
          ],
          "references": [
            "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
            "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
            "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
            "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
            "http://tracks.theleders.family",
            "photos.theleders.family",
            "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
            "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
            "http://mobtrack.trkclk.net",
            "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "nr-data.net",
            "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
            "103.233.208.9                    (CNC IP)",
            "apex.jquery.com             (scammer | works for who?)",
            "api.useragentswitch.com",
            "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
            "dns.google                          (DNS client services - Doug Cole)",
            "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
            "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
            "apple-dns.net",
            "emails.redvue.com  (apple DNS w/amvima)",
            "142.250.180.4 (init.ess)",
            "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
            "freeimdatingsites.thomasdobo.eu",
            "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
            "https://urlscan.io/domain/maxwam.tk",
            "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            },
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "GameHack",
              "display_name": "GameHack",
              "target": null
            },
            {
              "id": "States",
              "display_name": "States",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1123",
              "name": "Audio Capture",
              "display_name": "T1123 - Audio Capture"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6562908e28e6cdc237fbf8db",
          "export_count": 78,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1956,
            "FileHash-SHA1": 867,
            "FileHash-SHA256": 3751,
            "URL": 10878,
            "domain": 2914,
            "hostname": 3520,
            "CVE": 16
          },
          "indicator_count": 23902,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "846 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655dafbe9ac9ac786fde45ad",
          "name": "http://malwaredomainlist.com/ \u2022 CNC \u2022 Spyware \u2022 Tracking",
          "description": "Network capture, dga domain, ecc domain, data collection, voicemail access, mail spammer, registrar abuse\n\n[Auto populated. I can't cannot confirm or deny the accuracy of the following information: A summary of key facts and information about a malicious web domain, hosted by the US government, has been released by Google.com and its parent company, Alphabet, for use on its website.]",
          "modified": "2023-12-22T06:03:01.993000",
          "created": "2023-11-22T07:37:34.595000",
          "tags": [
            "united",
            "as22612",
            "as2637",
            "creation date",
            "search",
            "moved",
            "expiration date",
            "date",
            "showing",
            "as397240",
            "next",
            "entries",
            "scan endpoints",
            "all octoseek",
            "dns replication",
            "win32 exe",
            "network capture",
            "android",
            "android adaway",
            "html",
            "files",
            "detections type",
            "name",
            "office open",
            "xml document",
            "namecheap",
            "namecheap inc",
            "whois lookups",
            "win32 dll",
            "text",
            "wextract",
            "text htaccess",
            "powershell",
            "detection list",
            "blacklist",
            "first",
            "ssl certificate",
            "whois record",
            "contacted",
            "december",
            "whois whois",
            "threat roundup",
            "historical ssl",
            "problems",
            "referrer",
            "pe resource",
            "startpage",
            "cyber threat",
            "redline stealer",
            "mail spammer",
            "hostname",
            "phishing site",
            "malicious site",
            "installcore",
            "http spammer",
            "malware site",
            "malware",
            "generic malware",
            "heur",
            "generic",
            "alexa top",
            "million",
            "site",
            "cisco umbrella",
            "alexa",
            "ip address",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cat cnzerossl",
            "ecc domain",
            "secure site",
            "ca ozerossl",
            "validity",
            "subject public",
            "server",
            "email",
            "code",
            "registrar abuse",
            "country",
            "privacy service",
            "withheld",
            "privacy",
            "domain name",
            "pattern match",
            "ascii text",
            "appdata",
            "file",
            "windows nt",
            "svg scalable",
            "vector graphics",
            "indicator",
            "gif image",
            "accept",
            "hybrid",
            "general",
            "local",
            "pixel",
            "click",
            "twitter",
            "strings",
            "class",
            "generator",
            "critical",
            "command_and_control",
            "spyware",
            "tracking",
            "voicemail access",
            "dga",
            "apple"
          ],
          "references": [
            "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
            "\u2193Interesting\u2193",
            "IPv4 198.54.117.211 command_and_control",
            "IPv4 198.54.117.210 command_and_control",
            "IPv4 198.54.117.212 command_and_control",
            "IPv4 198.54.117.215 command_and_control",
            "IPv4 198.54.117.217 command_and_control",
            "IPv4 198.54.117.218 command_and_control",
            "apple-securityiphone-icloud.com",
            "tx-p2p-pull.video-voip.com.dorm.com",
            "http://updates.voicemailaccess.net/b0f6a00b15311023",
            "tvapp-server.de",
            "zeustracker.abuse.ch",
            "ransomwaretracker.abuse.ch",
            "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
            "louisianarooflawyers.com         [phishing]",
            "hasownproperty.call"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "BlackNET",
              "display_name": "BlackNET",
              "target": null
            },
            {
              "id": "InstallCore",
              "display_name": "InstallCore",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1114",
              "name": "Email Collection",
              "display_name": "T1114 - Email Collection"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 105,
            "FileHash-SHA1": 100,
            "FileHash-SHA256": 3072,
            "domain": 1188,
            "email": 5,
            "URL": 7940,
            "hostname": 1925,
            "CVE": 1
          },
          "indicator_count": 14336,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 228,
          "modified_text": "850 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65551682899b039e02b8dc8a",
          "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
          "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
          "modified": "2023-12-15T18:02:25.356000",
          "created": "2023-11-15T19:05:38.437000",
          "tags": [
            "strong",
            "saal digital",
            "photo portal",
            "daten",
            "support",
            "saal",
            "bersicht",
            "informationen",
            "profis",
            "rabatte fr",
            "service",
            "heur",
            "malware",
            "cisco umbrella",
            "adware",
            "safe site",
            "malware site",
            "malicious site",
            "phishing site",
            "alexa top",
            "million",
            "tiggre",
            "presenoker",
            "agent",
            "opencandy",
            "conduit",
            "unsafe",
            "wacatac",
            "artemis",
            "phishing",
            "iframe",
            "installpack",
            "xrat",
            "fusioncore",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "genkryptik",
            "exploit",
            "filetour",
            "cleaner",
            "webtoolbar",
            "trojanspy",
            "get fdm",
            "ms windows",
            "pe32",
            "intel",
            "search",
            "show",
            "united",
            "entries",
            "systemdrive",
            "program files",
            "installer",
            "write",
            "delphi",
            "next",
            "june",
            "win32",
            "copy",
            "pixel",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "variables",
            "langpage string",
            "lang",
            "saalgroup",
            "creoletohtml",
            "chat",
            "reverse dns",
            "resource",
            "general full",
            "asn16509",
            "amazon02",
            "url https",
            "security tls",
            "protocol h2",
            "hash",
            "get h2",
            "main",
            "request chain",
            "http",
            "de redirected",
            "http redirect",
            "site",
            "malicious url",
            "blacklist https",
            "domain",
            "screenshot",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "amazons3",
            "aes128gcm",
            "amazon rsa",
            "aes256",
            "date",
            "name verdict",
            "pattern match",
            "root ca",
            "script",
            "done adding",
            "catalog file",
            "file",
            "indicator",
            "authority",
            "class",
            "mitre att",
            "meta",
            "unknown",
            "error",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "refresh",
            "tools",
            "null",
            "body",
            "create c",
            "html document",
            "xport",
            "noname057",
            "generic malware",
            "generic",
            "dapato",
            "alexa",
            "installcore",
            "downloader",
            "dropper",
            "outbreak",
            "iobit",
            "mediaget",
            "azorult",
            "runescape",
            "facebook",
            "bank",
            "download",
            "live",
            "rms",
            "maltiverse",
            "cyber threat",
            "engineering",
            "services",
            "malicious host",
            "malicious",
            "team",
            "zeus",
            "nymaim",
            "zbot",
            "simda",
            "asyncrat",
            "cobalt strike",
            "ransomware",
            "matsnu",
            "cutwail",
            "citadel",
            "pykspa",
            "raccoon",
            "kronos",
            "ramnit",
            "redline stealer",
            "apple",
            "apple",
            "html info",
            "title saal",
            "meta tags",
            "trackers google",
            "tag manager",
            "gtm5wjlq2",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "self",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "hostname",
            "anonymizer",
            "firehol",
            "mail spammer",
            "team proxy",
            "kraken",
            "suppobox",
            "tofsee",
            "vawtrak",
            "hotmail",
            "netsky",
            "stealer",
            "blacknet rat",
            "remcos",
            "miner",
            "hacktool",
            "trojan",
            "detplock",
            "team phishing",
            "a nxdomain",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "urls",
            "files",
            "ip address",
            "all search",
            "otx octoseek",
            "files ip",
            "contacted",
            "whois record",
            "ssl certificate",
            "pe resource",
            "bundled",
            "attack",
            "parent",
            "historical ssl",
            "collections",
            "communicating",
            "emotet",
            "execution",
            "markmonitor inc",
            "vhash",
            "authentihash",
            "imphash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "archive",
            "valid",
            "serial number",
            "valid from",
            "valid usage",
            "code signing",
            "status status",
            "valid issuer",
            "assured id",
            "issuer issuer",
            "symantec sha256",
            "sections",
            "file type",
            "trid generic",
            "cil executable",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "sections name",
            "streams size",
            "entropy chi2",
            "guid",
            "blob",
            "namecheap",
            "ip detections",
            "country",
            "resolutions",
            "referrer",
            "whois whois",
            "threat roundup",
            "parent domain",
            "CVE-2023-22518",
            "CVE-2017-0143",
            "CVE-2017-0147",
            "CVE-2020-0601",
            "CVE-2017-8570",
            "CVE-2018-4893",
            "CVE-2017-11882",
            "CVE-2017-0199",
            "CVE-2014-3153",
            "W32.AIDetectNet.01",
            "trojan.adload/ursu",
            "targeting tsara brashears",
            "cybercrime",
            "privilege escalation",
            "defacement",
            "privilege abuse",
            "soc",
            "red team",
            "social engineering",
            "retaliation",
            "assault victim",
            "obsession"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
            "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
            "\u2193 Interesting \u2193",
            "owa.telegrafix.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
            "christ.robert@gmx.de",
            "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
            "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
            "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
            "BEELab_web_1.0.2-prerelease.exe",
            "AfraidZad.exe",
            "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
            "greycroftpartners.com",
            "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
            "trkpls3.com",
            "eg-monitoring.com",
            "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
            "https://twitter.com/PORNO_SEXYBABES"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Italy",
            "Singapore",
            "France",
            "Germany",
            "Korea, Republic of"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "RMS",
              "display_name": "RMS",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 841,
            "FileHash-SHA1": 467,
            "FileHash-SHA256": 6370,
            "CVE": 9,
            "domain": 2160,
            "hostname": 3074,
            "email": 1,
            "URL": 6550,
            "SSLCertFingerprint": 1,
            "CIDR": 3
          },
          "indicator_count": 19476,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "857 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655516871038cbad9eae2bb7",
          "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
          "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
          "modified": "2023-12-15T18:02:25.356000",
          "created": "2023-11-15T19:05:43.285000",
          "tags": [
            "strong",
            "saal digital",
            "photo portal",
            "daten",
            "support",
            "saal",
            "bersicht",
            "informationen",
            "profis",
            "rabatte fr",
            "service",
            "heur",
            "malware",
            "cisco umbrella",
            "adware",
            "safe site",
            "malware site",
            "malicious site",
            "phishing site",
            "alexa top",
            "million",
            "tiggre",
            "presenoker",
            "agent",
            "opencandy",
            "conduit",
            "unsafe",
            "wacatac",
            "artemis",
            "phishing",
            "iframe",
            "installpack",
            "xrat",
            "fusioncore",
            "riskware",
            "acint",
            "nircmd",
            "swrort",
            "downldr",
            "systweak",
            "behav",
            "crack",
            "genkryptik",
            "exploit",
            "filetour",
            "cleaner",
            "webtoolbar",
            "trojanspy",
            "get fdm",
            "ms windows",
            "pe32",
            "intel",
            "search",
            "show",
            "united",
            "entries",
            "systemdrive",
            "program files",
            "installer",
            "write",
            "delphi",
            "next",
            "june",
            "win32",
            "copy",
            "pixel",
            "search live",
            "api blog",
            "docs pricing",
            "november",
            "de indicators",
            "domains",
            "hashes",
            "copyright",
            "gmbh version",
            "follow",
            "value",
            "variables",
            "langpage string",
            "lang",
            "saalgroup",
            "creoletohtml",
            "chat",
            "reverse dns",
            "resource",
            "general full",
            "asn16509",
            "amazon02",
            "url https",
            "security tls",
            "protocol h2",
            "hash",
            "get h2",
            "main",
            "request chain",
            "http",
            "de redirected",
            "http redirect",
            "site",
            "malicious url",
            "blacklist https",
            "domain",
            "screenshot",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "amazons3",
            "aes128gcm",
            "amazon rsa",
            "aes256",
            "date",
            "name verdict",
            "pattern match",
            "root ca",
            "script",
            "done adding",
            "catalog file",
            "file",
            "indicator",
            "authority",
            "class",
            "mitre att",
            "meta",
            "unknown",
            "error",
            "hybrid",
            "accept",
            "general",
            "local",
            "click",
            "strings",
            "generator",
            "critical",
            "refresh",
            "tools",
            "null",
            "body",
            "create c",
            "html document",
            "xport",
            "noname057",
            "generic malware",
            "generic",
            "dapato",
            "alexa",
            "installcore",
            "downloader",
            "dropper",
            "outbreak",
            "iobit",
            "mediaget",
            "azorult",
            "runescape",
            "facebook",
            "bank",
            "download",
            "live",
            "rms",
            "maltiverse",
            "cyber threat",
            "engineering",
            "services",
            "malicious host",
            "malicious",
            "team",
            "zeus",
            "nymaim",
            "zbot",
            "simda",
            "asyncrat",
            "cobalt strike",
            "ransomware",
            "matsnu",
            "cutwail",
            "citadel",
            "pykspa",
            "raccoon",
            "kronos",
            "ramnit",
            "redline stealer",
            "apple",
            "apple",
            "html info",
            "title saal",
            "meta tags",
            "trackers google",
            "tag manager",
            "gtm5wjlq2",
            "http response",
            "final url",
            "serving ip",
            "address",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "headers",
            "self",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "hostname",
            "anonymizer",
            "firehol",
            "mail spammer",
            "team proxy",
            "kraken",
            "suppobox",
            "tofsee",
            "vawtrak",
            "hotmail",
            "netsky",
            "stealer",
            "blacknet rat",
            "remcos",
            "miner",
            "hacktool",
            "trojan",
            "detplock",
            "team phishing",
            "a nxdomain",
            "passive dns",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "urls",
            "files",
            "ip address",
            "all search",
            "otx octoseek",
            "files ip",
            "contacted",
            "whois record",
            "ssl certificate",
            "pe resource",
            "bundled",
            "attack",
            "parent",
            "historical ssl",
            "collections",
            "communicating",
            "emotet",
            "execution",
            "markmonitor inc",
            "vhash",
            "authentihash",
            "imphash",
            "ssdeep",
            "win32 exe",
            "magic pe32",
            "trid win32",
            "archive",
            "valid",
            "serial number",
            "valid from",
            "valid usage",
            "code signing",
            "status status",
            "valid issuer",
            "assured id",
            "issuer issuer",
            "symantec sha256",
            "sections",
            "file type",
            "trid generic",
            "cil executable",
            "contained",
            "details module",
            "version id",
            "typelib id",
            "header target",
            "machine intel",
            "utc entry",
            "point",
            "sections name",
            "streams size",
            "entropy chi2",
            "guid",
            "blob",
            "namecheap",
            "ip detections",
            "country",
            "resolutions",
            "referrer",
            "whois whois",
            "threat roundup",
            "parent domain",
            "CVE-2023-22518",
            "CVE-2017-0143",
            "CVE-2017-0147",
            "CVE-2020-0601",
            "CVE-2017-8570",
            "CVE-2018-4893",
            "CVE-2017-11882",
            "CVE-2017-0199",
            "CVE-2014-3153",
            "W32.AIDetectNet.01",
            "trojan.adload/ursu",
            "targeting tsara brashears",
            "cybercrime",
            "privilege escalation",
            "defacement",
            "privilege abuse",
            "soc",
            "red team",
            "social engineering",
            "retaliation",
            "assault victim",
            "obsession"
          ],
          "references": [
            "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
            "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
            "\u2193 Interesting \u2193",
            "owa.telegrafix.com",
            "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
            "christ.robert@gmx.de",
            "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
            "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
            "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
            "BEELab_web_1.0.2-prerelease.exe",
            "AfraidZad.exe",
            "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
            "greycroftpartners.com",
            "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
            "trkpls3.com",
            "eg-monitoring.com",
            "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
            "https://twitter.com/PORNO_SEXYBABES"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Netherlands",
            "Italy",
            "Singapore",
            "France",
            "Germany",
            "Korea, Republic of"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "Generic",
              "display_name": "Generic",
              "target": null
            },
            {
              "id": "RMS",
              "display_name": "RMS",
              "target": null
            },
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "T1081",
              "name": "Credentials in Files",
              "display_name": "T1081 - Credentials in Files"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 841,
            "FileHash-SHA1": 467,
            "FileHash-SHA256": 6370,
            "CVE": 9,
            "domain": 2160,
            "hostname": 3074,
            "email": 1,
            "URL": 6550,
            "SSLCertFingerprint": 1,
            "CIDR": 3
          },
          "indicator_count": 19476,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "857 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "christ.robert@gmx.de",
        "apex.jquery.com             (scammer | works for who?)",
        "tvapp-server.de",
        "http://mobtrack.trkclk.net",
        "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "api.useragentswitch.com",
        "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
        "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
        "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators",
        "http://updates.voicemailaccess.net/b0f6a00b15311023",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "trkpls3.com",
        "https://twitter.com/PORNO_SEXYBABES",
        "apple-securityiphone-icloud.com",
        "tx-p2p-pull.video-voip.com.dorm.com",
        "IPv4 198.54.117.211 command_and_control",
        "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
        "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
        "IPv4 198.54.117.212 command_and_control",
        "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
        "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
        "IPv4 198.54.117.210 command_and_control",
        "hasownproperty.call",
        "142.250.180.4 (init.ess)",
        "IPv4 198.54.117.217 command_and_control",
        "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
        "AfraidZad.exe",
        "IPv4 198.54.117.218 command_and_control",
        "emails.redvue.com  (apple DNS w/amvima)",
        "\u2193 Interesting \u2193",
        "photos.theleders.family",
        "freeimdatingsites.thomasdobo.eu",
        "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
        "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
        "nr-data.net",
        "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
        "greycroftpartners.com",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
        "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
        "https://urlscan.io/domain/maxwam.tk",
        "apple-dns.net",
        "ransomwaretracker.abuse.ch",
        "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
        "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
        "IPv4 198.54.117.215 command_and_control",
        "louisianarooflawyers.com         [phishing]",
        "dns.google                          (DNS client services - Doug Cole)",
        "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
        "\u2193Interesting\u2193",
        "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
        "zeustracker.abuse.ch",
        "http://tracks.theleders.family",
        "BEELab_web_1.0.2-prerelease.exe",
        "eg-monitoring.com",
        "103.233.208.9                    (CNC IP)",
        "owa.telegrafix.com",
        "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Beach research",
            "States",
            "Blacknet",
            "Installcore",
            "Trojanspy",
            "Et",
            "Rms",
            "Webtoolbar",
            "Maltiverse",
            "Gamehack",
            "Generic"
          ],
          "industries": [],
          "unique_indicators": 56487
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/myspreadshop.de",
    "whois": "http://whois.domaintools.com/myspreadshop.de",
    "domain": "myspreadshop.de",
    "hostname": "299233.myspreadshop.de"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 6,
  "pulses": [
    {
      "id": "656aafd0e93efa420f74123c",
      "name": "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
      "description": "",
      "modified": "2024-10-12T01:00:47.836000",
      "created": "2023-12-02T04:17:20.189000",
      "tags": [
        "ssl certificate",
        "contacted",
        "threat roundup",
        "whois record",
        "communicating",
        "subdomains",
        "resolutions",
        "june",
        "july",
        "october",
        "august",
        "noname057",
        "generic malware",
        "ice fog",
        "tag count",
        "thu nov",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "first",
        "generic",
        "detection list",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "malware",
        "alexa",
        "malware site",
        "malicious site",
        "unsafe",
        "artemis",
        "fakealert",
        "exploit",
        "opencandy",
        "riskware",
        "genkryptik",
        "iframe",
        "tiggre",
        "presenoker",
        "agent",
        "conduit",
        "wacatac",
        "phishing",
        "redline stealer",
        "dropper",
        "cobalt strike",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "filetour",
        "cleaner",
        "installpack",
        "xrat",
        "fusioncore",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "blacknet rat",
        "stealer",
        "maltiverse",
        "webtoolbar",
        "trojanspy",
        "united",
        "engineering",
        "cyber threat",
        "phishing site",
        "america",
        "emotet",
        "zbot",
        "malicious",
        "steam",
        "team",
        "indonesia",
        "miner",
        "ransomware",
        "ramnit",
        "pe resource",
        "historical ssl",
        "execution",
        "hacktool",
        "metasploit",
        "relic",
        "monitoring",
        "android",
        "skynet",
        "et",
        "anonymizer",
        "trojanx",
        "back",
        "laplasclipper",
        "win64",
        "trojan",
        "ghost rat",
        "suppobox",
        "asyncrat",
        "union",
        "samples",
        "blacklist",
        "malicious url",
        "hostname",
        "hostnames",
        "tsara brashears",
        "reinsurance",
        "pinnacol insurance",
        "industry and commerce",
        "state",
        "danger",
        "warning",
        "nr-data.net",
        "apple",
        "data.net",
        "asp.net",
        "domains",
        "hashes",
        "reverse dns",
        "general full",
        "resource",
        "software",
        "asn15169",
        "google",
        "url http",
        "server",
        "hash",
        "get h2",
        "main",
        "cookie",
        "thu dec",
        "germany",
        "frankfurt",
        "netherlands",
        "asn20446",
        "highwinds3",
        "page url",
        "search live",
        "api blog",
        "docs pricing",
        "tags",
        "november",
        "us summary",
        "http",
        "google safe",
        "browsing",
        "adware",
        "xtrat",
        "firehol",
        "microsoft",
        "control server",
        "services",
        "msil",
        "hiloti",
        "asn16509",
        "amazon02",
        "fastly",
        "asn54113",
        "prague",
        "login",
        "listen live",
        "centura health",
        "colorado jobs",
        "eeo public",
        "filing url",
        "blacklist https",
        "mimikatz",
        "beach research",
        "de indicators",
        "copyright",
        "gmbh version",
        "follow",
        "softcnapp",
        "philadelphia",
        "gamehack",
        "value",
        "line",
        "variables",
        "nreum",
        "postrelease",
        "url https",
        "security tls",
        "protocol h2",
        "name value",
        "scam",
        "gesponsert url",
        "outputldjh",
        "oid2",
        "uhis2",
        "uh1200",
        "uw1600",
        "uah1200",
        "uaw1600",
        "ucd24",
        "usd1",
        "utz60",
        "no data",
        "coinminer",
        "ip address",
        "exchange",
        "http attacker",
        "states",
        "jimburkedentistry",
        "leder-family",
        "adam lee",
        "erika lee",
        "malvertizing"
      ],
      "references": [
        "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
        "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
        "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
        "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
        "http://tracks.theleders.family",
        "photos.theleders.family",
        "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
        "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
        "http://mobtrack.trkclk.net",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "nr-data.net",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "103.233.208.9                    (CNC IP)",
        "apex.jquery.com             (scammer | works for who?)",
        "api.useragentswitch.com",
        "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
        "dns.google                          (DNS client services - Doug Cole)",
        "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
        "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
        "apple-dns.net",
        "emails.redvue.com  (apple DNS w/amvima)",
        "142.250.180.4 (init.ess)",
        "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
        "freeimdatingsites.thomasdobo.eu",
        "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
        "https://urlscan.io/domain/maxwam.tk",
        "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "States",
          "display_name": "States",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6562908e28e6cdc237fbf8db",
      "export_count": 107,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1956,
        "FileHash-SHA1": 867,
        "FileHash-SHA256": 3895,
        "URL": 11195,
        "domain": 2959,
        "hostname": 3575,
        "CVE": 16,
        "SSLCertFingerprint": 1,
        "email": 1
      },
      "indicator_count": 24465,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 230,
      "modified_text": "555 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6562908e28e6cdc237fbf8db",
      "name": "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
      "description": "",
      "modified": "2023-12-26T00:03:03.925000",
      "created": "2023-11-26T00:25:50.529000",
      "tags": [
        "ssl certificate",
        "contacted",
        "threat roundup",
        "whois record",
        "communicating",
        "subdomains",
        "resolutions",
        "june",
        "july",
        "october",
        "august",
        "noname057",
        "generic malware",
        "ice fog",
        "tag count",
        "thu nov",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "first",
        "generic",
        "detection list",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "malware",
        "alexa",
        "malware site",
        "malicious site",
        "unsafe",
        "artemis",
        "fakealert",
        "exploit",
        "opencandy",
        "riskware",
        "genkryptik",
        "iframe",
        "tiggre",
        "presenoker",
        "agent",
        "conduit",
        "wacatac",
        "phishing",
        "redline stealer",
        "dropper",
        "cobalt strike",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "filetour",
        "cleaner",
        "installpack",
        "xrat",
        "fusioncore",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "blacknet rat",
        "stealer",
        "maltiverse",
        "webtoolbar",
        "trojanspy",
        "united",
        "engineering",
        "cyber threat",
        "phishing site",
        "america",
        "emotet",
        "zbot",
        "malicious",
        "steam",
        "team",
        "indonesia",
        "miner",
        "ransomware",
        "ramnit",
        "pe resource",
        "historical ssl",
        "execution",
        "hacktool",
        "metasploit",
        "relic",
        "monitoring",
        "android",
        "skynet",
        "et",
        "anonymizer",
        "trojanx",
        "back",
        "laplasclipper",
        "win64",
        "trojan",
        "ghost rat",
        "suppobox",
        "asyncrat",
        "union",
        "samples",
        "blacklist",
        "malicious url",
        "hostname",
        "hostnames",
        "tsara brashears",
        "reinsurance",
        "pinnacol insurance",
        "industry and commerce",
        "state",
        "danger",
        "warning",
        "nr-data.net",
        "apple",
        "data.net",
        "asp.net",
        "domains",
        "hashes",
        "reverse dns",
        "general full",
        "resource",
        "software",
        "asn15169",
        "google",
        "url http",
        "server",
        "hash",
        "get h2",
        "main",
        "cookie",
        "thu dec",
        "germany",
        "frankfurt",
        "netherlands",
        "asn20446",
        "highwinds3",
        "page url",
        "search live",
        "api blog",
        "docs pricing",
        "tags",
        "november",
        "us summary",
        "http",
        "google safe",
        "browsing",
        "adware",
        "xtrat",
        "firehol",
        "microsoft",
        "control server",
        "services",
        "msil",
        "hiloti",
        "asn16509",
        "amazon02",
        "fastly",
        "asn54113",
        "prague",
        "login",
        "listen live",
        "centura health",
        "colorado jobs",
        "eeo public",
        "filing url",
        "blacklist https",
        "mimikatz",
        "beach research",
        "de indicators",
        "copyright",
        "gmbh version",
        "follow",
        "softcnapp",
        "philadelphia",
        "gamehack",
        "value",
        "line",
        "variables",
        "nreum",
        "postrelease",
        "url https",
        "security tls",
        "protocol h2",
        "name value",
        "scam",
        "gesponsert url",
        "outputldjh",
        "oid2",
        "uhis2",
        "uh1200",
        "uw1600",
        "uah1200",
        "uaw1600",
        "ucd24",
        "usd1",
        "utz60",
        "no data",
        "coinminer",
        "ip address",
        "exchange",
        "http attacker",
        "states",
        "jimburkedentistry",
        "leder-family",
        "adam lee",
        "erika lee",
        "malvertizing"
      ],
      "references": [
        "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
        "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
        "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
        "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
        "http://tracks.theleders.family",
        "photos.theleders.family",
        "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
        "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
        "http://mobtrack.trkclk.net",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "nr-data.net",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "103.233.208.9                    (CNC IP)",
        "apex.jquery.com             (scammer | works for who?)",
        "api.useragentswitch.com",
        "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
        "dns.google                          (DNS client services - Doug Cole)",
        "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
        "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
        "apple-dns.net",
        "emails.redvue.com  (apple DNS w/amvima)",
        "142.250.180.4 (init.ess)",
        "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
        "freeimdatingsites.thomasdobo.eu",
        "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
        "https://urlscan.io/domain/maxwam.tk",
        "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "States",
          "display_name": "States",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1956,
        "FileHash-SHA1": 867,
        "FileHash-SHA256": 3751,
        "URL": 10878,
        "domain": 2914,
        "hostname": 3520,
        "CVE": 16
      },
      "indicator_count": 23902,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "846 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "656aafce24b001cba328dcbc",
      "name": "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
      "description": "",
      "modified": "2023-12-26T00:03:03.925000",
      "created": "2023-12-02T04:17:18.188000",
      "tags": [
        "ssl certificate",
        "contacted",
        "threat roundup",
        "whois record",
        "communicating",
        "subdomains",
        "resolutions",
        "june",
        "july",
        "october",
        "august",
        "noname057",
        "generic malware",
        "ice fog",
        "tag count",
        "thu nov",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "first",
        "generic",
        "detection list",
        "blacklist http",
        "cisco umbrella",
        "site",
        "heur",
        "alexa top",
        "safe site",
        "million",
        "malware",
        "alexa",
        "malware site",
        "malicious site",
        "unsafe",
        "artemis",
        "fakealert",
        "exploit",
        "opencandy",
        "riskware",
        "genkryptik",
        "iframe",
        "tiggre",
        "presenoker",
        "agent",
        "conduit",
        "wacatac",
        "phishing",
        "redline stealer",
        "dropper",
        "cobalt strike",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "filetour",
        "cleaner",
        "installpack",
        "xrat",
        "fusioncore",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "bank",
        "download",
        "blacknet rat",
        "stealer",
        "maltiverse",
        "webtoolbar",
        "trojanspy",
        "united",
        "engineering",
        "cyber threat",
        "phishing site",
        "america",
        "emotet",
        "zbot",
        "malicious",
        "steam",
        "team",
        "indonesia",
        "miner",
        "ransomware",
        "ramnit",
        "pe resource",
        "historical ssl",
        "execution",
        "hacktool",
        "metasploit",
        "relic",
        "monitoring",
        "android",
        "skynet",
        "et",
        "anonymizer",
        "trojanx",
        "back",
        "laplasclipper",
        "win64",
        "trojan",
        "ghost rat",
        "suppobox",
        "asyncrat",
        "union",
        "samples",
        "blacklist",
        "malicious url",
        "hostname",
        "hostnames",
        "tsara brashears",
        "reinsurance",
        "pinnacol insurance",
        "industry and commerce",
        "state",
        "danger",
        "warning",
        "nr-data.net",
        "apple",
        "data.net",
        "asp.net",
        "domains",
        "hashes",
        "reverse dns",
        "general full",
        "resource",
        "software",
        "asn15169",
        "google",
        "url http",
        "server",
        "hash",
        "get h2",
        "main",
        "cookie",
        "thu dec",
        "germany",
        "frankfurt",
        "netherlands",
        "asn20446",
        "highwinds3",
        "page url",
        "search live",
        "api blog",
        "docs pricing",
        "tags",
        "november",
        "us summary",
        "http",
        "google safe",
        "browsing",
        "adware",
        "xtrat",
        "firehol",
        "microsoft",
        "control server",
        "services",
        "msil",
        "hiloti",
        "asn16509",
        "amazon02",
        "fastly",
        "asn54113",
        "prague",
        "login",
        "listen live",
        "centura health",
        "colorado jobs",
        "eeo public",
        "filing url",
        "blacklist https",
        "mimikatz",
        "beach research",
        "de indicators",
        "copyright",
        "gmbh version",
        "follow",
        "softcnapp",
        "philadelphia",
        "gamehack",
        "value",
        "line",
        "variables",
        "nreum",
        "postrelease",
        "url https",
        "security tls",
        "protocol h2",
        "name value",
        "scam",
        "gesponsert url",
        "outputldjh",
        "oid2",
        "uhis2",
        "uh1200",
        "uw1600",
        "uah1200",
        "uaw1600",
        "ucd24",
        "usd1",
        "utz60",
        "no data",
        "coinminer",
        "ip address",
        "exchange",
        "http attacker",
        "states",
        "jimburkedentistry",
        "leder-family",
        "adam lee",
        "erika lee",
        "malvertizing"
      ],
      "references": [
        "http://maxwam.tk/news/top-stories/widow-penalized-for-late-husband-s-legal-marijuana-use/769762335",
        "https://www.denverpost.com/2018/07/17/marijuana-workers-compensation/amp/ Source",
        "http://jcsservices.in/gkqikjxn/index.php?pnz=jim@thejimburkefamily.com",
        "http://www.burkedentistry.com/Quarryville-Dentist-and-Staff/1567",
        "http://tracks.theleders.family",
        "photos.theleders.family",
        "http://45.159.189.105/bot/regex      (tracks Tsara Brashears)",
        "45.159.189.105                   (CNC IP \u2022 Tracking Tsara Brashears)",
        "http://mobtrack.trkclk.net",
        "https://otx.alienvault.com/indicator/url/https://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://wallpapers-nature.com/tsara-brashears/tse1-mm-bing-net",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "nr-data.net",
        "https://wallpapers-nature.com/%20tsara-brashears/urlscan-io",
        "103.233.208.9                    (CNC IP)",
        "apex.jquery.com             (scammer | works for who?)",
        "api.useragentswitch.com",
        "bam-cell.nr-data.net        (Apple Private Data Collection | since found, result continuously modified)",
        "dns.google                          (DNS client services - Doug Cole)",
        "https://www.9and10news.com/2021/09/17/fbi-releases-update-on-suspicious-packages-left-at-att-stores/",
        "https://api.openinstall.io/api/v2/android/otby76/init?certFinger=44:B4:38:61:15:B4:57:55:B5:BF:D1:6B:34:CC:60:72:DA:C7:40:CE&macAddress=6D:51:08:93:04:7B&serialNumber=&apiVersion=2.3.0&deviceId=&pkg=com.mobikok.ecoupon&version=8.1.0&installId=&androidId=91ed20d90734918e&versionCode=333\u00d7tamp=1684541379839",
        "apple-dns.net",
        "emails.redvue.com  (apple DNS w/amvima)",
        "142.250.180.4 (init.ess)",
        "init.ess.apple.com   (Highly malicious. Will infiltrate devices when exploited. Spyware)",
        "freeimdatingsites.thomasdobo.eu",
        "https://urlscan.io/result/07fe876e-8864-474f-8b32-ba2d50c9a242/#indicators",
        "https://urlscan.io/domain/maxwam.tk",
        "https://urlscan.io/result/e770a861-9818-4309-b31e-fd18510532a7/#indicators"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        },
        {
          "id": "Beach Research",
          "display_name": "Beach Research",
          "target": null
        },
        {
          "id": "GameHack",
          "display_name": "GameHack",
          "target": null
        },
        {
          "id": "States",
          "display_name": "States",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1123",
          "name": "Audio Capture",
          "display_name": "T1123 - Audio Capture"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6562908e28e6cdc237fbf8db",
      "export_count": 78,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1956,
        "FileHash-SHA1": 867,
        "FileHash-SHA256": 3751,
        "URL": 10878,
        "domain": 2914,
        "hostname": 3520,
        "CVE": 16
      },
      "indicator_count": 23902,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "846 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655dafbe9ac9ac786fde45ad",
      "name": "http://malwaredomainlist.com/ \u2022 CNC \u2022 Spyware \u2022 Tracking",
      "description": "Network capture, dga domain, ecc domain, data collection, voicemail access, mail spammer, registrar abuse\n\n[Auto populated. I can't cannot confirm or deny the accuracy of the following information: A summary of key facts and information about a malicious web domain, hosted by the US government, has been released by Google.com and its parent company, Alphabet, for use on its website.]",
      "modified": "2023-12-22T06:03:01.993000",
      "created": "2023-11-22T07:37:34.595000",
      "tags": [
        "united",
        "as22612",
        "as2637",
        "creation date",
        "search",
        "moved",
        "expiration date",
        "date",
        "showing",
        "as397240",
        "next",
        "entries",
        "scan endpoints",
        "all octoseek",
        "dns replication",
        "win32 exe",
        "network capture",
        "android",
        "android adaway",
        "html",
        "files",
        "detections type",
        "name",
        "office open",
        "xml document",
        "namecheap",
        "namecheap inc",
        "whois lookups",
        "win32 dll",
        "text",
        "wextract",
        "text htaccess",
        "powershell",
        "detection list",
        "blacklist",
        "first",
        "ssl certificate",
        "whois record",
        "contacted",
        "december",
        "whois whois",
        "threat roundup",
        "historical ssl",
        "problems",
        "referrer",
        "pe resource",
        "startpage",
        "cyber threat",
        "redline stealer",
        "mail spammer",
        "hostname",
        "phishing site",
        "malicious site",
        "installcore",
        "http spammer",
        "malware site",
        "malware",
        "generic malware",
        "heur",
        "generic",
        "alexa top",
        "million",
        "site",
        "cisco umbrella",
        "alexa",
        "ip address",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cat cnzerossl",
        "ecc domain",
        "secure site",
        "ca ozerossl",
        "validity",
        "subject public",
        "server",
        "email",
        "code",
        "registrar abuse",
        "country",
        "privacy service",
        "withheld",
        "privacy",
        "domain name",
        "pattern match",
        "ascii text",
        "appdata",
        "file",
        "windows nt",
        "svg scalable",
        "vector graphics",
        "indicator",
        "gif image",
        "accept",
        "hybrid",
        "general",
        "local",
        "pixel",
        "click",
        "twitter",
        "strings",
        "class",
        "generator",
        "critical",
        "command_and_control",
        "spyware",
        "tracking",
        "voicemail access",
        "dga",
        "apple"
      ],
      "references": [
        "https://www.hybrid-analysis.com/sample/c0c84df54b890bb408fc2289f1e75a29991127bbe207aa30042616b5ea150342/655d9af5679c7afcc409895e",
        "\u2193Interesting\u2193",
        "IPv4 198.54.117.211 command_and_control",
        "IPv4 198.54.117.210 command_and_control",
        "IPv4 198.54.117.212 command_and_control",
        "IPv4 198.54.117.215 command_and_control",
        "IPv4 198.54.117.217 command_and_control",
        "IPv4 198.54.117.218 command_and_control",
        "apple-securityiphone-icloud.com",
        "tx-p2p-pull.video-voip.com.dorm.com",
        "http://updates.voicemailaccess.net/b0f6a00b15311023",
        "tvapp-server.de",
        "zeustracker.abuse.ch",
        "ransomwaretracker.abuse.ch",
        "http://t.trkitok.com/track/rep?oid=2001&st=1&id=DP2441--w1VJE427J8SGGRTP02MD7UEG___93737493-c08b-4dc7-ad30-b17a2c09e771___$mid",
        "louisianarooflawyers.com         [phishing]",
        "hasownproperty.call"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "BlackNET",
          "display_name": "BlackNET",
          "target": null
        },
        {
          "id": "InstallCore",
          "display_name": "InstallCore",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1114",
          "name": "Email Collection",
          "display_name": "T1114 - Email Collection"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 51,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 105,
        "FileHash-SHA1": 100,
        "FileHash-SHA256": 3072,
        "domain": 1188,
        "email": 5,
        "URL": 7940,
        "hostname": 1925,
        "CVE": 1
      },
      "indicator_count": 14336,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 228,
      "modified_text": "850 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65551682899b039e02b8dc8a",
      "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
      "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
      "modified": "2023-12-15T18:02:25.356000",
      "created": "2023-11-15T19:05:38.437000",
      "tags": [
        "strong",
        "saal digital",
        "photo portal",
        "daten",
        "support",
        "saal",
        "bersicht",
        "informationen",
        "profis",
        "rabatte fr",
        "service",
        "heur",
        "malware",
        "cisco umbrella",
        "adware",
        "safe site",
        "malware site",
        "malicious site",
        "phishing site",
        "alexa top",
        "million",
        "tiggre",
        "presenoker",
        "agent",
        "opencandy",
        "conduit",
        "unsafe",
        "wacatac",
        "artemis",
        "phishing",
        "iframe",
        "installpack",
        "xrat",
        "fusioncore",
        "riskware",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "genkryptik",
        "exploit",
        "filetour",
        "cleaner",
        "webtoolbar",
        "trojanspy",
        "get fdm",
        "ms windows",
        "pe32",
        "intel",
        "search",
        "show",
        "united",
        "entries",
        "systemdrive",
        "program files",
        "installer",
        "write",
        "delphi",
        "next",
        "june",
        "win32",
        "copy",
        "pixel",
        "search live",
        "api blog",
        "docs pricing",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "follow",
        "value",
        "variables",
        "langpage string",
        "lang",
        "saalgroup",
        "creoletohtml",
        "chat",
        "reverse dns",
        "resource",
        "general full",
        "asn16509",
        "amazon02",
        "url https",
        "security tls",
        "protocol h2",
        "hash",
        "get h2",
        "main",
        "request chain",
        "http",
        "de redirected",
        "http redirect",
        "site",
        "malicious url",
        "blacklist https",
        "domain",
        "screenshot",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "amazons3",
        "aes128gcm",
        "amazon rsa",
        "aes256",
        "date",
        "name verdict",
        "pattern match",
        "root ca",
        "script",
        "done adding",
        "catalog file",
        "file",
        "indicator",
        "authority",
        "class",
        "mitre att",
        "meta",
        "unknown",
        "error",
        "hybrid",
        "accept",
        "general",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "refresh",
        "tools",
        "null",
        "body",
        "create c",
        "html document",
        "xport",
        "noname057",
        "generic malware",
        "generic",
        "dapato",
        "alexa",
        "installcore",
        "downloader",
        "dropper",
        "outbreak",
        "iobit",
        "mediaget",
        "azorult",
        "runescape",
        "facebook",
        "bank",
        "download",
        "live",
        "rms",
        "maltiverse",
        "cyber threat",
        "engineering",
        "services",
        "malicious host",
        "malicious",
        "team",
        "zeus",
        "nymaim",
        "zbot",
        "simda",
        "asyncrat",
        "cobalt strike",
        "ransomware",
        "matsnu",
        "cutwail",
        "citadel",
        "pykspa",
        "raccoon",
        "kronos",
        "ramnit",
        "redline stealer",
        "apple",
        "apple",
        "html info",
        "title saal",
        "meta tags",
        "trackers google",
        "tag manager",
        "gtm5wjlq2",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "self",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "hostname",
        "anonymizer",
        "firehol",
        "mail spammer",
        "team proxy",
        "kraken",
        "suppobox",
        "tofsee",
        "vawtrak",
        "hotmail",
        "netsky",
        "stealer",
        "blacknet rat",
        "remcos",
        "miner",
        "hacktool",
        "trojan",
        "detplock",
        "team phishing",
        "a nxdomain",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "urls",
        "files",
        "ip address",
        "all search",
        "otx octoseek",
        "files ip",
        "contacted",
        "whois record",
        "ssl certificate",
        "pe resource",
        "bundled",
        "attack",
        "parent",
        "historical ssl",
        "collections",
        "communicating",
        "emotet",
        "execution",
        "markmonitor inc",
        "vhash",
        "authentihash",
        "imphash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "archive",
        "valid",
        "serial number",
        "valid from",
        "valid usage",
        "code signing",
        "status status",
        "valid issuer",
        "assured id",
        "issuer issuer",
        "symantec sha256",
        "sections",
        "file type",
        "trid generic",
        "cil executable",
        "contained",
        "details module",
        "version id",
        "typelib id",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "sections name",
        "streams size",
        "entropy chi2",
        "guid",
        "blob",
        "namecheap",
        "ip detections",
        "country",
        "resolutions",
        "referrer",
        "whois whois",
        "threat roundup",
        "parent domain",
        "CVE-2023-22518",
        "CVE-2017-0143",
        "CVE-2017-0147",
        "CVE-2020-0601",
        "CVE-2017-8570",
        "CVE-2018-4893",
        "CVE-2017-11882",
        "CVE-2017-0199",
        "CVE-2014-3153",
        "W32.AIDetectNet.01",
        "trojan.adload/ursu",
        "targeting tsara brashears",
        "cybercrime",
        "privilege escalation",
        "defacement",
        "privilege abuse",
        "soc",
        "red team",
        "social engineering",
        "retaliation",
        "assault victim",
        "obsession"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
        "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
        "\u2193 Interesting \u2193",
        "owa.telegrafix.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
        "christ.robert@gmx.de",
        "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
        "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
        "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
        "BEELab_web_1.0.2-prerelease.exe",
        "AfraidZad.exe",
        "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
        "greycroftpartners.com",
        "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
        "trkpls3.com",
        "eg-monitoring.com",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "https://twitter.com/PORNO_SEXYBABES"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Italy",
        "Singapore",
        "France",
        "Germany",
        "Korea, Republic of"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "RMS",
          "display_name": "RMS",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 841,
        "FileHash-SHA1": 467,
        "FileHash-SHA256": 6370,
        "CVE": 9,
        "domain": 2160,
        "hostname": 3074,
        "email": 1,
        "URL": 6550,
        "SSLCertFingerprint": 1,
        "CIDR": 3
      },
      "indicator_count": 19476,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "857 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655516871038cbad9eae2bb7",
      "name": "Apple | iOS | Automated Attacks | Resource Hijacking | Google Tracker",
      "description": "Boot or Logon Autostart Execution\nCommand and Scripting Interpreter\nAutomated Collection\nWebToolbar \nAmazon rsa\nAmazon02\nAmazon S3\nPrivilege Abuse\nRetaliation",
      "modified": "2023-12-15T18:02:25.356000",
      "created": "2023-11-15T19:05:43.285000",
      "tags": [
        "strong",
        "saal digital",
        "photo portal",
        "daten",
        "support",
        "saal",
        "bersicht",
        "informationen",
        "profis",
        "rabatte fr",
        "service",
        "heur",
        "malware",
        "cisco umbrella",
        "adware",
        "safe site",
        "malware site",
        "malicious site",
        "phishing site",
        "alexa top",
        "million",
        "tiggre",
        "presenoker",
        "agent",
        "opencandy",
        "conduit",
        "unsafe",
        "wacatac",
        "artemis",
        "phishing",
        "iframe",
        "installpack",
        "xrat",
        "fusioncore",
        "riskware",
        "acint",
        "nircmd",
        "swrort",
        "downldr",
        "systweak",
        "behav",
        "crack",
        "genkryptik",
        "exploit",
        "filetour",
        "cleaner",
        "webtoolbar",
        "trojanspy",
        "get fdm",
        "ms windows",
        "pe32",
        "intel",
        "search",
        "show",
        "united",
        "entries",
        "systemdrive",
        "program files",
        "installer",
        "write",
        "delphi",
        "next",
        "june",
        "win32",
        "copy",
        "pixel",
        "search live",
        "api blog",
        "docs pricing",
        "november",
        "de indicators",
        "domains",
        "hashes",
        "copyright",
        "gmbh version",
        "follow",
        "value",
        "variables",
        "langpage string",
        "lang",
        "saalgroup",
        "creoletohtml",
        "chat",
        "reverse dns",
        "resource",
        "general full",
        "asn16509",
        "amazon02",
        "url https",
        "security tls",
        "protocol h2",
        "hash",
        "get h2",
        "main",
        "request chain",
        "http",
        "de redirected",
        "http redirect",
        "site",
        "malicious url",
        "blacklist https",
        "domain",
        "screenshot",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "amazons3",
        "aes128gcm",
        "amazon rsa",
        "aes256",
        "date",
        "name verdict",
        "pattern match",
        "root ca",
        "script",
        "done adding",
        "catalog file",
        "file",
        "indicator",
        "authority",
        "class",
        "mitre att",
        "meta",
        "unknown",
        "error",
        "hybrid",
        "accept",
        "general",
        "local",
        "click",
        "strings",
        "generator",
        "critical",
        "refresh",
        "tools",
        "null",
        "body",
        "create c",
        "html document",
        "xport",
        "noname057",
        "generic malware",
        "generic",
        "dapato",
        "alexa",
        "installcore",
        "downloader",
        "dropper",
        "outbreak",
        "iobit",
        "mediaget",
        "azorult",
        "runescape",
        "facebook",
        "bank",
        "download",
        "live",
        "rms",
        "maltiverse",
        "cyber threat",
        "engineering",
        "services",
        "malicious host",
        "malicious",
        "team",
        "zeus",
        "nymaim",
        "zbot",
        "simda",
        "asyncrat",
        "cobalt strike",
        "ransomware",
        "matsnu",
        "cutwail",
        "citadel",
        "pykspa",
        "raccoon",
        "kronos",
        "ramnit",
        "redline stealer",
        "apple",
        "apple",
        "html info",
        "title saal",
        "meta tags",
        "trackers google",
        "tag manager",
        "gtm5wjlq2",
        "http response",
        "final url",
        "serving ip",
        "address",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "headers",
        "self",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "hostname",
        "anonymizer",
        "firehol",
        "mail spammer",
        "team proxy",
        "kraken",
        "suppobox",
        "tofsee",
        "vawtrak",
        "hotmail",
        "netsky",
        "stealer",
        "blacknet rat",
        "remcos",
        "miner",
        "hacktool",
        "trojan",
        "detplock",
        "team phishing",
        "a nxdomain",
        "passive dns",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "urls",
        "files",
        "ip address",
        "all search",
        "otx octoseek",
        "files ip",
        "contacted",
        "whois record",
        "ssl certificate",
        "pe resource",
        "bundled",
        "attack",
        "parent",
        "historical ssl",
        "collections",
        "communicating",
        "emotet",
        "execution",
        "markmonitor inc",
        "vhash",
        "authentihash",
        "imphash",
        "ssdeep",
        "win32 exe",
        "magic pe32",
        "trid win32",
        "archive",
        "valid",
        "serial number",
        "valid from",
        "valid usage",
        "code signing",
        "status status",
        "valid issuer",
        "assured id",
        "issuer issuer",
        "symantec sha256",
        "sections",
        "file type",
        "trid generic",
        "cil executable",
        "contained",
        "details module",
        "version id",
        "typelib id",
        "header target",
        "machine intel",
        "utc entry",
        "point",
        "sections name",
        "streams size",
        "entropy chi2",
        "guid",
        "blob",
        "namecheap",
        "ip detections",
        "country",
        "resolutions",
        "referrer",
        "whois whois",
        "threat roundup",
        "parent domain",
        "CVE-2023-22518",
        "CVE-2017-0143",
        "CVE-2017-0147",
        "CVE-2020-0601",
        "CVE-2017-8570",
        "CVE-2018-4893",
        "CVE-2017-11882",
        "CVE-2017-0199",
        "CVE-2014-3153",
        "W32.AIDetectNet.01",
        "trojan.adload/ursu",
        "targeting tsara brashears",
        "cybercrime",
        "privilege escalation",
        "defacement",
        "privilege abuse",
        "soc",
        "red team",
        "social engineering",
        "retaliation",
        "assault victim",
        "obsession"
      ],
      "references": [
        "https://hybrid-analysis.com/sample/9e8ce8607b7f32f6f66c8126851a55818ff775ee060d2c448679e5eb1e22ba2a",
        "https://www.saal-digital.de/ordercockpit/?email=christ.robert@gmx.de&ordernumber=802109030129517",
        "\u2193 Interesting \u2193",
        "owa.telegrafix.com",
        "https://www.anyxxxtube.net/search-porn/tsara-brashears/     (Phishing)",
        "christ.robert@gmx.de",
        "https://simtk.org/projects/sv_tests   (Tsara Brashears project?)",
        "https://itunes.apple.com/de/app/saal-design-app/id1481631197?mt=8",
        "https://play.google.com/store/apps/details?id=com.saaldigital.designerapp.de&hl=de",
        "BEELab_web_1.0.2-prerelease.exe",
        "AfraidZad.exe",
        "https://mail.greycroft.com/owa/redir.aspx?SURL=a0oI1dvGGkFYUoACVEbN8REVrmfS6H0MhUvXdexgmertl7bBVhrTCGgAdAB0AHAAcwA6AC8ALwB3AHcAdwAuAHAAcgBvAGQAdQBjAHQAaAB1AG4AdAAuAGMAbwBtAC8AdABlAGMAaAAvAGEAbgBpAG0AYQB0AGkAYwA.&URL=https://www.producthunt.com/tech/animatic",
        "greycroftpartners.com",
        "http://videotubeplayer.com/?groupds=1&clientId=201&productId=1407&tracking=w5JJ46MKQI493DMO1NDNTQ6K&publisher_id=",
        "trkpls3.com",
        "eg-monitoring.com",
        "http://m.pornsexer.xxx.3.1.adiosfil.roksit.net/",
        "https://twitter.com/PORNO_SEXYBABES"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Netherlands",
        "Italy",
        "Singapore",
        "France",
        "Germany",
        "Korea, Republic of"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "Generic",
          "display_name": "Generic",
          "target": null
        },
        {
          "id": "RMS",
          "display_name": "RMS",
          "target": null
        },
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1003",
          "name": "OS Credential Dumping",
          "display_name": "T1003 - OS Credential Dumping"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "T1081",
          "name": "Credentials in Files",
          "display_name": "T1081 - Credentials in Files"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 841,
        "FileHash-SHA1": 467,
        "FileHash-SHA256": 6370,
        "CVE": 9,
        "domain": 2160,
        "hostname": 3074,
        "email": 1,
        "URL": 6550,
        "SSLCertFingerprint": 1,
        "CIDR": 3
      },
      "indicator_count": 19476,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "857 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://299233.myspreadshop.de/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://299233.myspreadshop.de/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776718245.6332915
}