{
  "type": "URL",
  "indicator": "https://action.aiseesoft.jp/itunes.php",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://action.aiseesoft.jp/itunes.php",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3777258899,
      "indicator": "https://action.aiseesoft.jp/itunes.php",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 7,
      "pulses": [
        {
          "id": "69ddeb45c45f6a3cd721397d",
          "name": "Active attacks  \u2022 Apple \u2022 Tulach",
          "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
          "modified": "2026-04-14T07:22:45.250000",
          "created": "2026-04-14T07:22:45.250000",
          "tags": [
            "url http",
            "ipv4",
            "indicator role",
            "active related",
            "united",
            "moved",
            "gmt content",
            "certificate",
            "all domain",
            "msie",
            "chrome",
            "extraction",
            "data upload",
            "twitter",
            "cookie",
            "extra",
            "include data",
            "review locs",
            "exclude",
            "suggested os",
            "onlv",
            "failed",
            "stop data",
            "read c",
            "unicode",
            "rgba",
            "memcommit",
            "delete",
            "dock",
            "write",
            "execution",
            "sc type",
            "extri",
            "include review",
            "exclude sugges",
            "typ data",
            "a domains",
            "present apr",
            "script urls",
            "files",
            "files ip",
            "address",
            "ios",
            "mac",
            "apple",
            "appleid",
            "itunes",
            "next associated",
            "all ipv4",
            "included ic",
            "uny teade",
            "type hostnar",
            "hostnar hostnar",
            "hostnar",
            "macair",
            "macairaustralia",
            "ipad",
            "ipod",
            "cryptexportkey",
            "invalid pointer",
            "cryptgenkey",
            "stream",
            "defender",
            "delphi",
            "class",
            "stack",
            "format",
            "unknown",
            "united states",
            "phishing",
            "password",
            "traffic redirected",
            "service mod",
            "service execution",
            "youtube",
            "music",
            "streams",
            "songs",
            "played songs",
            "music streams",
            "most played",
            "fonelab",
            "indicator",
            "included iocs",
            "manually add",
            "review ocs",
            "exclude inn",
            "sugges data",
            "find",
            "include",
            "url https",
            "enter sc",
            "type",
            "no matchme",
            "search otx",
            "https",
            "references x",
            "analyze",
            "open th",
            "url data",
            "se http",
            "no match",
            "excluded iocs",
            "iocs",
            "ip whitelisted",
            "whitelisted",
            "tcp include",
            "analysis date",
            "file score",
            "medium risk",
            "yara detections",
            "contacted",
            "related tags",
            "x vercel",
            "file type",
            "type indicator",
            "role title",
            "related pulses",
            "mulch virtua",
            "library loade",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugt",
            "samuel tulach",
            "unity engine",
            "tulach",
            "sa awareness",
            "sabey",
            "sar cut",
            "autofill",
            "includer review",
            "portiana oney",
            "targeting",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "spawns",
            "defense evasion",
            "t1480 execution",
            "musickit_1_.js",
            "lazarus",
            "injection",
            "CVE-2017-8570",
            "prefetch2",
            "target",
            "aaaa",
            "ip address",
            "record value",
            "emails",
            "samuel tuachs",
            "sapev",
            "review exclude",
            "monitored target",
            "script",
            "mitre att",
            "ascii text",
            "span",
            "path",
            "iframe",
            "april",
            "hybrid",
            "general",
            "local",
            "click",
            "strings",
            "body",
            "development att",
            "t1055.012 list planting",
            "active"
          ],
          "references": [
            "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
            "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
            "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
            "https://podcasts.apple.com/us/podcast/lazarus",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://help.aiseesoft.jp/blu-ray-player",
            "http://help.aiseesoft.jp/fonelab/",
            "https://action.aiseesoft.jp/itunes.php",
            "http://help.aiseesoft.jp/total-video-converter",
            "http://help.aiseesoft.jp/total-video-converter/",
            "http://help.aiseesoft.jp/video-converter-ultimate/",
            "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
            "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
            "http://test-firstmile.digitecgalaxus.ch",
            "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
            "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
            "cdn.rss.applemarketingtools.com",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "1.bing.com.cn",
            "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
            "www.phantomcameras.cn",
            "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
            "podcasts.apple.com \u2022 23.34.32.21",
            "www.apple.com \u2022 23.34.32.199",
            "js-cdn.music.apple.com \u2022 23.78.51.170",
            "http://firstmile.digitecgalaxus.ch",
            "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
            "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
            "Tulach.cc",
            "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
            "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
            "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
            "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
            "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
            "asp.net domain pointer",
            "developer.x.com",
            "aotx.alienvault.com (aotx.?)",
            "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
            "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1020.001",
              "name": "Traffic Duplication",
              "display_name": "T1020.001 - Traffic Duplication"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591.002",
              "name": "Business Relationships",
              "display_name": "T1591.002 - Business Relationships"
            },
            {
              "id": "T1591.001",
              "name": "Determine Physical Locations",
              "display_name": "T1591.001 - Determine Physical Locations"
            },
            {
              "id": "T1585.001",
              "name": "Social Media Accounts",
              "display_name": "T1585.001 - Social Media Accounts"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1189",
              "name": "Drive-by Compromise",
              "display_name": "T1189 - Drive-by Compromise"
            },
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "T1055.012",
              "name": "Process Hollowing",
              "display_name": "T1055.012 - Process Hollowing"
            },
            {
              "id": "T1432",
              "name": "Access Contact List",
              "display_name": "T1432 - Access Contact List"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1568.002",
              "name": "Domain Generation Algorithms",
              "display_name": "T1568.002 - Domain Generation Algorithms"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 0,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1029,
            "domain": 396,
            "email": 7,
            "URL": 2784,
            "FileHash-SHA256": 898,
            "FileHash-MD5": 79,
            "FileHash-SHA1": 68,
            "IPv4": 35,
            "CVE": 1,
            "SSLCertFingerprint": 13
          },
          "indicator_count": 5310,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "6 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d5ee5a7359a5e815a6a",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:18.712000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d73e96dd70037ed22a7",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:39.802000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 82,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d76b057b79aaf7ba4a7",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:40.239000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 84,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65401d8480e4a9ed725f6458",
          "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
          "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-30T21:17:56.820000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 83,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "654140bae73f795aa914e8de",
          "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-10-31T18:00:26.439000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "65401d73e96dd70037ed22a7",
          "export_count": 98,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6544cbbca7610e92e4262c47",
          "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Targeting",
          "description": "",
          "modified": "2023-11-29T14:03:31.663000",
          "created": "2023-11-03T10:30:20.965000",
          "tags": [
            "ssl certificate",
            "whois record",
            "contacted",
            "referrer",
            "communicating",
            "resolutions",
            "historical ssl",
            "whois whois",
            "http",
            "critical risk",
            "dark power",
            "cobalt strike",
            "malware",
            "core",
            "critical",
            "copy",
            "formbook",
            "submission",
            "sophos sophos",
            "xcitium verdict",
            "cloud xcitium",
            "verdict cloud",
            "history first",
            "analysis",
            "utc http",
            "response final",
            "url https",
            "march",
            "execution",
            "falcon sandbox",
            "pattern match",
            "changelog",
            "header",
            "layer",
            "data",
            "ipv4",
            "function",
            "file",
            "et tor",
            "known tor",
            "meta",
            "monitoring",
            "date",
            "body",
            "form",
            "august",
            "june",
            "friendly",
            "main",
            "footer",
            "unknown",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "generator",
            "error",
            "pe resource",
            "redline stealer",
            "april",
            "lockbit",
            "emotet",
            "hacktool",
            "apple",
            "tsara brashears",
            "tmobile",
            "pyinstaller",
            "password",
            "dns poisoning",
            "domains",
            "abuse",
            "kiannas law",
            "cyber security",
            "cisco umbrella",
            "site",
            "malware site",
            "malicious site",
            "safe site",
            "alexa top",
            "million",
            "phishing site",
            "team phishing",
            "exploit",
            "download",
            "unruy",
            "alexa",
            "riskware",
            "back",
            "azorult",
            "phishing",
            "service",
            "runescape",
            "facebook",
            "bank",
            "team",
            "cutwail",
            "adload",
            "maltiverse",
            "kryptik",
            "united",
            "cyber threat",
            "engineering",
            "bambernek",
            "strike",
            "zbot",
            "suppobox",
            "malicious",
            "ransomware",
            "virut",
            "bandoo",
            "matsnu",
            "iframe",
            "zeus",
            "agent",
            "steam",
            "nymaim",
            "citadel",
            "heur",
            "covid19",
            "simda",
            "artemis",
            "bradesco",
            "pony",
            "pykspa",
            "sodinokibi",
            "betabot",
            "virustotal",
            "tinba",
            "domaiq",
            "ave maria",
            "revil",
            "downloader",
            "tofsee",
            "vawtrak",
            "hotmail",
            "dnspionage",
            "nexus",
            "generic",
            "andromeda",
            "dropper",
            "crypt",
            "outbreak",
            "wacatac",
            "mimikatz",
            "trojanx",
            "astaroth",
            "keybase",
            "stealer",
            "radamant",
            "kovter",
            "unsafe",
            "win64",
            "conduit",
            "presenoker",
            "opencandy",
            "remcos",
            "miner",
            "agenttesla",
            "trojan",
            "detplock",
            "networm",
            "fusioncore",
            "acint",
            "installpack",
            "xtrat",
            "nircmd",
            "psexec",
            "occamy",
            "brontok",
            "zpevdo",
            "startpage",
            "nanocore",
            "keygen",
            "fareit",
            "secrisk",
            "fakealert",
            "filetour",
            "installcore",
            "floxif",
            "cleaner",
            "patcher",
            "kgs0",
            "kls0",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "urls",
            "detection list",
            "blacklist http",
            "samples",
            "blacklist"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "Kryptik",
              "display_name": "Kryptik",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1497",
              "name": "Virtualization/Sandbox Evasion",
              "display_name": "T1497 - Virtualization/Sandbox Evasion"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            },
            {
              "id": "T1496",
              "name": "Resource Hijacking",
              "display_name": "T1496 - Resource Hijacking"
            }
          ],
          "industries": [
            "Health"
          ],
          "TLP": "green",
          "cloned_from": "654140bae73f795aa914e8de",
          "export_count": 108,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 518,
            "FileHash-SHA1": 507,
            "FileHash-SHA256": 10945,
            "URL": 19764,
            "domain": 5110,
            "hostname": 8668,
            "CIDR": 2,
            "CVE": 24
          },
          "indicator_count": 45538,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "872 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "http://help.aiseesoft.jp/total-video-converter/",
        "cdn.rss.applemarketingtools.com",
        "http://firstmile.digitecgalaxus.ch",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "www.phantomcameras.cn",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "http://test-firstmile.digitecgalaxus.ch",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://help.aiseesoft.jp/total-video-converter",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "http://help.aiseesoft.jp/fonelab/",
        "podcasts.apple.com \u2022 23.34.32.21",
        "https://action.aiseesoft.jp/itunes.php",
        "1.bing.com.cn",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "www.apple.com \u2022 23.34.32.199",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/blu-ray-player",
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "asp.net domain pointer",
        "Tulach.cc",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "aotx.alienvault.com (aotx.?)",
        "developer.x.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Kryptik",
            "Maltiverse"
          ],
          "industries": [
            "Health"
          ],
          "unique_indicators": 51427
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/aiseesoft.jp",
    "whois": "http://whois.domaintools.com/aiseesoft.jp",
    "domain": "aiseesoft.jp",
    "hostname": "action.aiseesoft.jp"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 7,
  "pulses": [
    {
      "id": "69ddeb45c45f6a3cd721397d",
      "name": "Active attacks  \u2022 Apple \u2022 Tulach",
      "description": "Including 360+ Apple\nIoC\u2019s from Malicious Tulac.cc + Virtual Servers Pulses. Ongoing history of malicious attacks, custom malware engineer, malicious media , account control. \n\nI was blocked from VirusToltal. It was Tulach Nextcloud posse. What I am doing now s legal. \n\nReferenced below. URL: \"https://accountapple.com/\" contacted related malicious domain: \"accountapple.com\"\nCONTACTED DOMAIN: \"sqllq.com\" has been identified as malicious",
      "modified": "2026-04-14T07:22:45.250000",
      "created": "2026-04-14T07:22:45.250000",
      "tags": [
        "url http",
        "ipv4",
        "indicator role",
        "active related",
        "united",
        "moved",
        "gmt content",
        "certificate",
        "all domain",
        "msie",
        "chrome",
        "extraction",
        "data upload",
        "twitter",
        "cookie",
        "extra",
        "include data",
        "review locs",
        "exclude",
        "suggested os",
        "onlv",
        "failed",
        "stop data",
        "read c",
        "unicode",
        "rgba",
        "memcommit",
        "delete",
        "dock",
        "write",
        "execution",
        "sc type",
        "extri",
        "include review",
        "exclude sugges",
        "typ data",
        "a domains",
        "present apr",
        "script urls",
        "files",
        "files ip",
        "address",
        "ios",
        "mac",
        "apple",
        "appleid",
        "itunes",
        "next associated",
        "all ipv4",
        "included ic",
        "uny teade",
        "type hostnar",
        "hostnar hostnar",
        "hostnar",
        "macair",
        "macairaustralia",
        "ipad",
        "ipod",
        "cryptexportkey",
        "invalid pointer",
        "cryptgenkey",
        "stream",
        "defender",
        "delphi",
        "class",
        "stack",
        "format",
        "unknown",
        "united states",
        "phishing",
        "password",
        "traffic redirected",
        "service mod",
        "service execution",
        "youtube",
        "music",
        "streams",
        "songs",
        "played songs",
        "music streams",
        "most played",
        "fonelab",
        "indicator",
        "included iocs",
        "manually add",
        "review ocs",
        "exclude inn",
        "sugges data",
        "find",
        "include",
        "url https",
        "enter sc",
        "type",
        "no matchme",
        "search otx",
        "https",
        "references x",
        "analyze",
        "open th",
        "url data",
        "se http",
        "no match",
        "excluded iocs",
        "iocs",
        "ip whitelisted",
        "whitelisted",
        "tcp include",
        "analysis date",
        "file score",
        "medium risk",
        "yara detections",
        "contacted",
        "related tags",
        "x vercel",
        "file type",
        "type indicator",
        "role title",
        "related pulses",
        "mulch virtua",
        "library loade",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugt",
        "samuel tulach",
        "unity engine",
        "tulach",
        "sa awareness",
        "sabey",
        "sar cut",
        "autofill",
        "includer review",
        "portiana oney",
        "targeting",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "spawns",
        "defense evasion",
        "t1480 execution",
        "musickit_1_.js",
        "lazarus",
        "injection",
        "CVE-2017-8570",
        "prefetch2",
        "target",
        "aaaa",
        "ip address",
        "record value",
        "emails",
        "samuel tuachs",
        "sapev",
        "review exclude",
        "monitored target",
        "script",
        "mitre att",
        "ascii text",
        "span",
        "path",
        "iframe",
        "april",
        "hybrid",
        "general",
        "local",
        "click",
        "strings",
        "body",
        "development att",
        "t1055.012 list planting",
        "active"
      ],
      "references": [
        "https://trade.kraken.com/charts/KRAKEN:APT-USD>+y",
        "https://kraken.com/\\\\r\\\\nSet-Cookie:\t\u2022 https://www.kraken-okta.com/",
        "https://account.apple.com/accept-encoding \u2022 http://apple.santandercustomerusa.com/",
        "https://podcasts.apple.com/us/podcast/lazarus",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://help.aiseesoft.jp/blu-ray-player",
        "http://help.aiseesoft.jp/fonelab/",
        "https://action.aiseesoft.jp/itunes.php",
        "http://help.aiseesoft.jp/total-video-converter",
        "http://help.aiseesoft.jp/total-video-converter/",
        "http://help.aiseesoft.jp/video-converter-ultimate/",
        "http://mli.digitecgalaxus.ch http://test-id.digitecgalaxus.ch/",
        "http://sf.digitecgalaxus.ch  http://static.digitecgalaxus.ch",
        "http://test-firstmile.digitecgalaxus.ch",
        "https://druryhotels.kiosoft.com/auth/reset_password/50032174/1/YjM2Y2UyY2VlNmVlOGI0NjZmNmFkZTNhYzBjNGVhNmVlZWQwODZjMDU0Yjg5YWZlZmRlM2RjMDUyNWYyZTRiMGRkNDM1ZjllZDNjYTA4YWJkMDhkMDQxNTEwNjY0YWQ2NTYwM2MzOWFhYTI5NTJiY2UzNzkyYWM2NWJkMzJlYmRCd2c5bjNicFBJRkhRS3dKU0JOREJEMXNjTTlOa0t1K0tlUkd2OEVKUUxUN0g1SlFzc1NoaUVKZ0NFM2YvekVIM29yTGZCTWJHaDBsOE9uL0phNHhwUT09/",
        "No matchine recorde f\u0627\u0648\u0635\u064a\u0647[?]",
        "cdn.rss.applemarketingtools.com",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "1.bing.com.cn",
        "www.akopde.dns-dynamic.net  Hostname www.est.net.google.com.bing.com.yahoo.com.pubgmobile.dns-dynamic.net  Hostname www.jhoexii.dns-dynamic.net",
        "www.phantomcameras.cn",
        "https://podcasts.apple.com/us/podcast/lazarus-rising-with-misha-collins-s4ep1/id1605385289?i=1000614835179\"",
        "podcasts.apple.com \u2022 23.34.32.21",
        "www.apple.com \u2022 23.34.32.199",
        "js-cdn.music.apple.com \u2022 23.78.51.170",
        "http://firstmile.digitecgalaxus.ch",
        "Tulach Virtual Servers https://otx.alienvault.com/pulse/69d9b0e549af1aae2975ebeb",
        "Library Loader \u2022 Tulach https://otx.alienvault.com/pulse/69d8a665177b8f64c7ce5fca",
        "Tulach.cc",
        "https://www.youtube.com/youtubei/v1/log_event?alt=json&key=AIzaSyAO_FJ2SlqU8Q4STEHLGCilw_Y9_11qcW8",
        "www.youtube.com/watch?v=GyuMozsVyYs  (targets song / channel be controlled by Tulach) \u2018song about SA awareness\u2019",
        "https://rss.applemarketingtools.com/api/v2/jp/music/most-played/100/songs.json",
        "https://x.com/Atlassian__;JS8!!J7H9jp7aFkU!OInVM0IrDSAR1lXf8KzR9vKsmEOVrBkg1M6QqughgO13mcAOawaxDaclQnhkyp3JvPbgCZX33l1xnRdvb4OxVqJcCz2cn9HcSw x.com \u2022 https://x.com/BastionMediaFR/status/2042194819397673290 cdn777.pussyporn.pro \u2022 https://tubepornstars.co/ \u2022 porneramix.xyz porneramix.xyz \u2022 porntubner.online \u2022 pornhubhd.shop https://api.w.org/ \u2022 api.w.org remote.poc-2.com \u2022 https://otx.alienvault.com/indicator/url/https://tulach.cc/assets/img/ogp.png https://assets.msn.com/bundles/v1/edgeChromium/latest/svg-as",
        "Samuel Tulach\u2019s assets connected to M. Brian Sabey, Esq + malicious media + quasi government + State & DGA domains",
        "asp.net domain pointer",
        "developer.x.com",
        "aotx.alienvault.com (aotx.?)",
        "https://otx.alienvault.com/indicator/url/http://asp.net/ApplicationServices/v200/AuthenticationService/LogoutResponseh",
        "https://hybrid-analysis.com/sample/3257a36fae4c3bd3c47b1c37604ff3e30ff75fffd4c07bc52bcfe3ecb189371f"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1035",
          "name": "Service Execution",
          "display_name": "T1035 - Service Execution"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1020.001",
          "name": "Traffic Duplication",
          "display_name": "T1020.001 - Traffic Duplication"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591.002",
          "name": "Business Relationships",
          "display_name": "T1591.002 - Business Relationships"
        },
        {
          "id": "T1591.001",
          "name": "Determine Physical Locations",
          "display_name": "T1591.001 - Determine Physical Locations"
        },
        {
          "id": "T1585.001",
          "name": "Social Media Accounts",
          "display_name": "T1585.001 - Social Media Accounts"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1189",
          "name": "Drive-by Compromise",
          "display_name": "T1189 - Drive-by Compromise"
        },
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "T1055.012",
          "name": "Process Hollowing",
          "display_name": "T1055.012 - Process Hollowing"
        },
        {
          "id": "T1432",
          "name": "Access Contact List",
          "display_name": "T1432 - Access Contact List"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1568.002",
          "name": "Domain Generation Algorithms",
          "display_name": "T1568.002 - Domain Generation Algorithms"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 0,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1029,
        "domain": 396,
        "email": 7,
        "URL": 2784,
        "FileHash-SHA256": 898,
        "FileHash-MD5": 79,
        "FileHash-SHA1": 68,
        "IPv4": 35,
        "CVE": 1,
        "SSLCertFingerprint": 13
      },
      "indicator_count": 5310,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "6 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65401d5ee5a7359a5e815a6a",
      "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
      "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-30T21:17:18.712000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "872 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65401d73e96dd70037ed22a7",
      "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
      "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-30T21:17:39.802000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 82,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "872 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65401d76b057b79aaf7ba4a7",
      "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
      "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-30T21:17:40.239000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 84,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "872 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65401d8480e4a9ed725f6458",
      "name": "Darkside 2020 Ecosystem  .BEware | BGP.tools | Target Tsara Brashears",
      "description": "I don't want to be dramatic but...Main source of cyber attacks. Includes - governmentattic.org, tulach.cc, malvertizing, monitoring. remote attacks, endangered Tsara Brashears attack, BotNet, CNC, telephone service, Apple hacking. https://bgp.tools/prefix/167.203.96.0, adult content, moo.com, afraid.org.  I'm assuming accessed by attorneys and insurance companies to silence people forever. Death references. I can't verify if government complicity is accurate or spoofed. Stranger was owned by American International Group, found in an STSH domain (AIG.com). Last night Ben Cartwright became the sole owner of  domain after being a verified AIG domain. Terrifying.  Looks like the main target is the same.  Tsara Brashears. \nFound in an attack against a device 'malicious sorry index' that caused research effort. \n[auto populated: BGP.TOOLS - bgp.tools - has published its full list of historical records for BGP, which are based on its current IP address address and routing system (PGP).]",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-30T21:17:56.820000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 83,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "872 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "654140bae73f795aa914e8de",
      "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Target Tsara Brashears",
      "description": "",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-10-31T18:00:26.439000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": "65401d73e96dd70037ed22a7",
      "export_count": 98,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "872 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6544cbbca7610e92e4262c47",
      "name": "Darkside 2020 Ecosystem .BEware | BGP.tools | Targeting",
      "description": "",
      "modified": "2023-11-29T14:03:31.663000",
      "created": "2023-11-03T10:30:20.965000",
      "tags": [
        "ssl certificate",
        "whois record",
        "contacted",
        "referrer",
        "communicating",
        "resolutions",
        "historical ssl",
        "whois whois",
        "http",
        "critical risk",
        "dark power",
        "cobalt strike",
        "malware",
        "core",
        "critical",
        "copy",
        "formbook",
        "submission",
        "sophos sophos",
        "xcitium verdict",
        "cloud xcitium",
        "verdict cloud",
        "history first",
        "analysis",
        "utc http",
        "response final",
        "url https",
        "march",
        "execution",
        "falcon sandbox",
        "pattern match",
        "changelog",
        "header",
        "layer",
        "data",
        "ipv4",
        "function",
        "file",
        "et tor",
        "known tor",
        "meta",
        "monitoring",
        "date",
        "body",
        "form",
        "august",
        "june",
        "friendly",
        "main",
        "footer",
        "unknown",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "generator",
        "error",
        "pe resource",
        "redline stealer",
        "april",
        "lockbit",
        "emotet",
        "hacktool",
        "apple",
        "tsara brashears",
        "tmobile",
        "pyinstaller",
        "password",
        "dns poisoning",
        "domains",
        "abuse",
        "kiannas law",
        "cyber security",
        "cisco umbrella",
        "site",
        "malware site",
        "malicious site",
        "safe site",
        "alexa top",
        "million",
        "phishing site",
        "team phishing",
        "exploit",
        "download",
        "unruy",
        "alexa",
        "riskware",
        "back",
        "azorult",
        "phishing",
        "service",
        "runescape",
        "facebook",
        "bank",
        "team",
        "cutwail",
        "adload",
        "maltiverse",
        "kryptik",
        "united",
        "cyber threat",
        "engineering",
        "bambernek",
        "strike",
        "zbot",
        "suppobox",
        "malicious",
        "ransomware",
        "virut",
        "bandoo",
        "matsnu",
        "iframe",
        "zeus",
        "agent",
        "steam",
        "nymaim",
        "citadel",
        "heur",
        "covid19",
        "simda",
        "artemis",
        "bradesco",
        "pony",
        "pykspa",
        "sodinokibi",
        "betabot",
        "virustotal",
        "tinba",
        "domaiq",
        "ave maria",
        "revil",
        "downloader",
        "tofsee",
        "vawtrak",
        "hotmail",
        "dnspionage",
        "nexus",
        "generic",
        "andromeda",
        "dropper",
        "crypt",
        "outbreak",
        "wacatac",
        "mimikatz",
        "trojanx",
        "astaroth",
        "keybase",
        "stealer",
        "radamant",
        "kovter",
        "unsafe",
        "win64",
        "conduit",
        "presenoker",
        "opencandy",
        "remcos",
        "miner",
        "agenttesla",
        "trojan",
        "detplock",
        "networm",
        "fusioncore",
        "acint",
        "installpack",
        "xtrat",
        "nircmd",
        "psexec",
        "occamy",
        "brontok",
        "zpevdo",
        "startpage",
        "nanocore",
        "keygen",
        "fareit",
        "secrisk",
        "fakealert",
        "filetour",
        "installcore",
        "floxif",
        "cleaner",
        "patcher",
        "kgs0",
        "kls0",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "urls",
        "detection list",
        "blacklist http",
        "samples",
        "blacklist"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "Kryptik",
          "display_name": "Kryptik",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1497",
          "name": "Virtualization/Sandbox Evasion",
          "display_name": "T1497 - Virtualization/Sandbox Evasion"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        },
        {
          "id": "T1496",
          "name": "Resource Hijacking",
          "display_name": "T1496 - Resource Hijacking"
        }
      ],
      "industries": [
        "Health"
      ],
      "TLP": "green",
      "cloned_from": "654140bae73f795aa914e8de",
      "export_count": 108,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 518,
        "FileHash-SHA1": 507,
        "FileHash-SHA256": 10945,
        "URL": 19764,
        "domain": 5110,
        "hostname": 8668,
        "CIDR": 2,
        "CVE": 24
      },
      "indicator_count": 45538,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "872 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://action.aiseesoft.jp/itunes.php",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://action.aiseesoft.jp/itunes.php",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776681779.68426
}