{
  "type": "URL",
  "indicator": "https://admin.arivs.com/user_session/new",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://admin.arivs.com/user_session/new",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4156789561,
      "indicator": "https://admin.arivs.com/user_session/new",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 2,
      "pulses": [
        {
          "id": "6939d93da11a7d2bf7535ef1",
          "name": "Tesla Hackers Log In | Disqus",
          "description": "I\u2019m not for certain when blog \u2018https://pickyhot.disqus.com/tsara-brashears\u2019 first appeared online. It was present in 2016 -2021.  It was a porn spewing blog that obviously was full of tools. The lot pics debated targets race , beauty and other silly things. I don\u2019t know if target ever clicked on links. Tesla Hackers have played a major role in attacks against target. I haven\u2019t sifted through all malware yet. \n\n\n - Elon Musk - When Brashears suffered attempted hit on roadway she described suspect as an Elon Musk type, possible, offspring, or someone closely tied to him.",
          "modified": "2026-01-09T19:02:12.608000",
          "created": "2025-12-10T20:34:05.903000",
          "tags": [
            "disqus",
            "disqus.com",
            "comments",
            "blog",
            "blogs",
            "discussion",
            "google facebook",
            "twitter",
            "microsoft apple",
            "email",
            "forgot password",
            "login",
            "sign",
            "general full",
            "url https",
            "security tls",
            "united",
            "asn54113",
            "fastly",
            "reverse dns",
            "resource",
            "hash",
            "flag",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "domain address",
            "contacted hosts",
            "ck id",
            "show technique",
            "mitre att",
            "ck matrix",
            "pattern match",
            "ascii text",
            "network traffic",
            "t1057",
            "path",
            "learn",
            "command",
            "suspicious",
            "informative",
            "name tactics",
            "spawns",
            "t1480 execution",
            "signing defense",
            "file defense",
            "read c",
            "tlsv1",
            "search",
            "jfif",
            "ijg jpeg",
            "tls handshake",
            "failure",
            "show",
            "port",
            "execution",
            "next",
            "dock",
            "write",
            "persistence",
            "malware",
            "unknown",
            "waymo",
            "tesla",
            "musk",
            "austin",
            "bay area",
            "tesla ceo",
            "elon musk",
            "wednesday",
            "safety monitor",
            "synacktiv",
            "aaaa",
            "present jul",
            "status",
            "asnone country",
            "as13335",
            "present sep",
            "present apr",
            "present dec",
            "present jun",
            "lte all",
            "search otx",
            "additionally",
            "enter source",
            "url or",
            "data upload",
            "extraction",
            "entries",
            "present may",
            "dynamicloader",
            "as15169",
            "medium",
            "write c",
            "odigicert inc",
            "windows",
            "as54113",
            "worm",
            "copy",
            "explorer",
            "encrypt",
            "target tsraa brashears"
          ],
          "references": [
            "http://pickyhot.disqus.com/",
            "https://www.teslarati.com/tesla-hackers",
            "https://pickyhot.disqus.com/tsara-brashears",
            "All tags auto populated including\u2019 Elon Musk\u2019",
            "Running webserver Running WordPress Running Drupal",
            "bulletproof.palantirapollo.com \u2022 vpn-etuleusj2dpr.palantirclou",
            "https://publicsector.google/404-page-not-found/\t \u2022 www.founderstack.pro \u2022 oedfoundation.org",
            "https://www.founderstack.pro/feedhive \u2022 https://coinbase.getro.com/companies/astar-foundation \u2022 founders-vision.com",
            "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
            "www.endgame.com",
            "://blog.endgamesystems.com/ \u2022 http://httpswww.endgamesystems.com\t URL\thttp://wg41xm05b3.endgamesystems.com",
            "https://www.endgames.us \u2022 https://www.endgames.us/",
            "wg41xm05b3.endgamesystems.com\t\u2022 http://blog.endgamesystems.com",
            "https://httpswww.endgamesystems.com\t\u2022 https://wg41xm05b3.endgamesystems.com",
            "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com",
            "https://blog.endgamesystems.com/\t\u2022 https://blog.endgamesystems.com",
            "http://www.endgamesystems.com/",
            "http://wg41xm05b3.endgamesystems.com/",
            "http://www.endgamesystems.com/",
            "Requires further research"
          ],
          "public": 1,
          "adversary": "Tesla Hackers",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Synacktiv",
              "display_name": "Synacktiv",
              "target": null
            },
            {
              "id": "Tesla Hackers",
              "display_name": "Tesla Hackers",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "Mofksys",
              "display_name": "Mofksys",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1095",
              "name": "Non-Application Layer Protocol",
              "display_name": "T1095 - Non-Application Layer Protocol"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2523,
            "URL": 6583,
            "FileHash-SHA256": 1132,
            "domain": 1483,
            "FileHash-SHA1": 43,
            "SSLCertFingerprint": 17,
            "FileHash-MD5": 109,
            "email": 2
          },
          "indicator_count": 11892,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "99 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692f04e9fa3d782118e94aac",
          "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
          "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
          "modified": "2026-01-01T15:04:20.907000",
          "created": "2025-12-02T15:25:29.158000",
          "tags": [
            "levelblue",
            "open threat",
            "dynamicloader",
            "tlsv1",
            "high",
            "msie",
            "windows nt",
            "delete c",
            "fwlink",
            "stream",
            "powershell",
            "write",
            "malware",
            "local",
            "united",
            "flag",
            "date",
            "server",
            "crazy egg",
            "name server",
            "gmt flag",
            "domain address",
            "markmonitor",
            "enom",
            "sugges",
            "onv incude",
            "data upload",
            "find s",
            "extraction",
            "types",
            "type",
            "indicator",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "dns requests",
            "contacted hosts",
            "search",
            "entries",
            "read c",
            "medium",
            "memcommit",
            "tls handshake",
            "failure",
            "module load",
            "next",
            "execution",
            "dock",
            "capture",
            "persistence",
            "copy",
            "unknown",
            "suricata alert",
            "et info",
            "bad traffic",
            "learn",
            "command",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "t1480 execution",
            "file defense",
            "write c",
            "x02x82",
            "xe6x15c6",
            "x16f",
            "xc0xc0xc0",
            "revengerat",
            "guard",
            "service",
            "encrypt",
            "entries yara",
            "delphi",
            "win32",
            "jordan",
            "delete app"
          ],
          "references": [
            "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
            "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
            "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
            "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Malware.Vmprotect-9880726-0",
              "display_name": "Win.Malware.Vmprotect-9880726-0",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1112",
              "name": "Modify Registry",
              "display_name": "T1112 - Modify Registry"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1134",
              "name": "Access Token Manipulation",
              "display_name": "T1134 - Access Token Manipulation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            }
          ],
          "industries": [
            "Technology",
            "Legal"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 5,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4624,
            "FileHash-SHA256": 2021,
            "FileHash-MD5": 51,
            "FileHash-SHA1": 20,
            "SSLCertFingerprint": 10,
            "hostname": 1433,
            "domain": 728
          },
          "indicator_count": 8887,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "http://www.endgamesystems.com/",
        "Running webserver Running WordPress Running Drupal",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "https://pickyhot.disqus.com/tsara-brashears",
        "https://blog.endgamesystems.com/\t\u2022 https://blog.endgamesystems.com",
        "://blog.endgamesystems.com/ \u2022 http://httpswww.endgamesystems.com\t URL\thttp://wg41xm05b3.endgamesystems.com",
        "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "https://publicsector.google/404-page-not-found/\t \u2022 www.founderstack.pro \u2022 oedfoundation.org",
        "https://www.teslarati.com/tesla-hackers",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev",
        "http://pickyhot.disqus.com/",
        "All tags auto populated including\u2019 Elon Musk\u2019",
        "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com",
        "Requires further research",
        "https://www.endgames.us \u2022 https://www.endgames.us/",
        "https://www.founderstack.pro/feedhive \u2022 https://coinbase.getro.com/companies/astar-foundation \u2022 founders-vision.com",
        "https://httpswww.endgamesystems.com\t\u2022 https://wg41xm05b3.endgamesystems.com",
        "bulletproof.palantirapollo.com \u2022 vpn-etuleusj2dpr.palantirclou",
        "wg41xm05b3.endgamesystems.com\t\u2022 http://blog.endgamesystems.com",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "http://wg41xm05b3.endgamesystems.com/",
        "www.endgame.com"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "Tesla Hackers"
          ],
          "malware_families": [
            "Synacktiv",
            "Mofksys",
            "Tesla hackers",
            "Win.malware.vmprotect-9880726-0",
            "Other malware"
          ],
          "industries": [
            "Legal",
            "Technology"
          ],
          "unique_indicators": 20419
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/arivs.com",
    "whois": "http://whois.domaintools.com/arivs.com",
    "domain": "arivs.com",
    "hostname": "admin.arivs.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 2,
  "pulses": [
    {
      "id": "6939d93da11a7d2bf7535ef1",
      "name": "Tesla Hackers Log In | Disqus",
      "description": "I\u2019m not for certain when blog \u2018https://pickyhot.disqus.com/tsara-brashears\u2019 first appeared online. It was present in 2016 -2021.  It was a porn spewing blog that obviously was full of tools. The lot pics debated targets race , beauty and other silly things. I don\u2019t know if target ever clicked on links. Tesla Hackers have played a major role in attacks against target. I haven\u2019t sifted through all malware yet. \n\n\n - Elon Musk - When Brashears suffered attempted hit on roadway she described suspect as an Elon Musk type, possible, offspring, or someone closely tied to him.",
      "modified": "2026-01-09T19:02:12.608000",
      "created": "2025-12-10T20:34:05.903000",
      "tags": [
        "disqus",
        "disqus.com",
        "comments",
        "blog",
        "blogs",
        "discussion",
        "google facebook",
        "twitter",
        "microsoft apple",
        "email",
        "forgot password",
        "login",
        "sign",
        "general full",
        "url https",
        "security tls",
        "united",
        "asn54113",
        "fastly",
        "reverse dns",
        "resource",
        "hash",
        "flag",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "domain address",
        "contacted hosts",
        "ck id",
        "show technique",
        "mitre att",
        "ck matrix",
        "pattern match",
        "ascii text",
        "network traffic",
        "t1057",
        "path",
        "learn",
        "command",
        "suspicious",
        "informative",
        "name tactics",
        "spawns",
        "t1480 execution",
        "signing defense",
        "file defense",
        "read c",
        "tlsv1",
        "search",
        "jfif",
        "ijg jpeg",
        "tls handshake",
        "failure",
        "show",
        "port",
        "execution",
        "next",
        "dock",
        "write",
        "persistence",
        "malware",
        "unknown",
        "waymo",
        "tesla",
        "musk",
        "austin",
        "bay area",
        "tesla ceo",
        "elon musk",
        "wednesday",
        "safety monitor",
        "synacktiv",
        "aaaa",
        "present jul",
        "status",
        "asnone country",
        "as13335",
        "present sep",
        "present apr",
        "present dec",
        "present jun",
        "lte all",
        "search otx",
        "additionally",
        "enter source",
        "url or",
        "data upload",
        "extraction",
        "entries",
        "present may",
        "dynamicloader",
        "as15169",
        "medium",
        "write c",
        "odigicert inc",
        "windows",
        "as54113",
        "worm",
        "copy",
        "explorer",
        "encrypt",
        "target tsraa brashears"
      ],
      "references": [
        "http://pickyhot.disqus.com/",
        "https://www.teslarati.com/tesla-hackers",
        "https://pickyhot.disqus.com/tsara-brashears",
        "All tags auto populated including\u2019 Elon Musk\u2019",
        "Running webserver Running WordPress Running Drupal",
        "bulletproof.palantirapollo.com \u2022 vpn-etuleusj2dpr.palantirclou",
        "https://publicsector.google/404-page-not-found/\t \u2022 www.founderstack.pro \u2022 oedfoundation.org",
        "https://www.founderstack.pro/feedhive \u2022 https://coinbase.getro.com/companies/astar-foundation \u2022 founders-vision.com",
        "www.endgame.com/blog/technical-blog/ten-process-injection-techniques-technical-survey-common-and-trending-process",
        "www.endgame.com",
        "://blog.endgamesystems.com/ \u2022 http://httpswww.endgamesystems.com\t URL\thttp://wg41xm05b3.endgamesystems.com",
        "https://www.endgames.us \u2022 https://www.endgames.us/",
        "wg41xm05b3.endgamesystems.com\t\u2022 http://blog.endgamesystems.com",
        "https://httpswww.endgamesystems.com\t\u2022 https://wg41xm05b3.endgamesystems.com",
        "https://wg41xm05b3.endgamesystems.com/ \u2022 https://www.endgamesystems.com",
        "https://blog.endgamesystems.com/\t\u2022 https://blog.endgamesystems.com",
        "http://www.endgamesystems.com/",
        "http://wg41xm05b3.endgamesystems.com/",
        "http://www.endgamesystems.com/",
        "Requires further research"
      ],
      "public": 1,
      "adversary": "Tesla Hackers",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Synacktiv",
          "display_name": "Synacktiv",
          "target": null
        },
        {
          "id": "Tesla Hackers",
          "display_name": "Tesla Hackers",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "Mofksys",
          "display_name": "Mofksys",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1095",
          "name": "Non-Application Layer Protocol",
          "display_name": "T1095 - Non-Application Layer Protocol"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2523,
        "URL": 6583,
        "FileHash-SHA256": 1132,
        "domain": 1483,
        "FileHash-SHA1": 43,
        "SSLCertFingerprint": 17,
        "FileHash-MD5": 109,
        "email": 2
      },
      "indicator_count": 11892,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "99 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692f04e9fa3d782118e94aac",
      "name": "LevelBlue - Open Threat Exchange - Delete AppDeployed",
      "description": "I\u2019m not sure what to think. |\ndeploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev | Are these\npulses being sold or attacked? Christopher P. Ahmann of TAM Legal and his other firms has ALWAYS attacked targets phones and networks. Nothing is too outrageous for this maniac.\n\nHe is responsible for the recent attacks on devices , clouds , google accounts and a flurry of threats. Indicators in recently pulsed reports have been removed. I\u2019ve done my best to restore. \n\nI am also concerned about the safety or legitimacy of this platform.\n\nNo one is ever alerted. Simply calling someone and telling them about the compromises can equate to a big pay day for Level Blue and nothing for the victims of attacks. I need my pulses restored. \n\nIt\u2019s plausible to believe OTX was attacked by an external threat actor.\nAnything is possible when it comes to money.",
      "modified": "2026-01-01T15:04:20.907000",
      "created": "2025-12-02T15:25:29.158000",
      "tags": [
        "levelblue",
        "open threat",
        "dynamicloader",
        "tlsv1",
        "high",
        "msie",
        "windows nt",
        "delete c",
        "fwlink",
        "stream",
        "powershell",
        "write",
        "malware",
        "local",
        "united",
        "flag",
        "date",
        "server",
        "crazy egg",
        "name server",
        "gmt flag",
        "domain address",
        "markmonitor",
        "enom",
        "sugges",
        "onv incude",
        "data upload",
        "find s",
        "extraction",
        "types",
        "type",
        "indicator",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "dns requests",
        "contacted hosts",
        "search",
        "entries",
        "read c",
        "medium",
        "memcommit",
        "tls handshake",
        "failure",
        "module load",
        "next",
        "execution",
        "dock",
        "capture",
        "persistence",
        "copy",
        "unknown",
        "suricata alert",
        "et info",
        "bad traffic",
        "learn",
        "command",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "t1480 execution",
        "file defense",
        "write c",
        "x02x82",
        "xe6x15c6",
        "x16f",
        "xc0xc0xc0",
        "revengerat",
        "guard",
        "service",
        "encrypt",
        "entries yara",
        "delphi",
        "win32",
        "jordan",
        "delete app"
      ],
      "references": [
        "https://otx.alienvault.com/indicator/domain/Tamlegal.com",
        "DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform Eziriz",
        "endgames.com \u2022 endgames.us \u2022 endgamesystems.com  \u2022 http://www.onyx-ware.com/lander",
        "deploy-delete-app-us-east-2-1.deploy-delete-test-us-east-2-1mtsufd.us-east-2.gamma.forgeapps.ec2.aws.dev"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Malware.Vmprotect-9880726-0",
          "display_name": "Win.Malware.Vmprotect-9880726-0",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1112",
          "name": "Modify Registry",
          "display_name": "T1112 - Modify Registry"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1134",
          "name": "Access Token Manipulation",
          "display_name": "T1134 - Access Token Manipulation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        }
      ],
      "industries": [
        "Technology",
        "Legal"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 5,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4624,
        "FileHash-SHA256": 2021,
        "FileHash-MD5": 51,
        "FileHash-SHA1": 20,
        "SSLCertFingerprint": 10,
        "hostname": 1433,
        "domain": 728
      },
      "indicator_count": 8887,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://admin.arivs.com/user_session/new",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://admin.arivs.com/user_session/new",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776612987.0493567
}