{
  "type": "URL",
  "indicator": "https://api.3dns.xyz/",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api.3dns.xyz/",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4131752459,
      "indicator": "https://api.3dns.xyz/",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 4,
      "pulses": [
        {
          "id": "68e2bb5d9ee8577ab5519f2c",
          "name": "Meritshealth with DoD links? ",
          "description": "",
          "modified": "2026-01-13T00:05:56.401000",
          "created": "2025-10-05T18:39:25.286000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "68e2b14d83bb63502feac65e",
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1365,
            "URL": 11172,
            "hostname": 2780,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4420,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 20486,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "138 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68e2b14d83bb63502feac65e",
          "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
          "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
          "modified": "2026-01-07T00:00:30.717000",
          "created": "2025-10-05T17:56:29.109000",
          "tags": [
            "gtmk5nxqc6",
            "utc amazon",
            "utc na",
            "acceptencoding",
            "gmt contenttype",
            "connection",
            "true pragma",
            "gmt setcookie",
            "httponly",
            "gmt vary",
            "nc000000 up",
            "html document",
            "unicode text",
            "utf8 text",
            "oc0006 http",
            "http traffic",
            "https http",
            "mitre att",
            "control ta0011",
            "protocol t1071",
            "match info",
            "t1573 severity",
            "info",
            "number",
            "ja3s",
            "algorithm",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft cus",
            "get http",
            "dns resolutions",
            "registrar",
            "markmonitor inc",
            "country",
            "resolver domain",
            "type name",
            "html",
            "apnic",
            "apnic whois",
            "please",
            "rirs",
            "cidr",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "development att",
            "name tactics",
            "binary file",
            "ck matrix",
            "wheelchair",
            "iamrobert",
            "pattern match",
            "ascii text",
            "href",
            "united",
            "general",
            "local",
            "path",
            "encrypt",
            "click",
            "passive dns",
            "urls",
            "files",
            "reverse dns",
            "netherlands",
            "present aug",
            "a domains",
            "moved",
            "first pqc",
            "ip address",
            "unknown ns",
            "unknown aaaa",
            "title",
            "body",
            "meta",
            "window",
            "accept",
            "body doctype",
            "welcome",
            "ok server",
            "gmt content",
            "present jul",
            "present sep",
            "aaaa",
            "hostname",
            "error",
            "defense evasion",
            "windows nt",
            "response",
            "vary",
            "strings",
            "core",
            "t1027.013 encrypted/encoded",
            "michelin lazy k",
            "prefetch8",
            "flag",
            "date",
            "starfield",
            "hybrid",
            "mobility cr",
            "extraction",
            "data upload",
            "include",
            "o url",
            "url url",
            "included i0",
            "review ioc",
            "excluded ic",
            "suggested",
            "find sugi",
            "failed",
            "cre pul",
            "enter",
            "enter sc",
            "type",
            "enric",
            "extra",
            "type opaste",
            "data u",
            "included",
            "copy md5",
            "copy sha1",
            "copy sha256",
            "null",
            "refresh",
            "tools",
            "look",
            "verify",
            "restart",
            "t1480 execution",
            "expiration",
            "url https",
            "no expiration",
            "iocs",
            "ipv4",
            "text drag",
            "drop or",
            "browse to",
            "select file",
            "redacted for",
            "server",
            "privacy tech",
            "privacy admin",
            "postal code",
            "stateprovince",
            "organization",
            "email",
            "code",
            "quantum rooms",
            "sam somalia",
            "emp",
            "porn",
            "media defense",
            "gov porn",
            "suck my nips",
            "reimer suspect",
            "jeffrey reimer",
            "dod",
            "department of defense",
            "show",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results may",
            "entries http",
            "scans record",
            "value status",
            "sabey type",
            "merits fake",
            "y.a.s.",
            "pornography",
            "ramsom"
          ],
          "references": [
            "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
            "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
            "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
            "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
            "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
            "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
            "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
            "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
            "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
            "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
            "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
            "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
            "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
            "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
            "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
            "https://meumundogay-com.sexogratis.page/locker",
            "https://es.pornhat.com/models/the-sex-creator/",
            "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
            "Can the DoD no questions asked target a SA victim",
            "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
            "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
            "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
            "There is fear in silence or speaking out",
            "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
            "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
            "If someone is believed to be a threat they have right to due process.",
            "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
            "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
            "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
            "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
            "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
            "iamrobert.com Y.A.S.",
            "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
            "Target agreed and complied with all lie detector measures.",
            "Is the family allowed to have a funeral for Tsara or print an obituary",
            "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
            "I am very upset. Whoever is doing this is sick."
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            },
            {
              "id": "Malware",
              "display_name": "Malware",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1573",
              "name": "Encrypted Channel",
              "display_name": "T1573 - Encrypted Channel"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1069.002",
              "name": "Domain Groups",
              "display_name": "T1069.002 - Domain Groups"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1583.001",
              "name": "Domains",
              "display_name": "T1583.001 - Domains"
            },
            {
              "id": "TA0042",
              "name": "Resource Development",
              "display_name": "TA0042 - Resource Development"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "T1553.002",
              "name": "Code Signing",
              "display_name": "T1553.002 - Code Signing"
            },
            {
              "id": "T1528",
              "name": "Steal Application Access Token",
              "display_name": "T1528 - Steal Application Access Token"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1591",
              "name": "Gather Victim Org Information",
              "display_name": "T1591 - Gather Victim Org Information"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1562",
              "name": "Impair Defenses",
              "display_name": "T1562 - Impair Defenses"
            },
            {
              "id": "T1457",
              "name": "Malicious Media Content",
              "display_name": "T1457 - Malicious Media Content"
            },
            {
              "id": "T1562.001",
              "name": "Disable or Modify Tools",
              "display_name": "T1562.001 - Disable or Modify Tools"
            },
            {
              "id": "T1562.004",
              "name": "Disable or Modify System Firewall",
              "display_name": "T1562.004 - Disable or Modify System Firewall"
            },
            {
              "id": "T1089",
              "name": "Disabling Security Tools",
              "display_name": "T1089 - Disabling Security Tools"
            },
            {
              "id": "T1562.008",
              "name": "Disable Cloud Logs",
              "display_name": "T1562.008 - Disable Cloud Logs"
            },
            {
              "id": "T1125",
              "name": "Video Capture",
              "display_name": "T1125 - Video Capture"
            },
            {
              "id": "T1056.003",
              "name": "Web Portal Capture",
              "display_name": "T1056.003 - Web Portal Capture"
            },
            {
              "id": "T1512",
              "name": "Capture Camera",
              "display_name": "T1512 - Capture Camera"
            },
            {
              "id": "T1180",
              "name": "Screensaver",
              "display_name": "T1180 - Screensaver"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 11,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1328,
            "URL": 9931,
            "hostname": 2621,
            "FileHash-MD5": 381,
            "FileHash-SHA256": 4360,
            "FileHash-SHA1": 338,
            "CIDR": 4,
            "SSLCertFingerprint": 24,
            "CVE": 1,
            "email": 1
          },
          "indicator_count": 18989,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "144 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "690e8b773dc39921d88abd44",
          "name": "Nanocore - Affected",
          "description": "- wmsspacer.gif\n| Photography: WMSspacer.gif, |[wmstransparent.org,]\n* YARA Detections : \nDotNET_Reactor\nSystem.Security.Cryptography.AesCryptoServiceProvider\nSystem.Security.Cryptography\nSystem.Security.Cryptography ~\nI CryptoTransform |\n Wmsspacer, i.g.sg.js..png.com, on-screen.|",
          "modified": "2025-12-07T23:02:29.645000",
          "created": "2025-11-08T00:14:47.600000",
          "tags": [
            "hgnvastlaiz",
            "read c",
            "medium",
            "rgba",
            "memcommit",
            "delete",
            "png image",
            "unicode",
            "dock",
            "execution",
            "malware",
            "crlf line",
            "speichermedium",
            "productversion",
            "fileversion",
            "engine dll",
            "internalname",
            "einstellungen",
            "comodo ca",
            "limited st",
            "yara detections",
            "next pe",
            "eula",
            "policy",
            "direct",
            "opencandy",
            "suspicious_write_exe",
            "network_icmp",
            "process_martian",
            "present jun",
            "present jul",
            "domain",
            "united",
            "ip address",
            "unknown ns",
            "ms windows",
            "intel",
            "verisign",
            "time stamping",
            "unknown",
            "class",
            "write",
            "markus",
            "temple",
            "msie",
            "windows nt",
            "get http",
            "lehash",
            "av detections",
            "ids detections",
            "alerts",
            "file score",
            "low risk",
            "compromised_site_redirector_fromcharcode",
            "present aug",
            "passive dns",
            "all ipv4",
            "urls",
            "files",
            "hosting",
            "america flag",
            "win32",
            "ipv4 add",
            "signed file, valid signature. revoked.",
            "united states",
            "pws",
            "atros",
            "fiha",
            "search",
            "entries",
            "present oct",
            "next associated",
            "show",
            "high",
            "wow64",
            "slcc2",
            "next",
            "domain add",
            "poland",
            "poland unknown",
            "ipv4",
            "location poland",
            "poland asn",
            "et policy",
            "pe exe",
            "dll windows",
            "amazon s3",
            "location united",
            "associated urls",
            "date checked",
            "url hostname",
            "server response",
            "google safe",
            "results feb",
            "nanocore",
            "url add",
            "http",
            "related nids",
            "files location",
            "flag united",
            "malicious image",
            "files domain",
            "files related",
            "pulses otx",
            "related tags",
            "resources whois",
            "virustotal",
            "present sep",
            "status",
            "present nov",
            "present mar",
            "trojan",
            "script script",
            "div div",
            "link",
            "a li",
            "meta",
            "sweden",
            "invalid url",
            "head title",
            "title head",
            "reference",
            "bad request",
            "server",
            "netherlands",
            "creation date",
            "date",
            "running server",
            "ahmann",
            "christopher",
            "p",
            "tam",
            "legal",
            "treece",
            "alfrey",
            "muscat",
            "adversaries",
            "cyber crime",
            "quasi",
            "government"
          ],
          "references": [
            "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
            "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
            "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
            "www.opencandy.com",
            "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
            "Yara Detections : compromised_site_redirector_fromcharcode",
            "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
            "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
            "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
            "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
            "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
            "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
            "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
            "https://heavyfetish.com/search/CHEESE-PIZZA-porn/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Win.Trojan.Nanocore-5",
              "display_name": "Win.Trojan.Nanocore-5",
              "target": null
            },
            {
              "id": "Win.Trojan.Adinstall-2",
              "display_name": "Win.Trojan.Adinstall-2",
              "target": null
            },
            {
              "id": "PSW.Generic13",
              "display_name": "PSW.Generic13",
              "target": null
            },
            {
              "id": "Atros.UPK",
              "display_name": "Atros.UPK",
              "target": null
            },
            {
              "id": "Luhe.Fiha.A",
              "display_name": "Luhe.Fiha.A",
              "target": null
            },
            {
              "id": "Pua.Optimizerpro/PCOptimizerPro",
              "display_name": "Pua.Optimizerpro/PCOptimizerPro",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1143",
              "name": "Hidden Window",
              "display_name": "T1143 - Hidden Window"
            },
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1491.001",
              "name": "Internal Defacement",
              "display_name": "T1491.001 - Internal Defacement"
            },
            {
              "id": "T1204.003",
              "name": "Malicious Image",
              "display_name": "T1204.003 - Malicious Image"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 753,
            "FileHash-SHA1": 622,
            "FileHash-SHA256": 4336,
            "URL": 2448,
            "domain": 300,
            "hostname": 788,
            "CVE": 1,
            "email": 4
          },
          "indicator_count": 9252,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 142,
          "modified_text": "174 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68cb233ba91aa1eb958b3f31",
          "name": "Home - RMHS | APT 10 \u2022 Andromeda \u2022  OneLouder",
          "description": "I don\u2019t even know what to say. I\u2019ve received several complaints. This is 2nd time checking out technical issues that do exist. Operates as a Human Service entity for injured persons. OTX auto populated \u2018Golfing\u2019 as industry. \n\nDoes serve the severely disabled population. Does pay caregivers. Possibly a front page a FF link page, I have no idea",
          "modified": "2025-10-17T19:03:15.031000",
          "created": "2025-09-17T21:08:11.518000",
          "tags": [
            "script urls",
            "meta",
            "moved",
            "x tec",
            "passive dns",
            "encrypt",
            "america flag",
            "san francisco",
            "extraction",
            "data upload",
            "type indicatod",
            "united states",
            "a domains",
            "united",
            "gmt server",
            "jose",
            "university",
            "bill",
            "rmhs",
            "information",
            "board",
            "lorin",
            "joseph",
            "all veterans",
            "rocky mountain",
            "mission",
            "vice",
            "april",
            "school",
            "austin",
            "prior",
            "ipv4 add",
            "urls",
            "files",
            "location united",
            "wordpress",
            "rmhs meta",
            "tags viewport",
            "rmhs og",
            "rmhs article",
            "wpbakery page",
            "builder",
            "slider plugin",
            "google tag",
            "mountain human",
            "denver",
            "connecting",
            "denver start",
            "relevance home",
            "providers",
            "contact us",
            "rmhs main",
            "server",
            "redacted tech",
            "redacted admin",
            "registrar abuse",
            "algorithm",
            "key identifier",
            "x509v3 subject",
            "dnssec",
            "country",
            "ttl value",
            "graph summary",
            "resolved ips",
            "ip address",
            "port",
            "data",
            "screenshots no",
            "involved direct",
            "country name",
            "name response",
            "tcp connections",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "command",
            "adversaries",
            "found",
            "spawns",
            "t1590 gather",
            "path",
            "ascii text",
            "exif standard",
            "tiff image",
            "format",
            "stop",
            "false",
            "soldier",
            "model",
            "youth",
            "baby",
            "june",
            "general",
            "local",
            "click",
            "strings",
            "core",
            "warrior",
            "green",
            "emotion",
            "flash",
            "nina",
            "hunk",
            "fono",
            "daam",
            "mitre att",
            "ck techniques",
            "id name",
            "malicious",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "brand",
            "microsoft edge",
            "show process",
            "self",
            "date",
            "comspec",
            "hybrid",
            "form",
            "log id",
            "gmtn",
            "tls web",
            "b2 f6",
            "b0n timestamp",
            "f9401a",
            "record value",
            "x wix",
            "certificate",
            "domain add",
            "pulse submit",
            "body",
            "domain related",
            "blackbox",
            "apple",
            "helix",
            "dvrdns",
            "tracking",
            "remote access",
            "ios",
            "spyware",
            "hoax",
            "dynamicloader",
            "ptls6",
            "medium",
            "flashpix",
            "high",
            "ygjpavclsline",
            "officespace",
            "chartshared",
            "powershell",
            "write",
            "malware",
            "ygjpaulscontext",
            "status",
            "japan unknown",
            "domain",
            "pulses",
            "search",
            "accept",
            "apt10",
            "trojanspy",
            "win32",
            "entries",
            "susp",
            "backdoor",
            "useragent",
            "showing",
            "virtool",
            "twitter",
            "mozilla",
            "trojandropper",
            "trojan",
            "title",
            "onelouder",
            "yara det",
            "maware samoe",
            "genaco x",
            "ids detec",
            "ids terse",
            "win3 data",
            "include review",
            "exclude sugges",
            "targeting",
            "show",
            "copy",
            "reads",
            "dynamic",
            "vendor finding",
            "notes clamav",
            "files matching",
            "number",
            "sample analysis",
            "hide samples",
            "date hash",
            "next yara"
          ],
          "references": [
            "rmhumanservices.org",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
            "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
            "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
            "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
            "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
            "https://www.mlkfoundation.net/ (Foundry DGA)",
            "remotewd.com x 34 devices",
            "South Africa based:  remote.advisoroffice.com",
            "acc.lehigtapp.com - malware",
            "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
            "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
            "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
            "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
            "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
            "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
            "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
            "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
            "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
            "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
            "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
            "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
            "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
            "1.organization.api.powerplatform.partner.microsoftonline.cn",
            "chinaeast2.admin.api.powerautomate.cn",
            "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
            "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
            "ssa-gov.authorizeddns",
            "hmmm\u2026http://palander.stjernstrom.se/",
            "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU"
          ],
          "public": 1,
          "adversary": "APT 10",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "APT 10",
              "display_name": "APT 10",
              "target": null
            },
            {
              "id": "OneLouder",
              "display_name": "OneLouder",
              "target": null
            },
            {
              "id": "Andromeda",
              "display_name": "Andromeda",
              "target": null
            },
            {
              "id": "Sality",
              "display_name": "Sality",
              "target": null
            },
            {
              "id": "KoobFace",
              "display_name": "KoobFace",
              "target": null
            },
            {
              "id": "Bayrob",
              "display_name": "Bayrob",
              "target": null
            },
            {
              "id": "Nivdort Checkin",
              "display_name": "Nivdort Checkin",
              "target": null
            },
            {
              "id": "Win.Malware.Installcore-6950365-0",
              "display_name": "Win.Malware.Installcore-6950365-0",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1102",
              "name": "Web Service",
              "display_name": "T1102 - Web Service"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1056",
              "name": "Input Capture",
              "display_name": "T1056 - Input Capture"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1553",
              "name": "Subvert Trust Controls",
              "display_name": "T1553 - Subvert Trust Controls"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1583",
              "name": "Acquire Infrastructure",
              "display_name": "T1583 - Acquire Infrastructure"
            },
            {
              "id": "T1590",
              "name": "Gather Victim Network Information",
              "display_name": "T1590 - Gather Victim Network Information"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1132",
              "name": "Data Encoding",
              "display_name": "T1132 - Data Encoding"
            },
            {
              "id": "T1518",
              "name": "Software Discovery",
              "display_name": "T1518 - Software Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1574.006",
              "name": "Dynamic Linker Hijacking",
              "display_name": "T1574.006 - Dynamic Linker Hijacking"
            },
            {
              "id": "T1210",
              "name": "Exploitation of Remote Services",
              "display_name": "T1210 - Exploitation of Remote Services"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Golfing",
            "Healthcare",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 690,
            "hostname": 1912,
            "URL": 5925,
            "FileHash-SHA1": 273,
            "email": 8,
            "FileHash-SHA256": 3618,
            "CIDR": 3,
            "FileHash-MD5": 254,
            "SSLCertFingerprint": 19,
            "CVE": 2
          },
          "indicator_count": 12704,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "225 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "www.opencandy.com",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
        "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
        "https://meumundogay-com.sexogratis.page/locker",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "acc.lehigtapp.com - malware",
        "There is fear in silence or speaking out",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "I am very upset. Whoever is doing this is sick.",
        "https://www.mlkfoundation.net/ (Foundry DGA)",
        "If someone is believed to be a threat they have right to due process.",
        "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
        "ssa-gov.authorizeddns",
        "Target agreed and complied with all lie detector measures.",
        "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
        "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "1.organization.api.powerplatform.partner.microsoftonline.cn",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "South Africa based:  remote.advisoroffice.com",
        "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
        "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "Yara Detections : compromised_site_redirector_fromcharcode",
        "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
        "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "remotewd.com x 34 devices",
        "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
        "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
        "hmmm\u2026http://palander.stjernstrom.se/",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "rmhumanservices.org",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
        "https://es.pornhat.com/models/the-sex-creator/",
        "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "chinaeast2.admin.api.powerautomate.cn",
        "iamrobert.com Y.A.S.",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "Can the DoD no questions asked target a SA victim",
        "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU",
        "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
        "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
        "https://heavyfetish.com/search/CHEESE-PIZZA-porn/",
        "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "APT 10"
          ],
          "malware_families": [
            "Luhe.fiha.a",
            "Apt 10",
            "Andromeda",
            "Atros.upk",
            "Nivdort checkin",
            "Bayrob",
            "Malware",
            "Koobface",
            "Win.trojan.adinstall-2",
            "Win.trojan.nanocore-5",
            "Pua.optimizerpro/pcoptimizerpro",
            "Win.malware.installcore-6950365-0",
            "Sality",
            "Psw.generic13",
            "Apnic",
            "Onelouder"
          ],
          "industries": [
            "Healthcare",
            "Golfing",
            "Government"
          ],
          "unique_indicators": 39221
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/3dns.xyz",
    "whois": "http://whois.domaintools.com/3dns.xyz",
    "domain": "3dns.xyz",
    "hostname": "api.3dns.xyz"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 4,
  "pulses": [
    {
      "id": "68e2bb5d9ee8577ab5519f2c",
      "name": "Meritshealth with DoD links? ",
      "description": "",
      "modified": "2026-01-13T00:05:56.401000",
      "created": "2025-10-05T18:39:25.286000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "68e2b14d83bb63502feac65e",
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1365,
        "URL": 11172,
        "hostname": 2780,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4420,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 20486,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "138 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68e2b14d83bb63502feac65e",
      "name": "Did the \u2018real\u2019 DoD kill Targets wheelchair as promised? It\u2019s alive again.",
      "description": "I\u2019d never think the DoD would be found when researching a wheelchair company NO ONE has ever heard of in this region. \n\nA wheelchair was ordered for target early spring, it was received in early summer. \n\nSettings became a crazy mess. Suspicion was immediate as a toothless tech tried to identify if dealing w/target by birth year , quizzing, fear tactics (doomsday wheelchair) , familiar Then warns about EMP attacks against wheelchair? His son is a hacker (gamer) + software engineer. He left not knowing if target status after quizzing tech knowledge? I intentionally verbalized the truth , target was a very early adopter of Ruby & Ruby on Rails & everything tech, he dropped his tools & left breaking the arm of wheelchair. New tech  needed. Later denies ever being a mobility technician. They killed  a new wheelchair. Why?. You\u2019re allowed to donate your equipment Vets & uninsured NEED mobility equipment. Stop the craziness. Is it possible gamer hackers are riding the DoD w/o their knowledge?",
      "modified": "2026-01-07T00:00:30.717000",
      "created": "2025-10-05T17:56:29.109000",
      "tags": [
        "gtmk5nxqc6",
        "utc amazon",
        "utc na",
        "acceptencoding",
        "gmt contenttype",
        "connection",
        "true pragma",
        "gmt setcookie",
        "httponly",
        "gmt vary",
        "nc000000 up",
        "html document",
        "unicode text",
        "utf8 text",
        "oc0006 http",
        "http traffic",
        "https http",
        "mitre att",
        "control ta0011",
        "protocol t1071",
        "match info",
        "t1573 severity",
        "info",
        "number",
        "ja3s",
        "algorithm",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft cus",
        "get http",
        "dns resolutions",
        "registrar",
        "markmonitor inc",
        "country",
        "resolver domain",
        "type name",
        "html",
        "apnic",
        "apnic whois",
        "please",
        "rirs",
        "cidr",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "development att",
        "name tactics",
        "binary file",
        "ck matrix",
        "wheelchair",
        "iamrobert",
        "pattern match",
        "ascii text",
        "href",
        "united",
        "general",
        "local",
        "path",
        "encrypt",
        "click",
        "passive dns",
        "urls",
        "files",
        "reverse dns",
        "netherlands",
        "present aug",
        "a domains",
        "moved",
        "first pqc",
        "ip address",
        "unknown ns",
        "unknown aaaa",
        "title",
        "body",
        "meta",
        "window",
        "accept",
        "body doctype",
        "welcome",
        "ok server",
        "gmt content",
        "present jul",
        "present sep",
        "aaaa",
        "hostname",
        "error",
        "defense evasion",
        "windows nt",
        "response",
        "vary",
        "strings",
        "core",
        "t1027.013 encrypted/encoded",
        "michelin lazy k",
        "prefetch8",
        "flag",
        "date",
        "starfield",
        "hybrid",
        "mobility cr",
        "extraction",
        "data upload",
        "include",
        "o url",
        "url url",
        "included i0",
        "review ioc",
        "excluded ic",
        "suggested",
        "find sugi",
        "failed",
        "cre pul",
        "enter",
        "enter sc",
        "type",
        "enric",
        "extra",
        "type opaste",
        "data u",
        "included",
        "copy md5",
        "copy sha1",
        "copy sha256",
        "null",
        "refresh",
        "tools",
        "look",
        "verify",
        "restart",
        "t1480 execution",
        "expiration",
        "url https",
        "no expiration",
        "iocs",
        "ipv4",
        "text drag",
        "drop or",
        "browse to",
        "select file",
        "redacted for",
        "server",
        "privacy tech",
        "privacy admin",
        "postal code",
        "stateprovince",
        "organization",
        "email",
        "code",
        "quantum rooms",
        "sam somalia",
        "emp",
        "porn",
        "media defense",
        "gov porn",
        "suck my nips",
        "reimer suspect",
        "jeffrey reimer",
        "dod",
        "department of defense",
        "show",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results may",
        "entries http",
        "scans record",
        "value status",
        "sabey type",
        "merits fake",
        "y.a.s.",
        "pornography",
        "ramsom"
      ],
      "references": [
        "https://www.meritshealth.com/ Defense.Gov Mobility Co?  <https://iamwithrobert.com/>",
        "zeroeyes.host \u2022 media.defense.gov \u2022 defense.gov \u2022 23.222.155.67",
        "https://media.defense.gov/2022/Mar/17/2002958406/-1/-1/1/SUMMARY-OF-THE-JOINT-ALL-DOMAIN-COMMAND-AND-CONTROL-STRATEGY.pdf",
        "https://media.defense.gov/2020/jun/09/2002313081/-1/-1/0/csi-detect-and-prevent-web-shell-malware-20200422.pdf",
        "https://rto.bappam.eu/ai-n2cdl/mirai-2025-ven5k-telugu-movie-watch-online.html",
        "https://pornokind.vgt.pl \u2022  https://cdn2.video.itsyourporn.com",
        "https://webcams.itsyourporn.com/ \u2022 https://members.itsyourporn.com/",
        "https://pics-storage-1.pornhat.com/contents/albums/main/1920x1080/135000/135855/9537375.jp",
        "https://static.pornhat.com/contents/videos_screenshots/642000/642793/640x360/1.jpg",
        "https://d1rozh26tys225.cloudfront.net/robot-suspicion.svg (mobility company no one has heard of)",
        "https://www2.itsyourporn.com/license.php \u2022  https://www.lovephoto.tw/members",
        "https://members.engine.com/login \u2022  https://members.engine.com/payment-details/220210",
        "https://www-pornocarioca-com.sexogratis.page/videos/bbb/ex",
        "https://media.defense.gov/2024/sep/18/2003547016/-1/-1/0/csa-prc-linked-actors-botnet.pdf",
        "https://maisexo-com.putaria.info/casting \u2022  https://contosadultos-club.sexogratis.page/tudo",
        "https://meumundogay-com.sexogratis.page/locker",
        "https://es.pornhat.com/models/the-sex-creator/",
        "Dear US Government, the man who assaulted targets name is Jeffrey Scott Reimer of Chester Springs, PA",
        "Can the DoD no questions asked target a SA victim",
        "Red Team Abuse? Starfield ? DoD? You need a real criminal Jeffrey Reimer.",
        "There\u2019s a problem with terrorizing victims, relatives of, associates of and stealing their property intellectual or otherwise",
        "socialmedia \u2022 socialmedia.defense.gov \u2022 static.defense.gov",
        "There is fear in silence or speaking out",
        "Target left unattended by anyone in a hospital except a security guard. Hospital refused care. Ignored rare brain incident from high cervical & brain assault injuries aggravated by car accident.",
        "3-4 Police presence. 25 + hospital employees prepped radiology room. No one left room so was it for her?",
        "If someone is believed to be a threat they have right to due process.",
        "Infectious Disease UC Health denied target medication they said she needed as questionable liquid seeped into her brain.",
        "She was a researcher not a hacker. A mother not a criminal. Most talented and least impressed person I have ever known.",
        "Remarks online \u2018 T\u2019*#^^ is not a runner\u2019 a size 00 broke two track records at a major universities.",
        "Honestly, you\u2019ve never seen or met her no many how many people you\u2019ve sent out. That\u2019s why you quiz.",
        "ftp.iamrobert.com ? \u2022 https://www.meritshealth.com/templates/iamrobert/fonts/Graphik-Regular.eot",
        "iamrobert.com Y.A.S.",
        "1.2016 M.Brian Sabey filed a complaint about?  Jeffrey Reimer refused Lie detector test and False memory exam",
        "Target agreed and complied with all lie detector measures.",
        "Is the family allowed to have a funeral for Tsara or print an obituary",
        "No, they put Tsara in her mom\u2019s obituary, she couldn\u2019t grieve, she had to take it down.",
        "I am very upset. Whoever is doing this is sick."
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        },
        {
          "id": "Malware",
          "display_name": "Malware",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1573",
          "name": "Encrypted Channel",
          "display_name": "T1573 - Encrypted Channel"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1069.002",
          "name": "Domain Groups",
          "display_name": "T1069.002 - Domain Groups"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1583.001",
          "name": "Domains",
          "display_name": "T1583.001 - Domains"
        },
        {
          "id": "TA0042",
          "name": "Resource Development",
          "display_name": "TA0042 - Resource Development"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "T1553.002",
          "name": "Code Signing",
          "display_name": "T1553.002 - Code Signing"
        },
        {
          "id": "T1528",
          "name": "Steal Application Access Token",
          "display_name": "T1528 - Steal Application Access Token"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1591",
          "name": "Gather Victim Org Information",
          "display_name": "T1591 - Gather Victim Org Information"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1562",
          "name": "Impair Defenses",
          "display_name": "T1562 - Impair Defenses"
        },
        {
          "id": "T1457",
          "name": "Malicious Media Content",
          "display_name": "T1457 - Malicious Media Content"
        },
        {
          "id": "T1562.001",
          "name": "Disable or Modify Tools",
          "display_name": "T1562.001 - Disable or Modify Tools"
        },
        {
          "id": "T1562.004",
          "name": "Disable or Modify System Firewall",
          "display_name": "T1562.004 - Disable or Modify System Firewall"
        },
        {
          "id": "T1089",
          "name": "Disabling Security Tools",
          "display_name": "T1089 - Disabling Security Tools"
        },
        {
          "id": "T1562.008",
          "name": "Disable Cloud Logs",
          "display_name": "T1562.008 - Disable Cloud Logs"
        },
        {
          "id": "T1125",
          "name": "Video Capture",
          "display_name": "T1125 - Video Capture"
        },
        {
          "id": "T1056.003",
          "name": "Web Portal Capture",
          "display_name": "T1056.003 - Web Portal Capture"
        },
        {
          "id": "T1512",
          "name": "Capture Camera",
          "display_name": "T1512 - Capture Camera"
        },
        {
          "id": "T1180",
          "name": "Screensaver",
          "display_name": "T1180 - Screensaver"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 11,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1328,
        "URL": 9931,
        "hostname": 2621,
        "FileHash-MD5": 381,
        "FileHash-SHA256": 4360,
        "FileHash-SHA1": 338,
        "CIDR": 4,
        "SSLCertFingerprint": 24,
        "CVE": 1,
        "email": 1
      },
      "indicator_count": 18989,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "144 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "690e8b773dc39921d88abd44",
      "name": "Nanocore - Affected",
      "description": "- wmsspacer.gif\n| Photography: WMSspacer.gif, |[wmstransparent.org,]\n* YARA Detections : \nDotNET_Reactor\nSystem.Security.Cryptography.AesCryptoServiceProvider\nSystem.Security.Cryptography\nSystem.Security.Cryptography ~\nI CryptoTransform |\n Wmsspacer, i.g.sg.js..png.com, on-screen.|",
      "modified": "2025-12-07T23:02:29.645000",
      "created": "2025-11-08T00:14:47.600000",
      "tags": [
        "hgnvastlaiz",
        "read c",
        "medium",
        "rgba",
        "memcommit",
        "delete",
        "png image",
        "unicode",
        "dock",
        "execution",
        "malware",
        "crlf line",
        "speichermedium",
        "productversion",
        "fileversion",
        "engine dll",
        "internalname",
        "einstellungen",
        "comodo ca",
        "limited st",
        "yara detections",
        "next pe",
        "eula",
        "policy",
        "direct",
        "opencandy",
        "suspicious_write_exe",
        "network_icmp",
        "process_martian",
        "present jun",
        "present jul",
        "domain",
        "united",
        "ip address",
        "unknown ns",
        "ms windows",
        "intel",
        "verisign",
        "time stamping",
        "unknown",
        "class",
        "write",
        "markus",
        "temple",
        "msie",
        "windows nt",
        "get http",
        "lehash",
        "av detections",
        "ids detections",
        "alerts",
        "file score",
        "low risk",
        "compromised_site_redirector_fromcharcode",
        "present aug",
        "passive dns",
        "all ipv4",
        "urls",
        "files",
        "hosting",
        "america flag",
        "win32",
        "ipv4 add",
        "signed file, valid signature. revoked.",
        "united states",
        "pws",
        "atros",
        "fiha",
        "search",
        "entries",
        "present oct",
        "next associated",
        "show",
        "high",
        "wow64",
        "slcc2",
        "next",
        "domain add",
        "poland",
        "poland unknown",
        "ipv4",
        "location poland",
        "poland asn",
        "et policy",
        "pe exe",
        "dll windows",
        "amazon s3",
        "location united",
        "associated urls",
        "date checked",
        "url hostname",
        "server response",
        "google safe",
        "results feb",
        "nanocore",
        "url add",
        "http",
        "related nids",
        "files location",
        "flag united",
        "malicious image",
        "files domain",
        "files related",
        "pulses otx",
        "related tags",
        "resources whois",
        "virustotal",
        "present sep",
        "status",
        "present nov",
        "present mar",
        "trojan",
        "script script",
        "div div",
        "link",
        "a li",
        "meta",
        "sweden",
        "invalid url",
        "head title",
        "title head",
        "reference",
        "bad request",
        "server",
        "netherlands",
        "creation date",
        "date",
        "running server",
        "ahmann",
        "christopher",
        "p",
        "tam",
        "legal",
        "treece",
        "alfrey",
        "muscat",
        "adversaries",
        "cyber crime",
        "quasi",
        "government"
      ],
      "references": [
        "wmsspacer.gif : 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87",
        "ceidg.gov.pl \u2022 https://www.csrc.gov.cn.lxcvc.com/ \u2022 www.alt.krasnopil-silrada.gov.ua",
        "http://www.mof.gov.cn.lxcvc.com/ \u2022  http://www.mohurd.gov.cn.lxcvc.com/ \u2022",
        "www.opencandy.com",
        "http://www.opencandy.com/privacy \u2022 http://www.opencandy.com/privacy-policy. \u2022  license@opencandy.com \u2022",
        "Yara Detections : compromised_site_redirector_fromcharcode",
        "Matches rule: skip20_sqllang_hook from ruleset skip20_sqllang_hook by Mathieu Tartare <mathieu.tartare@eset.com>",
        "Matches rule Adobe_XMP_Identifier from ruleset Adobe_XMP_Identifier by InQuest Labs",
        "http://pcoptimizerpro.com/eula.aspx \u2022 http://www.pcoptimizerpro.com/privacypolicy.aspx",
        "pcoptimizerpro.com \u2022 www.pcoptimizerpro.com",
        "PE EXE UpdatesDll.dll : 69081ab853021bd28bf7fb1eb4eac3199623c8ed413589e6f3898806a15f0f23",
        "YARA: DotNET_Reactor System.Security.Cryptography.AesCryptoServiceProvider System.Security.Cryptography System.Security.Cryptography ICryptoTransform",
        "https://img.fkcdn.com/image/kg8avm80/mobile/j/f/9/apple-iphone-12-dummyapplefsn-200x200-imafwg8dkyh2zgrh.jpeg",
        "https://heavyfetish.com/search/CHEESE-PIZZA-porn/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Win.Trojan.Nanocore-5",
          "display_name": "Win.Trojan.Nanocore-5",
          "target": null
        },
        {
          "id": "Win.Trojan.Adinstall-2",
          "display_name": "Win.Trojan.Adinstall-2",
          "target": null
        },
        {
          "id": "PSW.Generic13",
          "display_name": "PSW.Generic13",
          "target": null
        },
        {
          "id": "Atros.UPK",
          "display_name": "Atros.UPK",
          "target": null
        },
        {
          "id": "Luhe.Fiha.A",
          "display_name": "Luhe.Fiha.A",
          "target": null
        },
        {
          "id": "Pua.Optimizerpro/PCOptimizerPro",
          "display_name": "Pua.Optimizerpro/PCOptimizerPro",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1143",
          "name": "Hidden Window",
          "display_name": "T1143 - Hidden Window"
        },
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1491.001",
          "name": "Internal Defacement",
          "display_name": "T1491.001 - Internal Defacement"
        },
        {
          "id": "T1204.003",
          "name": "Malicious Image",
          "display_name": "T1204.003 - Malicious Image"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 753,
        "FileHash-SHA1": 622,
        "FileHash-SHA256": 4336,
        "URL": 2448,
        "domain": 300,
        "hostname": 788,
        "CVE": 1,
        "email": 4
      },
      "indicator_count": 9252,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 142,
      "modified_text": "174 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68cb233ba91aa1eb958b3f31",
      "name": "Home - RMHS | APT 10 \u2022 Andromeda \u2022  OneLouder",
      "description": "I don\u2019t even know what to say. I\u2019ve received several complaints. This is 2nd time checking out technical issues that do exist. Operates as a Human Service entity for injured persons. OTX auto populated \u2018Golfing\u2019 as industry. \n\nDoes serve the severely disabled population. Does pay caregivers. Possibly a front page a FF link page, I have no idea",
      "modified": "2025-10-17T19:03:15.031000",
      "created": "2025-09-17T21:08:11.518000",
      "tags": [
        "script urls",
        "meta",
        "moved",
        "x tec",
        "passive dns",
        "encrypt",
        "america flag",
        "san francisco",
        "extraction",
        "data upload",
        "type indicatod",
        "united states",
        "a domains",
        "united",
        "gmt server",
        "jose",
        "university",
        "bill",
        "rmhs",
        "information",
        "board",
        "lorin",
        "joseph",
        "all veterans",
        "rocky mountain",
        "mission",
        "vice",
        "april",
        "school",
        "austin",
        "prior",
        "ipv4 add",
        "urls",
        "files",
        "location united",
        "wordpress",
        "rmhs meta",
        "tags viewport",
        "rmhs og",
        "rmhs article",
        "wpbakery page",
        "builder",
        "slider plugin",
        "google tag",
        "mountain human",
        "denver",
        "connecting",
        "denver start",
        "relevance home",
        "providers",
        "contact us",
        "rmhs main",
        "server",
        "redacted tech",
        "redacted admin",
        "registrar abuse",
        "algorithm",
        "key identifier",
        "x509v3 subject",
        "dnssec",
        "country",
        "ttl value",
        "graph summary",
        "resolved ips",
        "ip address",
        "port",
        "data",
        "screenshots no",
        "involved direct",
        "country name",
        "name response",
        "tcp connections",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "command",
        "adversaries",
        "found",
        "spawns",
        "t1590 gather",
        "path",
        "ascii text",
        "exif standard",
        "tiff image",
        "format",
        "stop",
        "false",
        "soldier",
        "model",
        "youth",
        "baby",
        "june",
        "general",
        "local",
        "click",
        "strings",
        "core",
        "warrior",
        "green",
        "emotion",
        "flash",
        "nina",
        "hunk",
        "fono",
        "daam",
        "mitre att",
        "ck techniques",
        "id name",
        "malicious",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "brand",
        "microsoft edge",
        "show process",
        "self",
        "date",
        "comspec",
        "hybrid",
        "form",
        "log id",
        "gmtn",
        "tls web",
        "b2 f6",
        "b0n timestamp",
        "f9401a",
        "record value",
        "x wix",
        "certificate",
        "domain add",
        "pulse submit",
        "body",
        "domain related",
        "blackbox",
        "apple",
        "helix",
        "dvrdns",
        "tracking",
        "remote access",
        "ios",
        "spyware",
        "hoax",
        "dynamicloader",
        "ptls6",
        "medium",
        "flashpix",
        "high",
        "ygjpavclsline",
        "officespace",
        "chartshared",
        "powershell",
        "write",
        "malware",
        "ygjpaulscontext",
        "status",
        "japan unknown",
        "domain",
        "pulses",
        "search",
        "accept",
        "apt10",
        "trojanspy",
        "win32",
        "entries",
        "susp",
        "backdoor",
        "useragent",
        "showing",
        "virtool",
        "twitter",
        "mozilla",
        "trojandropper",
        "trojan",
        "title",
        "onelouder",
        "yara det",
        "maware samoe",
        "genaco x",
        "ids detec",
        "ids terse",
        "win3 data",
        "include review",
        "exclude sugges",
        "targeting",
        "show",
        "copy",
        "reads",
        "dynamic",
        "vendor finding",
        "notes clamav",
        "files matching",
        "number",
        "sample analysis",
        "hide samples",
        "date hash",
        "next yara"
      ],
      "references": [
        "rmhumanservices.org",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt",
        "ntp17.dn.n-helix.com \u2022 ntp6.n-helix.com \u2022\tn-helix.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://www.dvrdns.net/BlackBox/google/googleMapKey.txt",
        "http://www.dvrdns.net/BlackBox/AOKI/AMEXA07/AMEX-A07%20PCViewer(3.9.8.1).exe",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H%2520Player",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_X9/version.txt",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/IROAD%20Viewer(4.1.6.1).exe",
        "http://www.dvrdns.net/BlackBox/IROAD/IROAD_T8S2/",
        "https://we4.ondemand.esker.com/ondemand/webaccess/logon.aspx?status=CookieNotFound",
        "https://www.mlkfoundation.net/ (Foundry DGA)",
        "remotewd.com x 34 devices",
        "South Africa based:  remote.advisoroffice.com",
        "acc.lehigtapp.com - malware",
        "http://watchhers.net/index.php (espionage entity /palantir relationship  - seen before with palantir and Pegasus sometimes simultaneously )",
        "Active - apple-dns.net \u2022 nr-data.net \u2022 tunes.apple.com \u2022  emails.redvue.com \u2022",
        "Active - pointing:  https://itunes.apple.com/app/apple-store/id284815942/us/app/samsung-galaxy-watch-gear-s/id1117310635",
        "http://help.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "http://wpgchanfp01.cangene.com/tmp/javascript/tiny_mce/plugins/imagepaste/applet/cp.jar",
        "Excess porn -http://barbaramarx.com/__media__/js/netsoltrademark.php?d=www.pornxxxgals.info/feet-licking-porn/",
        "https://www.rmhumanservices.org/wp-content/themes/unicon/framework/js/isotope.pkgd.min.js malware hosting",
        "YARA Detections: NAME STRINGS CATEGORY APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "acc.lehigtapp.com - APT10_Malware_Sample_Gen acc.lehigtapp.com FILE",
        "http://www.dvrdns.net/BlackBox/LVR_SD310HWG/SD310H/Player(3.7.2.0).exe.txt \u2022 www.dvrdns.net",
        "IDS Detections: Koobface HTTP Request (2) W32/Bayrob Attempted Checkin 2",
        "IDS Terse HTTP 1.0 Request Possible Nivdort Probable OneLouder downloader (Zeus P2P)",
        "IDS: Win32/Nivdort Checkin Win32.Sality.bh Checkin 2 Andromeda Checkin Hostname",
        "1.organization.api.powerplatform.partner.microsoftonline.cn",
        "chinaeast2.admin.api.powerautomate.cn",
        "https://cisomag.com/mysterious-malware-infects-over-45000-android-phones/amp/",
        "https://hhahiag.r.af.d.sendibt2.com/tr/cl/k5n4lETrM7BShW8xAUoWzvHtXjUA9oY0eN0p94b4t6YmDCrHhUgR0CnWSrSU4oUFIIWHm33C5ltugoVezhyEVu8aXyY_lcNjanZPDFg-LOsishNuFrY6IJn0V0mjTudzlxtGsp9Cf04n9fUhwGutzxcgUbjXHhhy9RZdcxw9Z89-_v9NL4wQvbEhDhAlekBXUxvWjkXG_WyC8myfJAYzXL_43Cok-YEiyDHA7JvRwSX9aWdWtcE5N-kL3K-VM_-tvhSJcLt-mXjsbAN6DYkoz2r7j11242EYDQHdzTiC1Or0k6_Ptz-GvAw4cZyo3978asi27ijV89a5ngu_Ene6XOjg_UMpexvj9Zrihu4i9EPTSC-5-7qKwlTLKNHiwI6DvmurR5IoMJVMPa-xIDMUN2LCMTwUHMvfo0q2a0btH2Fx2A",
        "ssa-gov.authorizeddns",
        "hmmm\u2026http://palander.stjernstrom.se/",
        "https://jt667.keap-link003.com/v2/click/063b9634a5ebbdf34f43cbbbca6019ca/eJyNkEEPwUAQhf_LnEularE3EZGmOAhn2bRTlu2abIdEpP_dEHEicZ335nvz5g6M3njOStBwZKWGEEHAwpJFz9OzZ1O8xH6Spr1BBM760zycLwT6_m33oz-n6ThNBioCvhGKZ7OeTPNsNd8tslUuXjJBQv4BDVUyUqMPaLacZAto259krC3PrgJvQHO44LNTaaUXb4MT_4GZGh3HJzTUJbPH-BUbY22s61DACuW0AjuFMDB0D1w7wRoi9OX7KzneQFfGNdg-ANNtagU"
      ],
      "public": 1,
      "adversary": "APT 10",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "APT 10",
          "display_name": "APT 10",
          "target": null
        },
        {
          "id": "OneLouder",
          "display_name": "OneLouder",
          "target": null
        },
        {
          "id": "Andromeda",
          "display_name": "Andromeda",
          "target": null
        },
        {
          "id": "Sality",
          "display_name": "Sality",
          "target": null
        },
        {
          "id": "KoobFace",
          "display_name": "KoobFace",
          "target": null
        },
        {
          "id": "Bayrob",
          "display_name": "Bayrob",
          "target": null
        },
        {
          "id": "Nivdort Checkin",
          "display_name": "Nivdort Checkin",
          "target": null
        },
        {
          "id": "Win.Malware.Installcore-6950365-0",
          "display_name": "Win.Malware.Installcore-6950365-0",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1102",
          "name": "Web Service",
          "display_name": "T1102 - Web Service"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1056",
          "name": "Input Capture",
          "display_name": "T1056 - Input Capture"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1553",
          "name": "Subvert Trust Controls",
          "display_name": "T1553 - Subvert Trust Controls"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1583",
          "name": "Acquire Infrastructure",
          "display_name": "T1583 - Acquire Infrastructure"
        },
        {
          "id": "T1590",
          "name": "Gather Victim Network Information",
          "display_name": "T1590 - Gather Victim Network Information"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1132",
          "name": "Data Encoding",
          "display_name": "T1132 - Data Encoding"
        },
        {
          "id": "T1518",
          "name": "Software Discovery",
          "display_name": "T1518 - Software Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1574.006",
          "name": "Dynamic Linker Hijacking",
          "display_name": "T1574.006 - Dynamic Linker Hijacking"
        },
        {
          "id": "T1210",
          "name": "Exploitation of Remote Services",
          "display_name": "T1210 - Exploitation of Remote Services"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Golfing",
        "Healthcare",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 690,
        "hostname": 1912,
        "URL": 5925,
        "FileHash-SHA1": 273,
        "email": 8,
        "FileHash-SHA256": 3618,
        "CIDR": 3,
        "FileHash-MD5": 254,
        "SSLCertFingerprint": 19,
        "CVE": 2
      },
      "indicator_count": 12704,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "225 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api.3dns.xyz/",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api.3dns.xyz/",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1780246778.6038718
}