{
  "type": "URL",
  "indicator": "https://api.packetstream.io",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api.packetstream.io",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3750131684,
      "indicator": "https://api.packetstream.io",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 21,
      "pulses": [
        {
          "id": "6523344e4adc85389899504c",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2024-10-13T03:00:28.081000",
          "created": "2023-10-08T22:59:26.040000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b48d699080b4bfd334c5",
          "export_count": 74,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7761,
            "CVE": 6,
            "FileHash-MD5": 285,
            "FileHash-SHA1": 165,
            "FileHash-SHA256": 5059,
            "domain": 987,
            "hostname": 2399
          },
          "indicator_count": 16662,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "553 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a835fc0836f148fa45c8",
          "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
          "description": "",
          "modified": "2023-12-06T16:58:29.243000",
          "created": "2023-12-06T16:58:29.243000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a581b1024ea61979da96",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "",
          "modified": "2023-12-06T16:46:57.782000",
          "created": "2023-12-06T16:46:57.782000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 3,
            "FileHash-SHA256": 5791,
            "hostname": 3255,
            "domain": 2317,
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "URL": 11513
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 111,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a56de96660c99420dbc2",
          "name": "Beach Research | Instagram Account Deleted Command and Control",
          "description": "",
          "modified": "2023-12-06T16:46:37.866000",
          "created": "2023-12-06T16:46:37.866000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 5,
            "hostname": 565,
            "domain": 287,
            "FileHash-SHA256": 966,
            "FileHash-MD5": 393,
            "FileHash-SHA1": 212,
            "URL": 2122,
            "FilePath": 2
          },
          "indicator_count": 4552,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a521974bdb5d6dbda092",
          "name": "",
          "description": "",
          "modified": "2023-12-06T16:45:21.776000",
          "created": "2023-12-06T16:45:21.776000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a5109ecc3c75c949f950",
          "name": "Unsupported IE 404 account running BotNet Command & Control Server | B/L",
          "description": "",
          "modified": "2023-12-06T16:45:04.296000",
          "created": "2023-12-06T16:45:04.296000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4f322399eb1db2a07b2",
          "name": "Hijacked Pinterest Account Spreader, BotNet Control Server | Unsupported IE",
          "description": "",
          "modified": "2023-12-06T16:44:35.786000",
          "created": "2023-12-06T16:44:35.786000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4e083c4acd789ea7e58",
          "name": "Blacklisted",
          "description": "",
          "modified": "2023-12-06T16:44:16.060000",
          "created": "2023-12-06T16:44:16.060000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2258,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15663,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4d5c14495fcf65ee8a5",
          "name": "Netsky",
          "description": "",
          "modified": "2023-12-06T16:44:05.631000",
          "created": "2023-12-06T16:44:05.631000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a4cb97598bac143dc90b",
          "name": "Critical: Pinterest Cyber Espionage",
          "description": "",
          "modified": "2023-12-06T16:43:55.639000",
          "created": "2023-12-06T16:43:55.639000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 6,
            "URL": 7203,
            "hostname": 2260,
            "FileHash-SHA256": 4835,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "domain": 915
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a1c7a5c24dab818e2af8",
          "name": "ET CNC Feodo Tracker Reported CnC Server UDP Command & Control Server",
          "description": "",
          "modified": "2023-12-06T16:31:03.566000",
          "created": "2023-12-06T16:31:03.566000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 631,
            "domain": 102,
            "hostname": 427,
            "URL": 1229,
            "FileHash-MD5": 26,
            "FileHash-SHA1": 26
          },
          "indicator_count": 2441,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f203d9b8cd815d8b5134c",
          "name": "Unsupported IE 404 account running BotNet Command & Control",
          "description": "",
          "modified": "2023-10-30T03:17:17.770000",
          "created": "2023-10-30T03:17:17.770000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6523344e4adc85389899504c",
          "export_count": 10,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "902 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650a0b7c9a6b3c5d0a2a3960",
          "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
          "description": "Link: apple.instagram.com \nQuasar is a lightweight, publicly available open-source Remote Access Trojan (RAT). Used by a variety of attackers.  Typically packed to make analysis of the source demanding.\nAccount appears to have been breached, operational in dark web. Dead host.",
          "modified": "2023-10-19T14:04:37.381000",
          "created": "2023-09-19T20:58:36.137000",
          "tags": [
            "contacted",
            "threat roundup",
            "execution",
            "ssl certificate",
            "dark web",
            "crypto threat",
            "resolutions",
            "referrer",
            "stealer",
            "quasar",
            "asyncrat",
            "error",
            "social engineering",
            "iPhone phishing",
            "Apple phishing",
            "email phishing",
            "emotet",
            "remote",
            "attacks"
          ],
          "references": [
            "Alienvault OTX",
            "Data Analysis",
            "Online Research",
            "WebTools"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "India"
          ],
          "malware_families": [
            {
              "id": "Backdoor:MSIL/AsyncRAT",
              "display_name": "Backdoor:MSIL/AsyncRAT",
              "target": "/malware/Backdoor:MSIL/AsyncRAT"
            },
            {
              "id": "Backdoor:MSIL/QuasarRat",
              "display_name": "Backdoor:MSIL/QuasarRat",
              "target": "/malware/Backdoor:MSIL/QuasarRat"
            }
          ],
          "attack_ids": [
            {
              "id": "T1003",
              "name": "OS Credential Dumping",
              "display_name": "T1003 - OS Credential Dumping"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1548",
              "name": "Abuse Elevation Control Mechanism",
              "display_name": "T1548 - Abuse Elevation Control Mechanism"
            }
          ],
          "industries": [
            "Media",
            "Social Media",
            "Technology",
            "Hacking"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 31,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 44,
            "FileHash-SHA1": 34,
            "FileHash-SHA256": 5791,
            "URL": 11513,
            "domain": 2317,
            "hostname": 3255,
            "CVE": 3
          },
          "indicator_count": 22957,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "650930a75e59920ea90a90df",
          "name": "Beach Research | Instagram Account Deleted Command and Control",
          "description": "Instagram account deleted by malicious attackers.\nAfter a period of information harvesting and spying , phone access,  iPhone intrusion, apparently the site was maliciously attacked.\n\nPrivilege Escalation\nTargeted individual\nObscuration\nHacking/ Web Attack",
          "modified": "2023-10-19T03:01:46.569000",
          "created": "2023-09-19T05:24:55.870000",
          "tags": [
            "cyber threat",
            "team phishing",
            "engineering",
            "united",
            "team",
            "team covid19",
            "heur",
            "ssh attacker",
            "hostname",
            "malicious site",
            "malware",
            "service",
            "phishing",
            "malicious",
            "agent",
            "installcore",
            "exploit",
            "msil",
            "hiloti",
            "riskware",
            "artemis",
            "unsafe",
            "crack",
            "cisco umbrella",
            "site",
            "alexa top",
            "million",
            "safe site",
            "malware site",
            "phishing site",
            "redline stealer",
            "alexa",
            "download",
            "teamspy",
            "beach research",
            "generic malware",
            "cyber crime",
            "Instagram",
            "Instagram account attack",
            "keylogger",
            "Social Engineering",
            "Palm Beach Research Group phishing",
            "Ramnit",
            "Apple phishing"
          ],
          "references": [
            "Online Research",
            "Hybrid Analysis",
            "WebTools",
            "Data Analysis",
            "Behavior Pattern Match",
            "Research Targets media",
            "https://www.instagram.com/songculture/",
            "Alienvault OTX",
            "This AV link was attached to account: https://otx.alienvault.com/indicator/file/4dc6e4f00f06abdc43d4108301eadb800d77e18b631fdeb522e357845fba30c5"
          ],
          "public": 1,
          "adversary": "[Unnamed group]",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Beach Research",
              "display_name": "Beach Research",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:Win32/Hiloti",
              "display_name": "ALF:HeraklezEval:Trojan:Win32/Hiloti",
              "target": null
            },
            {
              "id": "Trojan:Win32/InstallCore",
              "display_name": "Trojan:Win32/InstallCore",
              "target": "/malware/Trojan:Win32/InstallCore"
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "HackTool:Win32/Crack",
              "display_name": "HackTool:Win32/Crack",
              "target": "/malware/HackTool:Win32/Crack"
            },
            {
              "id": "DEcovid19",
              "display_name": "DEcovid19",
              "target": null
            },
            {
              "id": "#Lowfi:HSTR:MSIL/Keylogger",
              "display_name": "#Lowfi:HSTR:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "ALF:HeraklezEval:Trojan:MSIL/SpyAgent",
              "display_name": "ALF:HeraklezEval:Trojan:MSIL/SpyAgent",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "TeamSpy",
              "display_name": "TeamSpy",
              "target": null
            },
            {
              "id": "TrojanDropper:Win32/Teamspy",
              "display_name": "TrojanDropper:Win32/Teamspy",
              "target": "/malware/TrojanDropper:Win32/Teamspy"
            },
            {
              "id": "Genheur",
              "display_name": "Genheur",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1035",
              "name": "Service Execution",
              "display_name": "T1035 - Service Execution"
            },
            {
              "id": "T1043",
              "name": "Commonly Used Port",
              "display_name": "T1043 - Commonly Used Port"
            },
            {
              "id": "T1179",
              "name": "Hooking",
              "display_name": "T1179 - Hooking"
            },
            {
              "id": "T1001",
              "name": "Data Obfuscation",
              "display_name": "T1001 - Data Obfuscation"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "T1056.001",
              "name": "Keylogging",
              "display_name": "T1056.001 - Keylogging"
            }
          ],
          "industries": [
            "Technology",
            "Media"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 24,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "CVE": 5,
            "hostname": 565,
            "domain": 287,
            "FileHash-MD5": 393,
            "FileHash-SHA1": 212,
            "FileHash-SHA256": 966,
            "URL": 2122,
            "FilePath": 2
          },
          "indicator_count": 4552,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "913 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6506b296b842740e2f7b2625",
          "name": "Blacklisted",
          "description": "",
          "modified": "2023-10-17T09:00:23.825000",
          "created": "2023-09-17T08:02:30.711000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b27d63535110fca94a73",
          "export_count": 51,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7207,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2258
          },
          "indicator_count": 15667,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6506b4a0406fd5b9839955b0",
          "name": "     ",
          "description": "",
          "modified": "2023-10-17T04:04:05.965000",
          "created": "2023-09-17T08:11:12.583000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b48d699080b4bfd334c5",
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6506b48d699080b4bfd334c5",
          "name": "Unsupported IE 404 account running BotNet Command & Control Server | B/L",
          "description": "",
          "modified": "2023-10-17T04:04:05.965000",
          "created": "2023-09-17T08:10:53.311000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b3a1d09b3acfd89906a5",
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6506b3a1d09b3acfd89906a5",
          "name": "Hijacked Pinterest Account Spreader, BotNet Control Server | Unsupported IE",
          "description": "",
          "modified": "2023-10-17T04:04:05.965000",
          "created": "2023-09-17T08:06:57.276000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b296b842740e2f7b2625",
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6506b27d63535110fca94a73",
          "name": "Netsky ",
          "description": "",
          "modified": "2023-10-17T04:04:05.965000",
          "created": "2023-09-17T08:02:05.910000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": "6506b2196ad4270f3ba15394",
          "export_count": 41,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6506b2196ad4270f3ba15394",
          "name": "Critical: Pinterest Cyber Espionage",
          "description": "Attack",
          "modified": "2023-10-17T04:04:05.965000",
          "created": "2023-09-17T08:00:24.928000",
          "tags": [
            "united",
            "contacted urls",
            "whois record",
            "contacted",
            "malicious site",
            "malware",
            "phishing site",
            "anonymizer",
            "heur",
            "control server",
            "facebook",
            "cobalt strike",
            "execution",
            "installcore",
            "phishing",
            "service",
            "core",
            "metro",
            "icmp",
            "hacktool",
            "download",
            "relic",
            "monitoring",
            "installer",
            "steam",
            "bank",
            "dnspionage",
            "crack",
            "unsafe",
            "ramnit",
            "emotet",
            "malware site",
            "proxy",
            "exploit",
            "fakealert",
            "team",
            "redline stealer",
            "laplasclipper",
            "cisco umbrella",
            "site",
            "safe site",
            "alexa top",
            "million",
            "alexa",
            "downloader",
            "opencandy",
            "generic",
            "presenoker",
            "maltiverse",
            "trojanspy",
            "date",
            "unknown",
            "windir",
            "markmonitor",
            "name server",
            "av detection",
            "september",
            "default browser",
            "guest system",
            "hybrid",
            "general",
            "click",
            "strings",
            "class",
            "critical",
            "blacklist",
            "union",
            "Embarcadero Delphi",
            "whois whois",
            "referrer",
            "ssl certificate",
            "communicating",
            "resolutions",
            "parent parent",
            "dropped",
            "stealer",
            "banker",
            "keylogger",
            "attack",
            "apple",
            "detection list",
            "ip address",
            "netsky",
            "firehol proxy",
            "noname057",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "FireHol",
            "Proxy",
            "Pexee",
            "Bank of America Corporation Malware Download",
            "CVE-2017-11882",
            "Alexa SANS Internet Storm Center",
            "MCI Verizon Block",
            "NaN"
          ],
          "references": [
            "http://ww1.tsx.org/_fd",
            "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
            "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
            "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
            "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
            "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
            "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
            "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
            "firebaseremoteconfig.googleapis.com     (remote hacking)",
            "remote.telegrafix.com          (remote hacking)",
            "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
            "remote.haverhillcc.com        (remote hacking)",
            "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "http://init-p01st.push.apple.com/bag        (remote hacking)",
            "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
            "apple.com.        (malicious version/header)",
            "https://www.apple.com/sitemap/",
            "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
            "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
            "init.ess.apple.com        (remote hacking)",
            "applepaydayloans.com",
            "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
            "https://applepaydayloans.com/",
            "https://sinister.ly/Thread-Apple-empty-box?page=13",
            "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
            "https://support.Apple.com/de",
            "http://www.Apple.com/quicktime/download",
            "http://www.Apple.com/quicktime/download/standalone.html",
            "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
            "https://www.roseoubleu.fr/panier        (phishing)",
            "Roksit.net",
            "stagelight.pl                                                 (malicious/ pattern match)",
            "www.jamesbgriffinlaw.com                     (malicious host)",
            "Data Analytics",
            "Behavior Pattern Match Analysis",
            "45.159.189.105                                                (Command and Control)",
            "http://45.159.189.105/bot/regex            (Bot Command)",
            "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
            "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
            "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
            "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Canada"
          ],
          "malware_families": [
            {
              "id": "Maltiverse",
              "display_name": "Maltiverse",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "TEL:Delphi/Obfuscator",
              "display_name": "TEL:Delphi/Obfuscator",
              "target": "/malware/TEL:Delphi/Obfuscator"
            },
            {
              "id": "LaplasClipper",
              "display_name": "LaplasClipper",
              "target": null
            },
            {
              "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
              "target": null
            },
            {
              "id": "SLFPER:InstallCore",
              "display_name": "SLFPER:InstallCore",
              "target": null
            },
            {
              "id": "RedLine Stealer",
              "display_name": "RedLine Stealer",
              "target": null
            },
            {
              "id": "ALF:Program:OpenCandy:Remnant",
              "display_name": "ALF:Program:OpenCandy:Remnant",
              "target": null
            },
            {
              "id": "Ramnit",
              "display_name": "Ramnit",
              "target": null
            },
            {
              "id": "Relic",
              "display_name": "Relic",
              "target": null
            },
            {
              "id": "Skynet",
              "display_name": "Skynet",
              "target": null
            },
            {
              "id": "generic.malware",
              "display_name": "generic.malware",
              "target": null
            },
            {
              "id": "Anonymizer",
              "display_name": "Anonymizer",
              "target": null
            },
            {
              "id": "#HSTR:HackTool:Win32/Mimikatz",
              "display_name": "#HSTR:HackTool:Win32/Mimikatz",
              "target": null
            },
            {
              "id": "PWS:MSIL/Steam",
              "display_name": "PWS:MSIL/Steam",
              "target": "/malware/PWS:MSIL/Steam"
            },
            {
              "id": "Trojan.HTML.Agent",
              "display_name": "Trojan.HTML.Agent",
              "target": null
            },
            {
              "id": "Gen:Variant.Zusy",
              "display_name": "Gen:Variant.Zusy",
              "target": null
            },
            {
              "id": "Worm:Win32/Netsky",
              "display_name": "Worm:Win32/Netsky",
              "target": "/malware/Worm:Win32/Netsky"
            },
            {
              "id": "Sodin Ransomware",
              "display_name": "Sodin Ransomware",
              "target": null
            },
            {
              "id": "Keyloggers",
              "display_name": "Keyloggers",
              "target": null
            },
            {
              "id": "Proxy",
              "display_name": "Proxy",
              "target": null
            },
            {
              "id": "TEL:Trojan:Win32/Emotet",
              "display_name": "TEL:Trojan:Win32/Emotet",
              "target": null
            },
            {
              "id": "Cobalt Strike - S0154",
              "display_name": "Cobalt Strike - S0154",
              "target": null
            },
            {
              "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
              "target": null
            },
            {
              "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
              "target": null
            },
            {
              "id": "AdwareSig [Adw] ml.Generic",
              "display_name": "AdwareSig [Adw] ml.Generic",
              "target": null
            },
            {
              "id": "W32.Hack.Generic",
              "display_name": "W32.Hack.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ole2.Vbs",
              "display_name": "Trojan.Ole2.Vbs",
              "target": null
            },
            {
              "id": "QVM20.1.8D80.Malware",
              "display_name": "QVM20.1.8D80.Malware",
              "target": null
            },
            {
              "id": "Generic.Malware",
              "display_name": "Generic.Malware",
              "target": null
            },
            {
              "id": "Backdoor.Mokes",
              "display_name": "Backdoor.Mokes",
              "target": null
            },
            {
              "id": "AdWare.DropWare",
              "display_name": "AdWare.DropWare",
              "target": null
            },
            {
              "id": "Gen:Variant.Razy",
              "display_name": "Gen:Variant.Razy",
              "target": null
            },
            {
              "id": "Generic.31fcc75f",
              "display_name": "Generic.31fcc75f",
              "target": null
            },
            {
              "id": "Trojan.Generic",
              "display_name": "Trojan.Generic",
              "target": null
            },
            {
              "id": "Artemis",
              "display_name": "Artemis",
              "target": null
            },
            {
              "id": "malware.generic",
              "display_name": "malware.generic",
              "target": null
            },
            {
              "id": "Gen:Variant.Bulz",
              "display_name": "Gen:Variant.Bulz",
              "target": null
            },
            {
              "id": "GameHack.DR",
              "display_name": "GameHack.DR",
              "target": null
            },
            {
              "id": "Dropper.Binder",
              "display_name": "Dropper.Binder",
              "target": null
            },
            {
              "id": "malicious.22a4c0",
              "display_name": "malicious.22a4c0",
              "target": null
            },
            {
              "id": "SdBot.CAOC",
              "display_name": "SdBot.CAOC",
              "target": null
            },
            {
              "id": "ml.Generic",
              "display_name": "ml.Generic",
              "target": null
            },
            {
              "id": "Trojan.Ransom.GenericKD",
              "display_name": "Trojan.Ransom.GenericKD",
              "target": null
            },
            {
              "id": "Phish.AB",
              "display_name": "Phish.AB",
              "target": null
            },
            {
              "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1218",
              "name": "Signed Binary Proxy Execution",
              "display_name": "T1218 - Signed Binary Proxy Execution"
            },
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 42,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 7203,
            "CVE": 6,
            "FileHash-MD5": 283,
            "FileHash-SHA1": 163,
            "FileHash-SHA256": 4835,
            "domain": 915,
            "hostname": 2260
          },
          "indicator_count": 15665,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "915 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "64f952ed85f0eefd1d752acb",
          "name": "ET CNC Feodo Tracker Reported CnC Server UDP Command & Control Server",
          "description": "ET CNC Feodo Tracker Reported CnC Server UDP Command & Control Server \nOrionVM Cloud Platform\nHost IBM X FORCE EXCHANGE \nCountry Origin: Australia \nAbuse.ch\nBotNetwork Co-operative: Emotet Dridex, Emotet (aka Heodo), TrickBot, QakBot (aka QuakBot) Bazaar Loader.\nLink found in a 'Tsara Brashears' site. Research shows that the attack on this target was intentional. Dropbox stealing, spyware likely due to a potential case if  past online SA of assault  is true. You see a lot of droppers, brute force and a remarkable amount of remotely accessed files. IOW/ Target likely didn't visit a malicious websites unless redirected after a remote attack. There is sample pathe evidence. Aggressive tactics to enter any online media is identified.\nTarget.",
          "modified": "2023-10-07T04:03:37.753000",
          "created": "2023-09-07T04:34:53.312000",
          "tags": [
            "cidr",
            "execution",
            "ssl certificate",
            "whois whois",
            "contacted",
            "whois referrer",
            "communicating",
            "bundled",
            "attack",
            "historical ssl",
            "family",
            "lolkek",
            "bank",
            "dark power",
            "ransomware",
            "play ransomware",
            "makop",
            "core",
            "hacktool",
            "emotet"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 631,
            "domain": 102,
            "URL": 1229,
            "hostname": 427,
            "FileHash-MD5": 26,
            "FileHash-SHA1": 26
          },
          "indicator_count": 2441,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "925 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "Hybrid Analysis",
        "https://applepaydayloans.com/",
        "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
        "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
        "remote.telegrafix.com          (remote hacking)",
        "https://www.instagram.com/songculture/",
        "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
        "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
        "Online Research",
        "WebTools",
        "Alienvault OTX",
        "Roksit.net",
        "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
        "Data Analytics",
        "https://www.roseoubleu.fr/panier        (phishing)",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "apple.com.        (malicious version/header)",
        "firebaseremoteconfig.googleapis.com     (remote hacking)",
        "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
        "http://www.Apple.com/quicktime/download",
        "init.ess.apple.com        (remote hacking)",
        "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
        "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
        "Research Targets media",
        "http://ww1.tsx.org/_fd",
        "applepaydayloans.com",
        "https://sinister.ly/Thread-Apple-empty-box?page=13",
        "www.jamesbgriffinlaw.com                     (malicious host)",
        "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
        "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
        "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
        "stagelight.pl                                                 (malicious/ pattern match)",
        "http://45.159.189.105/bot/regex            (Bot Command)",
        "remote.haverhillcc.com        (remote hacking)",
        "http://www.Apple.com/quicktime/download/standalone.html",
        "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)",
        "http://init-p01st.push.apple.com/bag        (remote hacking)",
        "Data Analysis",
        "https://www.apple.com/sitemap/",
        "Behavior Pattern Match",
        "This AV link was attached to account: https://otx.alienvault.com/indicator/file/4dc6e4f00f06abdc43d4108301eadb800d77e18b631fdeb522e357845fba30c5",
        "45.159.189.105                                                (Command and Control)",
        "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
        "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
        "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
        "Behavior Pattern Match Analysis",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
        "https://support.Apple.com/de",
        "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
        "https://support.apple.com/en-us/HT201265. Targets (iOS ID)"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "[Unnamed group]"
          ],
          "malware_families": [
            "Relic",
            "Backdoor:msil/quasarrat",
            "Keyloggers",
            "W32.hack.generic",
            "Gamehack.dr",
            "Malicious.22a4c0",
            "Beach research",
            "Maltiverse",
            "Generic.asmalws          malicious_confidence_70% 1\til:trojan.msilzilla 1\tfilerepmalware 1\transom.sabsik 1\tbehaveslike.dropper 1\tmicrosoft phishing 1\tbackdoor.mokes 1\tphishing bank of america corporat",
            "Trojan.ole2.vbs",
            "Alf:heraklezeval:trojan:win32/hiloti",
            "Cobalt strike - s0154",
            "Alf:heraklezeval:trojan:msil/spyagent",
            "Alf:program:opencandy:remnant",
            "Proxy",
            "Slfper:installcore",
            "Anonymizer",
            "Tel:trojan:win32/emotet",
            "Generic.31fcc75f",
            "Ml.generic",
            "Skynet",
            "#lowfi:hstr:msil/keylogger",
            "Dropper.binder",
            "Adware.dropware",
            "Undefined 1\tms 1\txyz 1\tgl 1\tnet tld aggregation com ms xyz gl net 20% 20% 20% 20% 20% tld\tcount com\t1 undefined\tnan ms\t1 xyz\t1 gl\t1 net\t1   combined blacklist timeline hybrid-analysis maltiverse resea",
            "Trojan.generic",
            "Malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tunsafe.ai_score_98% 1\tmobigame 1\tbanker,evasive,retefe 1\tprogram.unwanted 1\tmalicious.high.ml 1\tkryptik.dawvk 1\tunsafe.ai_score_91% 1\tadwar",
            "Decovid19",
            "Worm:win32/netsky",
            "Adwaresig [adw] ml.generic",
            "Generic.malware",
            "Pws:msil/steam",
            "Trojanspy",
            "Gen:variant.bulz",
            "#hstr:hacktool:win32/mimikatz",
            "Ramnit",
            "Genheur",
            "Phish.ab",
            "Backdoor.mokes",
            "Trojandropper:win32/teamspy",
            "Qvm20.1.8d80.malware",
            "Malware.generic",
            "Sdbot.caoc",
            "Hacktool:win32/crack",
            "Backdoor:msil/asyncrat",
            "Tel:delphi/obfuscator",
            "Teamspy",
            "Laplasclipper",
            "Trojan.ransom.generickd",
            "Gen:variant.zusy",
            "Redline stealer",
            "Gen:variant.razy",
            "Artemis",
            "Trojan.html.agent",
            "#lowfi:siga:trojanspy:msil/keylogger",
            "Trojan:win32/installcore",
            "Sodin ransomware"
          ],
          "industries": [
            "Technology",
            "Hacking",
            "Social media",
            "Media"
          ],
          "unique_indicators": 42769
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/packetstream.io",
    "whois": "http://whois.domaintools.com/packetstream.io",
    "domain": "packetstream.io",
    "hostname": "api.packetstream.io"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 21,
  "pulses": [
    {
      "id": "6523344e4adc85389899504c",
      "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
      "description": "",
      "modified": "2024-10-13T03:00:28.081000",
      "created": "2023-10-08T22:59:26.040000",
      "tags": [
        "united",
        "contacted urls",
        "whois record",
        "contacted",
        "malicious site",
        "malware",
        "phishing site",
        "anonymizer",
        "heur",
        "control server",
        "facebook",
        "cobalt strike",
        "execution",
        "installcore",
        "phishing",
        "service",
        "core",
        "metro",
        "icmp",
        "hacktool",
        "download",
        "relic",
        "monitoring",
        "installer",
        "steam",
        "bank",
        "dnspionage",
        "crack",
        "unsafe",
        "ramnit",
        "emotet",
        "malware site",
        "proxy",
        "exploit",
        "fakealert",
        "team",
        "redline stealer",
        "laplasclipper",
        "cisco umbrella",
        "site",
        "safe site",
        "alexa top",
        "million",
        "alexa",
        "downloader",
        "opencandy",
        "generic",
        "presenoker",
        "maltiverse",
        "trojanspy",
        "date",
        "unknown",
        "windir",
        "markmonitor",
        "name server",
        "av detection",
        "september",
        "default browser",
        "guest system",
        "hybrid",
        "general",
        "click",
        "strings",
        "class",
        "critical",
        "blacklist",
        "union",
        "Embarcadero Delphi",
        "whois whois",
        "referrer",
        "ssl certificate",
        "communicating",
        "resolutions",
        "parent parent",
        "dropped",
        "stealer",
        "banker",
        "keylogger",
        "attack",
        "apple",
        "detection list",
        "ip address",
        "netsky",
        "firehol proxy",
        "noname057",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "FireHol",
        "Proxy",
        "Pexee",
        "Bank of America Corporation Malware Download",
        "CVE-2017-11882",
        "Alexa SANS Internet Storm Center",
        "MCI Verizon Block",
        "NaN"
      ],
      "references": [
        "http://ww1.tsx.org/_fd",
        "https://www.milehighmedia.com/legal/2257    (exploit source | revenge porn)",
        "Target \u2192 https://www.pinterest.com/pinkbuffalorun/ (EMOTET) Full control taken. True Board owner (a legitimate business) was likely very unaware Pinterest activities all flowed through the Dark Web. (Research shows over 5000 followers | 1 million visits per mo | more than 1 million pins re-pinned)",
        "http://103.246.145.111/gateonl.php?hwid=WALKER-PC-WALKER&cpuname=Intel                (remote hacking/potentially maliciousRedTeam)",
        "http://45.159.189.105/bot/online?guid=WALKER-PC&key=b73f03cae5752ff4c823f89de539b59754bc4e65d43970358b17bcf21fb6c4e5        (remote hacking)",
        "http://clipper.guru/bot/online?guid=WALKER-PC        (remote hacking)",
        "Target  \u2192 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian                              (attached to Pinterest account)",
        "https://firebaseremoteconfig.googleapis.com/v1/projects/16163253122/namespaces/firebase:fetch        (remote hacking)",
        "firebaseremoteconfig.googleapis.com     (remote hacking)",
        "remote.telegrafix.com          (remote hacking)",
        "fb582cc7cfcfa64786caff627cc34ff7aedf7a97620d0cd2eb927d4bb3b7653d",
        "remote.haverhillcc.com        (remote hacking)",
        "http://ax.itunes.apple.com/WebObjects/MZStoreServices.woa/ws/RSS/toppaidapplications/limit=10/xml",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "http://init-p01st.push.apple.com/bag        (remote hacking)",
        "https://support.apple.com/en-us/HT201265. Targets (iOS ID)",
        "apple.com.        (malicious version/header)",
        "https://www.apple.com/sitemap/",
        "https://applemusic-spotlight.myunidays.com/US/en-US?        (remote hacking)",
        "http://go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409",
        "init.ess.apple.com        (remote hacking)",
        "applepaydayloans.com",
        "www.metrobyt-mobile.com (So very hacked. Should be shut down. No corporate headquarters. Malicious practices by many independent owners)",
        "https://applepaydayloans.com/",
        "https://sinister.ly/Thread-Apple-empty-box?page=13",
        "7651508989a859a165a3e587268021e3ce3734b3e8711d06a101068c60dfdbbe  ( Spyware| tsetup.2.4.4.exe | Downloader.Agent!1.E2F1 (CLASSIC) |Telegram Messenger Inc WeExtract malicious installation on targets media & devices)",
        "https://support.Apple.com/de",
        "http://www.Apple.com/quicktime/download",
        "http://www.Apple.com/quicktime/download/standalone.html",
        "https://urldefense.us/v2/url?u=http-3A__support.apple.com_kb_HT2693&d=DwMGaQ&c=mcnPvAfk3Xtjyky7sc3uA24Vk9hJzQ1fEHisENJPWek&r=PjGDHIUs1kNE6nRUZrOEsufSDp8LBQ-SwHI1wE1Z0Qo&m=zBlvHUR-UT1fW5-53xrUtd5Uj5DBn30a-XGaqZ1lyWh4YCJi5SWOvg3tVORPEuat&s=OJ-NfystLux9f25c44kAAuBLCoTAo6gQJ7EMKHRlrCk&e=&data=05",
        "https://www.roseoubleu.fr/panier        (phishing)",
        "Roksit.net",
        "stagelight.pl                                                 (malicious/ pattern match)",
        "www.jamesbgriffinlaw.com                     (malicious host)",
        "Data Analytics",
        "Behavior Pattern Match Analysis",
        "45.159.189.105                                                (Command and Control)",
        "http://45.159.189.105/bot/regex            (Bot Command)",
        "151.101.0.84  US - United States Pinterest Botnet Command and Control Server -  23.62.46.21",
        "AS54113 Fastly Autonomous System aggregation for Pinterest United States Botnet Command and Control Server",
        "DetectItEasy PE32   Installer: Inno Setup Module (6.0.0) [unicode]   Compiler: Embarcadero Delphi (10.3 Rio) [Professional]   Linker: Turbo Linker (2.25*,Delphi) [GUI32,signed]   Overlay: Inno Setup Installer data",
        "(unsupported_iexplore exploit/redirect)  https://www.pinterest.com/pin/mood--35536284546940000/ (Dark Web Trace)"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Canada"
      ],
      "malware_families": [
        {
          "id": "Maltiverse",
          "display_name": "Maltiverse",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "TEL:Delphi/Obfuscator",
          "display_name": "TEL:Delphi/Obfuscator",
          "target": "/malware/TEL:Delphi/Obfuscator"
        },
        {
          "id": "LaplasClipper",
          "display_name": "LaplasClipper",
          "target": null
        },
        {
          "id": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "display_name": "#Lowfi:SIGA:TrojanSpy:MSIL/Keylogger",
          "target": null
        },
        {
          "id": "SLFPER:InstallCore",
          "display_name": "SLFPER:InstallCore",
          "target": null
        },
        {
          "id": "RedLine Stealer",
          "display_name": "RedLine Stealer",
          "target": null
        },
        {
          "id": "ALF:Program:OpenCandy:Remnant",
          "display_name": "ALF:Program:OpenCandy:Remnant",
          "target": null
        },
        {
          "id": "Ramnit",
          "display_name": "Ramnit",
          "target": null
        },
        {
          "id": "Relic",
          "display_name": "Relic",
          "target": null
        },
        {
          "id": "Skynet",
          "display_name": "Skynet",
          "target": null
        },
        {
          "id": "generic.malware",
          "display_name": "generic.malware",
          "target": null
        },
        {
          "id": "Anonymizer",
          "display_name": "Anonymizer",
          "target": null
        },
        {
          "id": "#HSTR:HackTool:Win32/Mimikatz",
          "display_name": "#HSTR:HackTool:Win32/Mimikatz",
          "target": null
        },
        {
          "id": "PWS:MSIL/Steam",
          "display_name": "PWS:MSIL/Steam",
          "target": "/malware/PWS:MSIL/Steam"
        },
        {
          "id": "Trojan.HTML.Agent",
          "display_name": "Trojan.HTML.Agent",
          "target": null
        },
        {
          "id": "Gen:Variant.Zusy",
          "display_name": "Gen:Variant.Zusy",
          "target": null
        },
        {
          "id": "Worm:Win32/Netsky",
          "display_name": "Worm:Win32/Netsky",
          "target": "/malware/Worm:Win32/Netsky"
        },
        {
          "id": "Sodin Ransomware",
          "display_name": "Sodin Ransomware",
          "target": null
        },
        {
          "id": "Keyloggers",
          "display_name": "Keyloggers",
          "target": null
        },
        {
          "id": "Proxy",
          "display_name": "Proxy",
          "target": null
        },
        {
          "id": "TEL:Trojan:Win32/Emotet",
          "display_name": "TEL:Trojan:Win32/Emotet",
          "target": null
        },
        {
          "id": "Cobalt Strike - S0154",
          "display_name": "Cobalt Strike - S0154",
          "target": null
        },
        {
          "id": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
          "display_name": "Generic.ASMalwS          Malicious_confidence_70% 1\tIL:Trojan.MSILZilla 1\tFileRepMalware 1\tRansom.Sabsik 1\tBehavesLike.Dropper 1\tMicrosoft phishing 1\tBackdoor.Mokes 1\tPhishing Bank of America Corporat",
          "target": null
        },
        {
          "id": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
          "display_name": "malware_download\tsuspicious.low.ml 2\tmalicious.moderate.ml 1\tUnsafe.AI_Score_98% 1\tMobigame 1\tbanker,evasive,retefe 1\tProgram.Unwanted 1\tmalicious.high.ml 1\tKryptik.dawvk 1\tUnsafe.AI_Score_91% 1\tAdwar",
          "target": null
        },
        {
          "id": "AdwareSig [Adw] ml.Generic",
          "display_name": "AdwareSig [Adw] ml.Generic",
          "target": null
        },
        {
          "id": "W32.Hack.Generic",
          "display_name": "W32.Hack.Generic",
          "target": null
        },
        {
          "id": "Trojan.Ole2.Vbs",
          "display_name": "Trojan.Ole2.Vbs",
          "target": null
        },
        {
          "id": "QVM20.1.8D80.Malware",
          "display_name": "QVM20.1.8D80.Malware",
          "target": null
        },
        {
          "id": "Generic.Malware",
          "display_name": "Generic.Malware",
          "target": null
        },
        {
          "id": "Backdoor.Mokes",
          "display_name": "Backdoor.Mokes",
          "target": null
        },
        {
          "id": "AdWare.DropWare",
          "display_name": "AdWare.DropWare",
          "target": null
        },
        {
          "id": "Gen:Variant.Razy",
          "display_name": "Gen:Variant.Razy",
          "target": null
        },
        {
          "id": "Generic.31fcc75f",
          "display_name": "Generic.31fcc75f",
          "target": null
        },
        {
          "id": "Trojan.Generic",
          "display_name": "Trojan.Generic",
          "target": null
        },
        {
          "id": "Artemis",
          "display_name": "Artemis",
          "target": null
        },
        {
          "id": "malware.generic",
          "display_name": "malware.generic",
          "target": null
        },
        {
          "id": "Gen:Variant.Bulz",
          "display_name": "Gen:Variant.Bulz",
          "target": null
        },
        {
          "id": "GameHack.DR",
          "display_name": "GameHack.DR",
          "target": null
        },
        {
          "id": "Dropper.Binder",
          "display_name": "Dropper.Binder",
          "target": null
        },
        {
          "id": "malicious.22a4c0",
          "display_name": "malicious.22a4c0",
          "target": null
        },
        {
          "id": "SdBot.CAOC",
          "display_name": "SdBot.CAOC",
          "target": null
        },
        {
          "id": "ml.Generic",
          "display_name": "ml.Generic",
          "target": null
        },
        {
          "id": "Trojan.Ransom.GenericKD",
          "display_name": "Trojan.Ransom.GenericKD",
          "target": null
        },
        {
          "id": "Phish.AB",
          "display_name": "Phish.AB",
          "target": null
        },
        {
          "id": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
          "display_name": "undefined 1\tms 1\txyz 1\tgl 1\tnet TLD aggregation com ms xyz gl net 20% 20% 20% 20% 20% TLD\tCount com\t1 undefined\tNaN ms\t1 xyz\t1 gl\t1 net\t1   Combined blacklist timeline Hybrid-Analysis Maltiverse Resea",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1218",
          "name": "Signed Binary Proxy Execution",
          "display_name": "T1218 - Signed Binary Proxy Execution"
        },
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": "6506b48d699080b4bfd334c5",
      "export_count": 74,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 7761,
        "CVE": 6,
        "FileHash-MD5": 285,
        "FileHash-SHA1": 165,
        "FileHash-SHA256": 5059,
        "domain": 987,
        "hostname": 2399
      },
      "indicator_count": 16662,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 227,
      "modified_text": "553 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a835fc0836f148fa45c8",
      "name": "Unsupported IE 404 account running BotNet Command & Control [by OctoSeek]",
      "description": "",
      "modified": "2023-12-06T16:58:29.243000",
      "created": "2023-12-06T16:58:29.243000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 10,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2260,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15665,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a581b1024ea61979da96",
      "name": "Quasar - Dark Web Instagram Account | Link found | Remote Access Trojan (RAT)",
      "description": "",
      "modified": "2023-12-06T16:46:57.782000",
      "created": "2023-12-06T16:46:57.782000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 3,
        "FileHash-SHA256": 5791,
        "hostname": 3255,
        "domain": 2317,
        "FileHash-MD5": 44,
        "FileHash-SHA1": 34,
        "URL": 11513
      },
      "indicator_count": 22957,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 111,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a56de96660c99420dbc2",
      "name": "Beach Research | Instagram Account Deleted Command and Control",
      "description": "",
      "modified": "2023-12-06T16:46:37.866000",
      "created": "2023-12-06T16:46:37.866000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 5,
        "hostname": 565,
        "domain": 287,
        "FileHash-SHA256": 966,
        "FileHash-MD5": 393,
        "FileHash-SHA1": 212,
        "URL": 2122,
        "FilePath": 2
      },
      "indicator_count": 4552,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a521974bdb5d6dbda092",
      "name": "",
      "description": "",
      "modified": "2023-12-06T16:45:21.776000",
      "created": "2023-12-06T16:45:21.776000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2260,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15665,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a5109ecc3c75c949f950",
      "name": "Unsupported IE 404 account running BotNet Command & Control Server | B/L",
      "description": "",
      "modified": "2023-12-06T16:45:04.296000",
      "created": "2023-12-06T16:45:04.296000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2260,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15665,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a4f322399eb1db2a07b2",
      "name": "Hijacked Pinterest Account Spreader, BotNet Control Server | Unsupported IE",
      "description": "",
      "modified": "2023-12-06T16:44:35.786000",
      "created": "2023-12-06T16:44:35.786000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2260,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15665,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a4e083c4acd789ea7e58",
      "name": "Blacklisted",
      "description": "",
      "modified": "2023-12-06T16:44:16.060000",
      "created": "2023-12-06T16:44:16.060000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2258,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15663,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a4d5c14495fcf65ee8a5",
      "name": "Netsky",
      "description": "",
      "modified": "2023-12-06T16:44:05.631000",
      "created": "2023-12-06T16:44:05.631000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2260,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15665,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a4cb97598bac143dc90b",
      "name": "Critical: Pinterest Cyber Espionage",
      "description": "",
      "modified": "2023-12-06T16:43:55.639000",
      "created": "2023-12-06T16:43:55.639000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "CVE": 6,
        "URL": 7203,
        "hostname": 2260,
        "FileHash-SHA256": 4835,
        "FileHash-MD5": 283,
        "FileHash-SHA1": 163,
        "domain": 915
      },
      "indicator_count": 15665,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api.packetstream.io",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api.packetstream.io",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776639199.3225067
}