{
  "type": "URL",
  "indicator": "https://api.partnertransactassist.microsoft-ppe.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://api.partnertransactassist.microsoft-ppe.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 4070233965,
      "indicator": "https://api.partnertransactassist.microsoft-ppe.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 13,
      "pulses": [
        {
          "id": "68596260a9ca6c4cc92ca068",
          "name": "Delete service | Affects Threat Research Platforms",
          "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
          "modified": "2025-08-20T04:13:22.641000",
          "created": "2025-06-23T14:19:12.328000",
          "tags": [
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "oc0006",
            "get http",
            "resolved ips",
            "dns resolutions",
            "request",
            "response",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "ip address",
            "country name",
            "cname",
            "port",
            "accept",
            "gmt ifnonematch",
            "url data",
            "icmp",
            "mutexes nothing",
            "data",
            "datacrashpad",
            "edge",
            "created",
            "nothing",
            "html internet",
            "html document",
            "ascii text",
            "gtmkvjvztk dl"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 2401,
            "URL": 5856,
            "FileHash-SHA256": 3473,
            "domain": 2188,
            "FileHash-MD5": 123,
            "FileHash-SHA1": 120,
            "CVE": 2
          },
          "indicator_count": 14163,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "242 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "687d91b1a8f414040bfba430",
          "name": "Spyware",
          "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
          "modified": "2025-08-20T00:01:59.498000",
          "created": "2025-07-21T01:02:41.049000",
          "tags": [
            "serving ip",
            "address",
            "status",
            "utc na",
            "utc google",
            "utc facebook",
            "custom audience",
            "tag manager",
            "ua748443502",
            "utc gtmwrp73mt",
            "utc gsrdlm5jnx1",
            "utc aw937838002",
            "adsense na",
            "connect",
            "file type",
            "status code",
            "body length",
            "kb body",
            "sha256",
            "powershell",
            "b file",
            "ta0004 defense",
            "evasion ta0005",
            "command",
            "control ta0011",
            "c0002 wininet",
            "number",
            "azure rsa",
            "tls issuing",
            "cus subject",
            "stwa lredmond",
            "corporation cus",
            "algorithm",
            "cndigicert sha2",
            "secure server",
            "ca odigicert",
            "inc cus",
            "subject",
            "cnwe1 ogoogle",
            "trust",
            "cnmicrosoft ecc",
            "update secure",
            "server ca",
            "omicrosoft",
            "get http",
            "request",
            "windows nt",
            "win64",
            "khtml",
            "gecko",
            "response",
            "united",
            "search",
            "creation date",
            "expiration date",
            "name servers",
            "unknown soa",
            "germany unknown",
            "entries",
            "pulse submit",
            "url analysis",
            "date"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 304,
            "hostname": 796,
            "URL": 2590,
            "FileHash-SHA256": 2735,
            "FileHash-MD5": 253,
            "FileHash-SHA1": 144,
            "email": 1
          },
          "indicator_count": 6823,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "243 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "685186035e5fb63846d29e45",
          "name": "Regarding Minority Report 2.0 | Aggresive Remote device tracking (multiple) | Network Rat",
          "description": "Abuse.\nWhy is so much of this in plain sight? .\nMalicious tactics abused by  preemptive policing recently implemented by Tech Bros under current Trump administration.\nThee governing Cyber Defense / AI / Data collection firm. | foundry2-lbl.dvr.dn2.n-helix.com | \nhttp://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://nl.cyberriskalliance.com/assets/icons/twitter.png |\nhttps://axis.snxd.com/track/0\n| track.getbuilt.com  | \nRelates to Denver female \u2018allegedly\u2019 injured \u2018in PT.\nA malicious prosecution case against alleged victim after a Detective brought \u2018MTI\u2019 case to controlled Denver DA was dismissed by judge. Injured victim paid a pathetic settlement; especially considering the seriousness of the response of the government.  \nThis type\nof tracking silencing is critically dangerous. \nHosanna make no haste to rescue all\nof victims of civilian & victim targeting.\n*Crowdsourced",
          "modified": "2025-07-17T14:01:34.245000",
          "created": "2025-06-17T15:13:07.233000",
          "tags": [
            "body",
            "cps https",
            "location",
            "urls server",
            "cloudfront",
            "united",
            "unknown aaaa",
            "search",
            "digital press",
            "moved",
            "digital culture",
            "ip address",
            "creation date",
            "record value",
            "entries",
            "date",
            "meta",
            "urls",
            "http",
            "passive dns",
            "unique",
            "pulse pulses",
            "related nids",
            "files location",
            "flag united",
            "showing",
            "rich content",
            "system",
            "cdn amazon",
            "amazons3 tls",
            "certificate",
            "redirects",
            "ua9385760744",
            "utc na",
            "utc google",
            "tag manager",
            "gk4vnlmd3b9",
            "server",
            "amazon",
            "net1832001",
            "net18160001",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "present mar",
            "present feb",
            "unknown cname",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "aaaa"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 48,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2075,
            "URL": 5471,
            "hostname": 1531,
            "domain": 1013,
            "FileHash-MD5": 55,
            "FileHash-SHA1": 53,
            "CVE": 1,
            "SSLCertFingerprint": 1,
            "email": 1,
            "CIDR": 2
          },
          "indicator_count": 10203,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "276 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "685186983a4dd00c2b45b255",
          "name": "Source:\thttps://cloud.samsara.com/o/79639/flee",
          "description": "",
          "modified": "2025-07-17T14:01:34.245000",
          "created": "2025-06-17T15:15:36.505000",
          "tags": [
            "body",
            "cps https",
            "location",
            "urls server",
            "cloudfront",
            "united",
            "unknown aaaa",
            "search",
            "digital press",
            "moved",
            "digital culture",
            "ip address",
            "creation date",
            "record value",
            "entries",
            "date",
            "meta",
            "urls",
            "http",
            "passive dns",
            "unique",
            "pulse pulses",
            "related nids",
            "files location",
            "flag united",
            "showing",
            "rich content",
            "system",
            "cdn amazon",
            "amazons3 tls",
            "certificate",
            "redirects",
            "ua9385760744",
            "utc na",
            "utc google",
            "tag manager",
            "gk4vnlmd3b9",
            "server",
            "amazon",
            "net1832001",
            "net18160001",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "entity amazon4",
            "handle",
            "present mar",
            "present feb",
            "unknown cname",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "aaaa"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "685186035e5fb63846d29e45",
          "export_count": 47,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 2075,
            "URL": 5471,
            "hostname": 1531,
            "domain": 1013,
            "FileHash-MD5": 55,
            "FileHash-SHA1": 53,
            "CVE": 1,
            "SSLCertFingerprint": 1,
            "email": 1,
            "CIDR": 2
          },
          "indicator_count": 10203,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 139,
          "modified_text": "276 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684a93360163e8802e213158",
          "name": "ELF:Mirai AMAZON-02 - Autonomous System  65.0.0.0/14",
          "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features",
          "modified": "2025-07-12T07:04:05.635000",
          "created": "2025-06-12T08:43:34.719000",
          "tags": [
            "thumbprint",
            "apnic",
            "apnic whois",
            "database",
            "please",
            "arin whois",
            "north america",
            "caribbean",
            "africa",
            "internet",
            "iana",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "algorithm",
            "v3 serial",
            "number",
            "cbe oglobalsign",
            "r6 alphassl",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "link",
            "search",
            "united",
            "a domains",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "india unknown",
            "status",
            "passive dns",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "location india",
            "india asn",
            "as133296 web",
            "dns resolutions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 27,
            "domain": 2499,
            "hostname": 2651,
            "URL": 10986,
            "CIDR": 2,
            "FileHash-SHA256": 3596,
            "email": 1,
            "FileHash-MD5": 23,
            "CVE": 7
          },
          "indicator_count": 19792,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "281 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468500f573317422968c7c",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:52.404000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468501eb091ae414509121",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:53.417000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 137,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468505ee31db44fe063e82",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:57.123000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6846850783baea1a6beb7e71",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. I won\u2019t be surprised if OTX cannot pull the threat. My account isn\u2019t allowing me full permissions. \n\n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:53:59.933000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "68468511340fb7ba8eeb7aae",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:54:09.116000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6846860a0c5ff214f345717c",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:58:17.902000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6846860ee9b4faefae8d4cf9",
          "name": "Crowdsourced research | IP 192.229.221.95",
          "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
          "modified": "2025-07-09T05:00:24.293000",
          "created": "2025-06-09T06:58:22.091000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 12,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 284,
            "FileHash-SHA1": 285,
            "FileHash-SHA256": 3666,
            "domain": 511,
            "hostname": 845,
            "URL": 3282,
            "CVE": 2,
            "email": 1
          },
          "indicator_count": 8876,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "284 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "682fb4c264a51bf88115b6d2",
          "name": "allegro.pl/uzytkownik/adam_f.  vgt.pl , sanselo.pl, bipadorno.pl",
          "description": "https://www.virustotal.com/gui/file/db7d7637c8fa698616282e31b1541082751601b27a3e71ad18caf138451c346a/relations\nhttps://allegro.pl/uzytkownik/adam_f./ogrod-1532",
          "modified": "2025-06-22T07:00:28.087000",
          "created": "2025-05-22T23:35:30.122000",
          "tags": [
            "whasz"
          ],
          "references": [
            "https://allegro.pl/uzytkownik/adam_f./ogrod-1532",
            "https://allegro.pl/uzytkownik/adam_f.?srsltid=AfmBOoqX6vYV4qDgCzkkJhmipZLDrarI5MuggstojVsohtfiSM_s0jdd&dd_referrer=https://www.google.com/"
          ],
          "public": 1,
          "adversary": "fac1ec40eea5a4fc05f17e019328e287.wirus",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 17,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 163,
            "FileHash-SHA1": 162,
            "FileHash-SHA256": 1706,
            "domain": 596,
            "hostname": 1278,
            "URL": 6163
          },
          "indicator_count": 10068,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 122,
          "modified_text": "301 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "https://allegro.pl/uzytkownik/adam_f./ogrod-1532",
        "https://allegro.pl/uzytkownik/adam_f.?srsltid=AfmBOoqX6vYV4qDgCzkkJhmipZLDrarI5MuggstojVsohtfiSM_s0jdd&dd_referrer=https://www.google.com/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [
            "fac1ec40eea5a4fc05f17e019328e287.wirus"
          ],
          "malware_families": [
            "Apnic"
          ],
          "industries": [],
          "unique_indicators": 66494
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/microsoft-ppe.com",
    "whois": "http://whois.domaintools.com/microsoft-ppe.com",
    "domain": "microsoft-ppe.com",
    "hostname": "api.partnertransactassist.microsoft-ppe.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 13,
  "pulses": [
    {
      "id": "68596260a9ca6c4cc92ca068",
      "name": "Delete service | Affects Threat Research Platforms",
      "description": "Delete service attacking threat researchers platforms. Deletes , blocks, scrambles , attaches to accounts like an overlord monitoring and deletion of Io\u2019s across various platforms. \n\nIDS Rules: PROTOCOL-ICMP PATH MTU denial of service attempt\n\u2022 PROTOCOL-ICMP Destination Unreachable Fragmentation Needed and DF bit was set\n\u2022 Matches rule PROTOCOL-ICMP Echo Reply\nInteresting: TLS: SNI: slscr.update.microsoft.com\nSNI: nexusrules.officeapps.live.com\nSNI: login.live.com\nSNI: client.wns.windows.com",
      "modified": "2025-08-20T04:13:22.641000",
      "created": "2025-06-23T14:19:12.328000",
      "tags": [
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "oc0006",
        "get http",
        "resolved ips",
        "dns resolutions",
        "request",
        "response",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "ip address",
        "country name",
        "cname",
        "port",
        "accept",
        "gmt ifnonematch",
        "url data",
        "icmp",
        "mutexes nothing",
        "data",
        "datacrashpad",
        "edge",
        "created",
        "nothing",
        "html internet",
        "html document",
        "ascii text",
        "gtmkvjvztk dl"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 17,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 2401,
        "URL": 5856,
        "FileHash-SHA256": 3473,
        "domain": 2188,
        "FileHash-MD5": 123,
        "FileHash-SHA1": 120,
        "CVE": 2
      },
      "indicator_count": 14163,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "242 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "687d91b1a8f414040bfba430",
      "name": "Spyware",
      "description": "And I've been walking, talking\nBelieving the things that are true\nAnd I've been finding\nThe difference between right and wrong, bad and good\nSee me put things together\nPut them back where they belong\nWhen I look at each other\nHave I always been singing the same song?\n\nShe said\nThis is a perfect world\nRiding on an incline\nI'm staring in your face\nYou'll photograph mine\n\nI-I-I-I-I\nWhoo, ah-ha-ha\nHa-ha-ha-ha-ha-ha\n\nSomebody said that it happens all over the world\nI do believe that it's true (\u2022o\u2022)\n#spyware #MaaS #malvertizing #bullyfor$ #unethical #dangerous_tool",
      "modified": "2025-08-20T00:01:59.498000",
      "created": "2025-07-21T01:02:41.049000",
      "tags": [
        "serving ip",
        "address",
        "status",
        "utc na",
        "utc google",
        "utc facebook",
        "custom audience",
        "tag manager",
        "ua748443502",
        "utc gtmwrp73mt",
        "utc gsrdlm5jnx1",
        "utc aw937838002",
        "adsense na",
        "connect",
        "file type",
        "status code",
        "body length",
        "kb body",
        "sha256",
        "powershell",
        "b file",
        "ta0004 defense",
        "evasion ta0005",
        "command",
        "control ta0011",
        "c0002 wininet",
        "number",
        "azure rsa",
        "tls issuing",
        "cus subject",
        "stwa lredmond",
        "corporation cus",
        "algorithm",
        "cndigicert sha2",
        "secure server",
        "ca odigicert",
        "inc cus",
        "subject",
        "cnwe1 ogoogle",
        "trust",
        "cnmicrosoft ecc",
        "update secure",
        "server ca",
        "omicrosoft",
        "get http",
        "request",
        "windows nt",
        "win64",
        "khtml",
        "gecko",
        "response",
        "united",
        "search",
        "creation date",
        "expiration date",
        "name servers",
        "unknown soa",
        "germany unknown",
        "entries",
        "pulse submit",
        "url analysis",
        "date"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 304,
        "hostname": 796,
        "URL": 2590,
        "FileHash-SHA256": 2735,
        "FileHash-MD5": 253,
        "FileHash-SHA1": 144,
        "email": 1
      },
      "indicator_count": 6823,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "243 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "685186035e5fb63846d29e45",
      "name": "Regarding Minority Report 2.0 | Aggresive Remote device tracking (multiple) | Network Rat",
      "description": "Abuse.\nWhy is so much of this in plain sight? .\nMalicious tactics abused by  preemptive policing recently implemented by Tech Bros under current Trump administration.\nThee governing Cyber Defense / AI / Data collection firm. | foundry2-lbl.dvr.dn2.n-helix.com | \nhttp://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://foundry2-lbl.dvr.dn2.n-helix.com |\nhttps://nl.cyberriskalliance.com/assets/icons/twitter.png |\nhttps://axis.snxd.com/track/0\n| track.getbuilt.com  | \nRelates to Denver female \u2018allegedly\u2019 injured \u2018in PT.\nA malicious prosecution case against alleged victim after a Detective brought \u2018MTI\u2019 case to controlled Denver DA was dismissed by judge. Injured victim paid a pathetic settlement; especially considering the seriousness of the response of the government.  \nThis type\nof tracking silencing is critically dangerous. \nHosanna make no haste to rescue all\nof victims of civilian & victim targeting.\n*Crowdsourced",
      "modified": "2025-07-17T14:01:34.245000",
      "created": "2025-06-17T15:13:07.233000",
      "tags": [
        "body",
        "cps https",
        "location",
        "urls server",
        "cloudfront",
        "united",
        "unknown aaaa",
        "search",
        "digital press",
        "moved",
        "digital culture",
        "ip address",
        "creation date",
        "record value",
        "entries",
        "date",
        "meta",
        "urls",
        "http",
        "passive dns",
        "unique",
        "pulse pulses",
        "related nids",
        "files location",
        "flag united",
        "showing",
        "rich content",
        "system",
        "cdn amazon",
        "amazons3 tls",
        "certificate",
        "redirects",
        "ua9385760744",
        "utc na",
        "utc google",
        "tag manager",
        "gk4vnlmd3b9",
        "server",
        "amazon",
        "net1832001",
        "net18160001",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "present mar",
        "present feb",
        "unknown cname",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "aaaa"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 48,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2075,
        "URL": 5471,
        "hostname": 1531,
        "domain": 1013,
        "FileHash-MD5": 55,
        "FileHash-SHA1": 53,
        "CVE": 1,
        "SSLCertFingerprint": 1,
        "email": 1,
        "CIDR": 2
      },
      "indicator_count": 10203,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "276 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "685186983a4dd00c2b45b255",
      "name": "Source:\thttps://cloud.samsara.com/o/79639/flee",
      "description": "",
      "modified": "2025-07-17T14:01:34.245000",
      "created": "2025-06-17T15:15:36.505000",
      "tags": [
        "body",
        "cps https",
        "location",
        "urls server",
        "cloudfront",
        "united",
        "unknown aaaa",
        "search",
        "digital press",
        "moved",
        "digital culture",
        "ip address",
        "creation date",
        "record value",
        "entries",
        "date",
        "meta",
        "urls",
        "http",
        "passive dns",
        "unique",
        "pulse pulses",
        "related nids",
        "files location",
        "flag united",
        "showing",
        "rich content",
        "system",
        "cdn amazon",
        "amazons3 tls",
        "certificate",
        "redirects",
        "ua9385760744",
        "utc na",
        "utc google",
        "tag manager",
        "gk4vnlmd3b9",
        "server",
        "amazon",
        "net1832001",
        "net18160001",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "entity amazon4",
        "handle",
        "present mar",
        "present feb",
        "unknown cname",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "aaaa"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "685186035e5fb63846d29e45",
      "export_count": 47,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 2075,
        "URL": 5471,
        "hostname": 1531,
        "domain": 1013,
        "FileHash-MD5": 55,
        "FileHash-SHA1": 53,
        "CVE": 1,
        "SSLCertFingerprint": 1,
        "email": 1,
        "CIDR": 2
      },
      "indicator_count": 10203,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 139,
      "modified_text": "276 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "684a93360163e8802e213158",
      "name": "ELF:Mirai AMAZON-02 - Autonomous System  65.0.0.0/14",
      "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features",
      "modified": "2025-07-12T07:04:05.635000",
      "created": "2025-06-12T08:43:34.719000",
      "tags": [
        "thumbprint",
        "apnic",
        "apnic whois",
        "database",
        "please",
        "arin whois",
        "north america",
        "caribbean",
        "africa",
        "internet",
        "iana",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "algorithm",
        "v3 serial",
        "number",
        "cbe oglobalsign",
        "r6 alphassl",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "link",
        "search",
        "united",
        "a domains",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "india unknown",
        "status",
        "passive dns",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "urls",
        "files",
        "location india",
        "india asn",
        "as133296 web",
        "dns resolutions"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 27,
        "domain": 2499,
        "hostname": 2651,
        "URL": 10986,
        "CIDR": 2,
        "FileHash-SHA256": 3596,
        "email": 1,
        "FileHash-MD5": 23,
        "CVE": 7
      },
      "indicator_count": 19792,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "281 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468500f573317422968c7c",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:52.404000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468501eb091ae414509121",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:53.417000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 137,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468505ee31db44fe063e82",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:57.123000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6846850783baea1a6beb7e71",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. I won\u2019t be surprised if OTX cannot pull the threat. My account isn\u2019t allowing me full permissions. \n\n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:53:59.933000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "68468511340fb7ba8eeb7aae",
      "name": "Crowdsourced research | IP 192.229.221.95",
      "description": "Crowdsourced research. \t\nLegitimately contracted for all forms of surveillance & other unspeakable jobs against  crime victims.\nThis is as dangerous as it gets. The targets are sometimes individuals with absolutely no means of escape, I am speaking for crime victims, investigative journalists, insiders, informants, etc. This is outrageous. The highest level of threat as this is a global operation, primarily in the US with endless resources. No exaggerations. The warfare could , has and has been attempted to result in loss of life. There is quite a bit of information available regarding this merciless, meritless attacks. OTX  isn\u2019t allowing full permissions. \n| 1003.v.vgt.pl |\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian | \nfoundry2-lbl.dvr.dn2.n-helix.com | \n192.229.221.95 | \ndns0.org | cdnfastly.net",
      "modified": "2025-07-09T05:00:24.293000",
      "created": "2025-06-09T06:54:09.116000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 12,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 284,
        "FileHash-SHA1": 285,
        "FileHash-SHA256": 3666,
        "domain": 511,
        "hostname": 845,
        "URL": 3282,
        "CVE": 2,
        "email": 1
      },
      "indicator_count": 8876,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "284 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://api.partnertransactassist.microsoft-ppe.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://api.partnertransactassist.microsoft-ppe.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776643579.763434
}