{ "type": "URL", "indicator": "https://assets.feedblitzstatic.com/fb4ssl.css", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://assets.feedblitzstatic.com/fb4ssl.css", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 2913027112, "indicator": "https://assets.feedblitzstatic.com/fb4ssl.css", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 38, "pulses": [ { "id": "65b809ec9da9326e1bdf8743", "name": "Pegasus | Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com]", "description": "", "modified": "2024-01-29T20:26:20.769000", "created": "2024-01-29T20:26:20.769000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657feca7df9ea6c21350c01a", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "811 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65b809eabd76cbbfdfc07c6e", "name": "Pegasus | Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com]", "description": "", "modified": "2024-01-29T20:26:18.174000", "created": "2024-01-29T20:26:18.174000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657feca7df9ea6c21350c01a", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "811 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6581d8d30621e6303cad9da4", "name": "RallyPoint.com", "description": "", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-19T17:54:27.416000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657f69115e6b1bdc8a7dcdbc", "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657feca7df9ea6c21350c01a", "name": "Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com] ", "description": "", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-18T06:54:31.063000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657f6b136775cbf67d25ddfb", "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f6b136775cbf67d25ddfb", "name": "Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com] Alias Brian Sabey?", "description": "", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:41:39.434000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657f69115e6b1bdc8a7dcdbc", "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f6920d79aa646c2d5db49", "name": "RallyPoint.com", "description": "MyPublicWiFi.exe\nRallyPoint.com", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:33:20.787000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f6919cafcba3ac406d5b2", "name": "RallyPoint.com", "description": "MyPublicWiFi.exe\nRallyPoint.com", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:33:13.375000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f69115e6b1bdc8a7dcdbc", "name": "RallyPoint.com", "description": "MyPublicWiFi.exe\nRallyPoint.com", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:33:05.056000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4bc7487548e66d6f004", "name": "Virus:DOS/Goma", "description": "", "modified": "2023-12-06T16:43:40.375000", "created": "2023-12-06T16:43:40.375000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4b4259cafcf79907b2f", "name": "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection and Distribution", "description": "", "modified": "2023-12-06T16:43:32.408000", "created": "2023-12-06T16:43:32.408000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4ac54885a7e866cedca", "name": "Elevated Exposure", "description": "", "modified": "2023-12-06T16:43:24.027000", "created": "2023-12-06T16:43:24.027000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4a3ac21d7733c8e1040", "name": "Malvertising", "description": "", "modified": "2023-12-06T16:43:15.632000", "created": "2023-12-06T16:43:15.632000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a49b0b6595444a3fdd9a", "name": "passkey.tracker.net", "description": "", "modified": "2023-12-06T16:43:07.031000", "created": "2023-12-06T16:43:07.031000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 9, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a49207f81d6791c30194", "name": "Cyber Espionage w/B(.) Link / Infringement (Tracking)", "description": "", "modified": "2023-12-06T16:42:58.146000", "created": "2023-12-06T16:42:58.146000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4876f8d1d174f717e7b", "name": "Cyber Espionage w/B(.) Link / Infringement (Tracking)", "description": "", "modified": "2023-12-06T16:42:47.591000", "created": "2023-12-06T16:42:47.591000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a47e33876ed78e19e1da", "name": "Cyber Espionage w/B(.) Link / Infringement (Tracking)", "description": "", "modified": "2023-12-06T16:42:38.479000", "created": "2023-12-06T16:42:38.479000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570897ecb6cec4777625431", "name": "www.routerlogin.net", "description": "", "modified": "2023-12-06T14:47:26.604000", "created": "2023-12-06T14:47:26.604000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1532, "domain": 2033, "URL": 11153, "hostname": 2800, "FileHash-SHA1": 5, "email": 3, "FileHash-MD5": 6 }, "indicator_count": 17532, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657081c803964e671c853056", "name": "clarity elections.com", "description": "", "modified": "2023-12-06T14:14:32.101000", "created": "2023-12-06T14:14:32.101000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 819, "FileHash-SHA256": 1516, "hostname": 1515, "URL": 5858 }, "indicator_count": 9708, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570800373899fd03e2e49db", "name": "Democrats.org", "description": "", "modified": "2023-12-06T14:06:59.250000", "created": "2023-12-06T14:06:59.250000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 3114, "domain": 3501, "hostname": 3860, "URL": 17938, "FileHash-MD5": 2, "FileHash-SHA1": 10 }, "indicator_count": 28425, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707f519ef27fa72eb62598", "name": "CambridgeAnalytica.org", "description": "", "modified": "2023-12-06T14:04:01.301000", "created": "2023-12-06T14:04:01.301000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 335, "URL": 13379, "hostname": 2501, "domain": 1501, "FileHash-SHA1": 15 }, "indicator_count": 17731, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707eeab580f7de1a34f811", "name": "Slack.com", "description": "", "modified": "2023-12-06T14:02:18.654000", "created": "2023-12-06T14:02:18.654000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 2, "FileHash-SHA256": 745, "hostname": 1645, "URL": 5297, "domain": 1029, "email": 2, "FileHash-MD5": 8, "FileHash-SHA1": 3, "CIDR": 6 }, "indicator_count": 8737, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707ec3c760eea3873db672", "name": "BernieSanders.com (Pt.3)", "description": "", "modified": "2023-12-06T14:01:39.582000", "created": "2023-12-06T14:01:39.582000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 1950, "hostname": 1620, "domain": 900, "URL": 6563 }, "indicator_count": 11034, "is_author": false, "is_subscribing": null, "subscriber_count": 110, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65707e3f5ecd5ba2eb187178", "name": "Crowdstrike - ewe", "description": "", "modified": "2023-12-06T13:59:27.940000", "created": "2023-12-06T13:59:27.940000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1822, "domain": 2744, "hostname": 3486, "URL": 15692, "FileHash-MD5": 31, "FileHash-SHA1": 1 }, "indicator_count": 23776, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65036040d3847fa5df0b8496", "name": "passkey.tracker.net", "description": "", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:34:24.232000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "65035fea189a32c0498667d9", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65035fea189a32c0498667d9", "name": "Cyber Espionage w/B(.) Link / Infringement (Tracking)", "description": "Alert: nr-data.net private Apple) iOS Data Collection & Distribution. Automatically flags as an investigation. Tag 'police agency's auto generated. It's possible with Edward Snowden disclosures, it seems unlikely and completely unethical. Extremely graphic adult content with, beacons, tracking Malicious content poses a cyber threat to the general public , iOS privileges, mouse control, phishing, scanning, open registry, service execution, hooking, passkeys and more. \nAppears in a Japanese themed video game and paired targets. Male subject common name have a profession, many with same name. Female target is singular, occupation & professions. Verdict: cyber espionage threat targeting overtly tarnished female. Potential Spreading issues: False distribution by false distributers of targets, hacked, malware singed, intangible downloads. \nAdult content doesn't portray targets. Tagging. \n(New-Issued by Cloudflare \nshi(.)cloudflaressl(.)com)", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:32:58.552000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65035fec3cd7bba66ebcef0b", "name": "Cyber Espionage w/B(.) Link / Infringement (Tracking)", "description": "Alert: nr-data.net private Apple) iOS Data Collection & Distribution. Automatically flags as an investigation. Tag 'police agency's auto generated. It's possible with Edward Snowden disclosures, it seems unlikely and completely unethical. Extremely graphic adult content with, beacons, tracking Malicious content poses a cyber threat to the general public , iOS privileges, mouse control, phishing, scanning, open registry, service execution, hooking, passkeys and more. \nAppears in a Japanese themed video game and paired targets. Male subject common name have a profession, many with same name. Female target is singular, occupation & professions. Verdict: cyber espionage threat targeting overtly tarnished female. Potential Spreading issues: False distribution by false distributers of targets, hacked, malware singed, intangible downloads. \nAdult content doesn't portray targets. Tagging. \n(New-Issued by Cloudflare \nshi(.)cloudflaressl(.)com)", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:33:00.802000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65035fee309320821ec82f95", "name": "Cyber Espionage w/B(.) Link / Infringement (Tracking)", "description": "Alert: nr-data.net private Apple) iOS Data Collection & Distribution. Automatically flags as an investigation. Tag 'police agency's auto generated. It's possible with Edward Snowden disclosures, it seems unlikely and completely unethical. Extremely graphic adult content with, beacons, tracking Malicious content poses a cyber threat to the general public , iOS privileges, mouse control, phishing, scanning, open registry, service execution, hooking, passkeys and more. \nAppears in a Japanese themed video game and paired targets. Male subject common name have a profession, many with same name. Female target is singular, occupation & professions. Verdict: cyber espionage threat targeting overtly tarnished female. Potential Spreading issues: False distribution by false distributers of targets, hacked, malware singed, intangible downloads. \nAdult content doesn't portray targets. Tagging. \n(New-Issued by Cloudflare \nshi(.)cloudflaressl(.)com)", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:33:02.262000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 13, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6503610f5f100cd8acad748e", "name": "Malvertising", "description": "", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:37:51.730000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "65036040d3847fa5df0b8496", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 222, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6503612851bdda6828f488da", "name": "Elevated Exposure ", "description": "", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:38:16.617000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "6503610f5f100cd8acad748e", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6503618b59e32805d0bbead7", "name": "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection and Distribution ", "description": "", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:39:55.364000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "6503612851bdda6828f488da", "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "650361b276a56506778d9231", "name": "Virus:DOS/Goma", "description": "", "modified": "2023-10-14T17:02:29.483000", "created": "2023-09-14T19:40:34.562000", "tags": [ "resolutions", "referrer", "elevated exposure", "malformed links", "fraud", "abuse", "united", "cyber threat", "phishing", "blockchain", "covid19", "coalition", "engineering", "facebook", "police agency", "japan", "download", "blacklist", "site", "cisco umbrella", "assassin's pride chapter 12 scans", "chapter", "pride chapter", "assassin", "read", "viewed today", "promise", "apotheosis", "rampage", "magister", "goma", "conan", "magician", "click", "Suricata Alert", "Malvertising", "ssl certificate", "contacted", "execution", "whois record", "pfqlnhi4ex http", "pe resource", "investigation", "team", "metro", "malicious", "social engineering", "cyber crime Alina", "tracker(.)net", "spyware", "monitoring", "tracking", "MITRE ATT&CKS", "malware", "http://www.evantrah.com/b0ar/ (phishing)", "https(:)//b(.)link / infringement (tracking)", "37.235.49.205 (scan host)", "scan hosts", "passkey", "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection", "nr-data.net", "iOS Unlocker", "iOS Data Collection", "Private Data", "distribution", "hacking" ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America", "Japan", "Canada", "Germany" ], "malware_families": [ { "id": "Alina POS", "display_name": "Alina POS", "target": null }, { "id": "Virus:DOS/Goma", "display_name": "Virus:DOS/Goma", "target": "/malware/Virus:DOS/Goma" }, { "id": "DEcovid19", "display_name": "DEcovid19", "target": null }, { "id": "Assassin", "display_name": "Assassin", "target": null }, { "id": "Virus:Win32/Magistr", "display_name": "Virus:Win32/Magistr", "target": "/malware/Virus:Win32/Magistr" }, { "id": "Darktrack RAT", "display_name": "Darktrack RAT", "target": null }, { "id": "B.link/infringement (tracking)", "display_name": "B.link/infringement (tracking)", "target": null }, { "id": "Malware", "display_name": "Malware", "target": null }, { "id": "Trojan.Agent", "display_name": "Trojan.Agent", "target": null }, { "id": "TrojanDownloader:JS/MalSpam", "display_name": "TrojanDownloader:JS/MalSpam", "target": "/malware/TrojanDownloader:JS/MalSpam" } ], "attack_ids": [ { "id": "T1179", "name": "Hooking", "display_name": "T1179 - Hooking" }, { "id": "T1035", "name": "Service Execution", "display_name": "T1035 - Service Execution" }, { "id": "T1132", "name": "Data Encoding", "display_name": "T1132 - Data Encoding" }, { "id": "T1043", "name": "Commonly Used Port", "display_name": "T1043 - Commonly Used Port" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1071.002", "name": "File Transfer Protocols", "display_name": "T1071.002 - File Transfer Protocols" }, { "id": "TA0011", "name": "Command and Control", "display_name": "TA0011 - Command and Control" }, { "id": "TA0009", "name": "Collection", "display_name": "TA0009 - Collection" }, { "id": "T1449", "name": "Exploit SS7 to Redirect Phone Calls/SMS", "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS" } ], "industries": [], "TLP": "white", "cloned_from": "6503618b59e32805d0bbead7", "export_count": 15, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 2931, "domain": 1095, "hostname": 1798, "URL": 5593, "FileHash-MD5": 23, "FileHash-SHA1": 17, "CVE": 1 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "918 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6235e08a628e6c19d898f05c", "name": "www.routerlogin.net", "description": "", "modified": "2022-04-18T00:07:16.048000", "created": "2022-03-19T13:54:18.436000", "tags": [ "code", "server", "san jose", "date", "key identifier", "algorithm", "email", "registrar url", "registry domain", "registry expiry", "win32 exe", "win32 dll", "dos exe", "android", "librouter", "network capture", "thinclient", "setup", "type name", "referring", "technology", "dns replication", "security", "registrar abuse", "comodo valkyrie", "verdict mobile", "rank value", "ingestion time", "cisco umbrella", "dns records", "record type", "nreum", "httponly", "netgear router", "submission", "expirestue", "path", "netgear twitter", "router login", "nr agent", "Ransomware", "WannaCry" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "Win.Ransomware.WannaCry-9856297-0", "display_name": "Win.Ransomware.WannaCry-9856297-0", "target": null }, { "id": "Win32:Dracur-D\\ [Cryp]", "display_name": "Win32:Dracur-D\\ [Cryp]", "target": null }, { "id": "Worm:Win32/Krol.A", "display_name": "Worm:Win32/Krol.A", "target": "/malware/Worm:Win32/Krol.A" } ], "attack_ids": [], "industries": [ "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 18, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 1532, "domain": 2033, "hostname": 2800, "URL": 11153, "email": 3, "FileHash-MD5": 6, "FileHash-SHA1": 5 }, "indicator_count": 17532, "is_author": false, "is_subscribing": null, "subscriber_count": 414, "modified_text": "1463 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "622faed53b9d5fe0c1331f1a", "name": "clarity elections.com", "description": "", "modified": "2022-04-13T00:01:48.292000", "created": "2022-03-14T21:08:37.571000", "tags": [ "whois", "ssl certificate", "whois record", "arkeistealer", "prometei", "xanthe", "evilgrab", "plugx", "sunburst", "trochilus rat", "mirai", "test" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 5858, "hostname": 1515, "domain": 819, "FileHash-SHA256": 1516 }, "indicator_count": 9708, "is_author": false, "is_subscribing": null, "subscriber_count": 407, "modified_text": "1468 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6220c81aaf6fddde0116569a", "name": "Democrats.org", "description": "", "modified": "2022-04-02T00:04:50.405000", "created": "2022-03-03T13:52:26.328000", "tags": [ "date", "dns replication" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 17938, "hostname": 3860, "domain": 3501, "FileHash-SHA256": 3114, "FileHash-MD5": 2, "FileHash-SHA1": 10 }, "indicator_count": 28425, "is_author": false, "is_subscribing": null, "subscriber_count": 408, "modified_text": "1479 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "621927dd57ee9ed86aeb9cb4", "name": "CambridgeAnalytica.org", "description": "", "modified": "2022-03-27T00:00:39.057000", "created": "2022-02-25T19:02:53.023000", "tags": [ "win32 exe", "scott hanselman", "win32 dll", "llc creation", "date", "passive dns", "subdomains", "detections type", "name", "rich text", "format", "music", "first" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 6, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 13379, "hostname": 2501, "domain": 1501, "FileHash-SHA256": 335, "FileHash-SHA1": 15 }, "indicator_count": 17731, "is_author": false, "is_subscribing": null, "subscriber_count": 406, "modified_text": "1485 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6215065b2fb111b27c14329f", "name": "Slack.com", "description": "", "modified": "2022-03-24T00:00:00.271000", "created": "2022-02-22T15:50:51.008000", "tags": [ "markmonitor", "first", "graph summary", "server", "domain status", "date", "registrar abuse", "san francisco", "slack", "postal code", "contact phone", "registrar", "whois lookup", "code", "bitdefender im", "comodo valkyrie", "verdict mobile", "chatimsms", "rank value", "ingestion time", "majestic", "utc statvoo", "utc cisco", "umbrella", "key identifier", "x509v3 subject", "full name", "data", "v3 serial", "number", "issuer", "cus cndigicert", "tls rsa", "sha256", "microsoft", "virustotal box", "apples", "os x", "sandbox", "security", "technology", "passive dns", "subdomains", "whois record", "ssl certificate", "whois" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 54, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1645, "URL": 5297, "domain": 1029, "FileHash-SHA256": 745, "CVE": 2, "FileHash-MD5": 8, "FileHash-SHA1": 3, "CIDR": 6, "email": 2 }, "indicator_count": 8737, "is_author": false, "is_subscribing": null, "subscriber_count": 408, "modified_text": "1488 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6213f8adc8cfe3f681957ed1", "name": "BernieSanders.com (Pt.3)", "description": "", "modified": "2022-03-23T00:02:04.887000", "created": "2022-02-21T20:40:13.490000", "tags": [ "ssl certificate", "whois record", "whois" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Government" ], "TLP": "white", "cloned_from": null, "export_count": 5, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "hostname": 1620, "URL": 6563, "FileHash-SHA256": 1950, "domain": 900, "CVE": 1 }, "indicator_count": 11034, "is_author": false, "is_subscribing": null, "subscriber_count": 409, "modified_text": "1489 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "620c170de055c19dbfaf50d4", "name": "Crowdstrike - ewe", "description": "", "modified": "2022-03-17T00:01:08.614000", "created": "2022-02-15T21:11:41.916000", "tags": [ "whois record", "whois", "ssl certificate" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Kailula4", "id": "131997", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 15692, "domain": 2744, "hostname": 3486, "FileHash-SHA256": 1822, "FileHash-MD5": 31, "FileHash-SHA1": 1 }, "indicator_count": 23776, "is_author": false, "is_subscribing": null, "subscriber_count": 412, "modified_text": "1495 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "https://hifiporn.pw/xxx/1/white-dpt-jeffrey-reimer-loves-pretty-indian-patient-forces-sex-3gp-video-tsara-brashears/she-loves-how-i-pound-her-pussy", "http://mangahasu.se/assassins-pride/chapter-12-a-promise-c629157.html?__cf_chl_jschl_tk__=7b4aeee234e6fcb906189a0ee99bff391aedad3f-1591653736-0-ATuxnw3UaJxen2hXCyv", "Data Analysis", "Pattern Behavior Research" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Trojandownloader:js/malspam", "Virus:win32/magistr", "Assassin", "Alina pos", "Win32:dracur-d\\ [cryp]", "Darktrack rat", "B.link/infringement (tracking)", "Worm:win32/krol.a", "Malware", "Decovid19", "Win.ransomware.wannacry-9856297-0", "Trojan.agent", "Virus:dos/goma" ], "industries": [ "Government", "Technology" ], "unique_indicators": 139422 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/feedblitzstatic.com", "whois": "http://whois.domaintools.com/feedblitzstatic.com", "domain": "feedblitzstatic.com", "hostname": "assets.feedblitzstatic.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 38, "pulses": [ { "id": "65b809ec9da9326e1bdf8743", "name": "Pegasus | Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com]", "description": "", "modified": "2024-01-29T20:26:20.769000", "created": "2024-01-29T20:26:20.769000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657feca7df9ea6c21350c01a", "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 227, "modified_text": "811 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "65b809eabd76cbbfdfc07c6e", "name": "Pegasus | Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com]", "description": "", "modified": "2024-01-29T20:26:18.174000", "created": "2024-01-29T20:26:18.174000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657feca7df9ea6c21350c01a", "export_count": 10, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 228, "modified_text": "811 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6581d8d30621e6303cad9da4", "name": "RallyPoint.com", "description": "", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-19T17:54:27.416000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657f69115e6b1bdc8a7dcdbc", "export_count": 40, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 225, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657feca7df9ea6c21350c01a", "name": "Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com] ", "description": "", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-18T06:54:31.063000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657f6b136775cbf67d25ddfb", "export_count": 34, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "scoreblue", "id": "254100", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 226, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f6b136775cbf67d25ddfb", "name": "Lazarus Group [Hallrender.com = safebae.oeg + rallypoint.com] Alias Brian Sabey?", "description": "", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:41:39.434000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": "657f69115e6b1bdc8a7dcdbc", "export_count": 35, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f6920d79aa646c2d5db49", "name": "RallyPoint.com", "description": "MyPublicWiFi.exe\nRallyPoint.com", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:33:20.787000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 219, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f6919cafcba3ac406d5b2", "name": "RallyPoint.com", "description": "MyPublicWiFi.exe\nRallyPoint.com", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:33:13.375000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 37, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 221, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "657f69115e6b1bdc8a7dcdbc", "name": "RallyPoint.com", "description": "MyPublicWiFi.exe\nRallyPoint.com", "modified": "2024-01-16T18:00:08.947000", "created": "2023-12-17T21:33:05.056000", "tags": [ "united", "unknown", "as13335", "search", "showing", "aaaa", "emails", "name servers", "servers", "as54113", "body", "date", "as15169 google", "cname", "as393648", "moved", "creation date", "record value", "entries", "domain related", "domains show", "asn15169", "google", "frankfurt", "main", "germany", "http", "ashburn", "amazonaes", "asn16509", "facebook", "june", "general full", "url https", "reverse dns", "protocol h2", "security tls", "get h2", "software", "resource", "hash", "value", "search live", "api blog", "docs pricing", "login", "december", "variables", "paq object", "piwik", "matomo", "article", "join url", "facebook url", "threat report", "ip summary", "url summary", "summary", "sample", "samples", "detection list", "blacklist", "ip detail", "domains domain", "tree links", "certs frames", "cisco umbrella", "site", "alexa top", "safe site", "malware", "heur", "malware site", "malicious site", "million", "phishing site", "phishing", "unsafe", "applicunwnt", "artemis", "riskware", "revenue service", "iframe", "downldr", "agent", "presenoker", "vidar", "alexa", "ssl certificate", "whois record", "historical ssl", "urls http", "njrat", "ransomware", "communicating", "referrer", "whois whois", "hostname", "hostnames", "ip address", "javascript", "detections type", "name", "win32 exe", "email holokaust", "android", "files", "android file", "domains", "hashes", "westlaw njrat", "whois", "collections", "contacted", "pe resource", "threat roundup", "january", "collection", "august", "lolkek", "installer", "hacktool", "emotet", "lazarus", "makop", "core" ], "references": [], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [], "attack_ids": [ { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" } ], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 36, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "OctoSeek", "id": "243548", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 149, "FileHash-SHA1": 97, "URL": 15233, "domain": 3362, "email": 14, "hostname": 5001, "FileHash-SHA256": 2750, "CVE": 5 }, "indicator_count": 26611, "is_author": false, "is_subscribing": null, "subscriber_count": 220, "modified_text": "824 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4bc7487548e66d6f004", "name": "Virus:DOS/Goma", "description": "", "modified": "2023-12-06T16:43:40.375000", "created": "2023-12-06T16:43:40.375000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "6570a4b4259cafcf79907b2f", "name": "APPLE ALERT: nr-data.net - Private Apple and iOS Data Collection and Distribution", "description": "", "modified": "2023-12-06T16:43:32.408000", "created": "2023-12-06T16:43:32.408000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 8, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "CVE": 1, "FileHash-SHA256": 2931, "hostname": 1798, "FileHash-MD5": 23, "FileHash-SHA1": 17, "URL": 5593, "domain": 1095 }, "indicator_count": 11458, "is_author": false, "is_subscribing": null, "subscriber_count": 111, "modified_text": "865 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://assets.feedblitzstatic.com/fb4ssl.css", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://assets.feedblitzstatic.com/fb4ssl.css", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776661752.609058 }