{
  "type": "URL",
  "indicator": "https://attachment.pooban.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://attachment.pooban.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3783153940,
      "indicator": "https://attachment.pooban.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 12,
      "pulses": [
        {
          "id": "6952fbca42c1b0da7431e6a7",
          "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ",
          "description": "",
          "modified": "2025-12-29T22:08:10.280000",
          "created": "2025-12-29T22:08:10.280000",
          "tags": [
            "backdoor",
            "cyprus",
            "trojan",
            "mtb sep",
            "passive dns",
            "ddos",
            "mtb oct",
            "mtb aug",
            "ipv4 add",
            "smokeloader",
            "trojandropper",
            "extraction",
            "se extraction",
            "failed",
            "data upload",
            "enter s",
            "enter sc",
            "data u",
            "extrac please",
            "prop",
            "extre data",
            "type",
            "extr data",
            "include review",
            "exclude",
            "find s",
            "typ data",
            "source tir",
            "extri",
            "exclude sugges",
            "se type",
            "extra",
            "include data",
            "exclude review",
            "show",
            "showinil tvnes",
            "dom dom",
            "sc cat959",
            "drop",
            "pulse pulses",
            "worm",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "susp",
            "cyprus showing",
            "entries",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "date",
            "registrar",
            "se cre",
            "pul use",
            "url list",
            "status http",
            "linkid182227",
            "linkid151642",
            "first",
            "domain list",
            "ii llc",
            "sc data",
            "ukl extract",
            "hiloti style",
            "msle",
            "win3 data",
            "onio",
            "observea",
            "data data",
            "stop data",
            "monitored target",
            "tsara",
            "pegasus",
            "social engineering"
          ],
          "references": [
            "http://fakejuko.site40/",
            "pegacloud.net",
            "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "IDS: Win32/Ibashade CnC Beacon",
            "IDS: Win32.Scar.hhrw POST",
            "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
            "IDS: OnionDuke CnC Beacon 1",
            "IDS: Observed Suspicious UA (Mozilla/5.0)",
            "IDS: Data POST to an image file (jpg)",
            "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:WormX-gen [Wrm]",
              "display_name": "Win32:WormX-gen [Wrm]",
              "target": null
            },
            {
              "id": "Worm:Win32:Drolnux",
              "display_name": "Worm:Win32:Drolnux",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": "6877422df67773a07ef450c2",
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1630,
            "URL": 4078,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 246,
            "FileHash-SHA256": 2561,
            "CVE": 2,
            "domain": 1307,
            "email": 1
          },
          "indicator_count": 10070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 140,
          "modified_text": "111 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6877422df67773a07ef450c2",
          "name": "Pegasus / Pegacloud - Infiltration",
          "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.",
          "modified": "2025-08-15T05:01:22.570000",
          "created": "2025-07-16T06:09:49.704000",
          "tags": [
            "backdoor",
            "cyprus",
            "trojan",
            "mtb sep",
            "passive dns",
            "ddos",
            "mtb oct",
            "mtb aug",
            "ipv4 add",
            "smokeloader",
            "trojandropper",
            "extraction",
            "se extraction",
            "failed",
            "data upload",
            "enter s",
            "enter sc",
            "data u",
            "extrac please",
            "prop",
            "extre data",
            "type",
            "extr data",
            "include review",
            "exclude",
            "find s",
            "typ data",
            "source tir",
            "extri",
            "exclude sugges",
            "se type",
            "extra",
            "include data",
            "exclude review",
            "show",
            "showinil tvnes",
            "dom dom",
            "sc cat959",
            "drop",
            "pulse pulses",
            "worm",
            "files show",
            "date hash",
            "avast avg",
            "win32",
            "susp",
            "cyprus showing",
            "entries",
            "next associated",
            "urls show",
            "date checked",
            "url hostname",
            "server response",
            "ip address",
            "google safe",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "date",
            "registrar",
            "se cre",
            "pul use",
            "url list",
            "status http",
            "linkid182227",
            "linkid151642",
            "first",
            "domain list",
            "ii llc",
            "sc data",
            "ukl extract",
            "hiloti style",
            "msle",
            "win3 data",
            "onio",
            "observea",
            "data data",
            "stop data",
            "monitored target",
            "tsara",
            "pegasus",
            "social engineering"
          ],
          "references": [
            "http://fakejuko.site40/",
            "pegacloud.net",
            "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
            "IDS: Win32/Ibashade CnC Beacon",
            "IDS: Win32.Scar.hhrw POST",
            "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
            "IDS: OnionDuke CnC Beacon 1",
            "IDS: Observed Suspicious UA (Mozilla/5.0)",
            "IDS: Data POST to an image file (jpg)",
            "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Win32:WormX-gen [Wrm]",
              "display_name": "Win32:WormX-gen [Wrm]",
              "target": null
            },
            {
              "id": "Worm:Win32:Drolnux",
              "display_name": "Worm:Win32:Drolnux",
              "target": null
            },
            {
              "id": "Pegasus - MOB-S0005",
              "display_name": "Pegasus - MOB-S0005",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [
            "Technology",
            "Telecommunications",
            "Government"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 20,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 1630,
            "URL": 4078,
            "FileHash-MD5": 245,
            "FileHash-SHA1": 246,
            "FileHash-SHA256": 2561,
            "CVE": 2,
            "domain": 1307,
            "email": 1
          },
          "indicator_count": 10070,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "248 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "684a93360163e8802e213158",
          "name": "ELF:Mirai AMAZON-02 - Autonomous System  65.0.0.0/14",
          "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features",
          "modified": "2025-07-12T07:04:05.635000",
          "created": "2025-06-12T08:43:34.719000",
          "tags": [
            "thumbprint",
            "apnic",
            "apnic whois",
            "database",
            "please",
            "arin whois",
            "north america",
            "caribbean",
            "africa",
            "internet",
            "iana",
            "address range",
            "cidr",
            "network name",
            "allocation type",
            "whois server",
            "algorithm",
            "v3 serial",
            "number",
            "cbe oglobalsign",
            "r6 alphassl",
            "validity",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "link",
            "search",
            "united",
            "a domains",
            "ip address",
            "creation date",
            "record value",
            "date",
            "showing",
            "india unknown",
            "status",
            "passive dns",
            "ipv4 add",
            "pulse submit",
            "url analysis",
            "urls",
            "files",
            "location india",
            "india asn",
            "as133296 web",
            "dns resolutions"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "APNIC",
              "display_name": "APNIC",
              "target": null
            }
          ],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA1": 27,
            "domain": 2499,
            "hostname": 2651,
            "URL": 10986,
            "CIDR": 2,
            "FileHash-SHA256": 3596,
            "email": 1,
            "FileHash-MD5": 23,
            "CVE": 7
          },
          "indicator_count": 19792,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 141,
          "modified_text": "282 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ad83180deb1186bb4f466",
          "name": "Carrotbat Malware | Stalker Suite |  gogglemaps.com",
          "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools, botnetwork \nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)",
          "modified": "2023-12-20T02:02:59.943000",
          "created": "2023-11-20T03:53:21.699000",
          "tags": [
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "tls web",
            "encrypt",
            "ca issuers",
            "f9970e",
            "bd6en timestamp",
            "a487132c3b",
            "false",
            "ssl certificate",
            "tsara brashears",
            "contacted",
            "referrer",
            "copy",
            "historical ssl",
            "collections",
            "password",
            "networks",
            "botnet campaign",
            "skynet",
            "fall",
            "hacktool",
            "malware",
            "critical",
            "relic",
            "monitoring",
            "attack",
            "hiddentear",
            "metro",
            "test",
            "detection list",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "temp",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "unknown",
            "meta",
            "span",
            "error",
            "refresh",
            "body",
            "generator",
            "look",
            "verify",
            "restart",
            "hybrid",
            "accept",
            "click",
            "strings",
            "tools",
            "whois record",
            "msgid10053",
            "msgid10051",
            "communicating",
            "anid",
            "execution",
            "null",
            "core",
            "installer",
            "threat roundup",
            "apple ios",
            "august",
            "highly targeted",
            "apple",
            "sqli dumper",
            "april",
            "february",
            "awful",
            "radar ineractive",
            "october",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "cisco umbrella",
            "site",
            "wormx",
            "malicious site",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "phishing site",
            "alexa",
            "phishing",
            "agent",
            "bank",
            "inmortal",
            "united",
            "cyber threat",
            "pony",
            "cnc zeus",
            "tracker",
            "cnc server",
            "covid19",
            "engineering",
            "http spammer",
            "host",
            "azorult",
            "asyncrat",
            "cobalt strike",
            "team",
            "hsbc",
            "noname057",
            "generic malware",
            "blacklist http",
            "malicious url"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 815,
            "FileHash-SHA256": 3404,
            "SSLCertFingerprint": 2,
            "URL": 8938,
            "domain": 1195,
            "hostname": 2705,
            "FileHash-SHA1": 457,
            "CIDR": 7,
            "CVE": 3
          },
          "indicator_count": 17526,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655ad8e83914549cd4658f8e",
          "name": "Radar Ineractive \u2022 Inmortal \u2022 HSBC.com",
          "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools,\nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)\nRadar Ineractive \u2022 Inmortal \u2022 HSBC.com",
          "modified": "2023-12-20T02:02:59.943000",
          "created": "2023-11-20T03:56:24.105000",
          "tags": [
            "log id",
            "gmtn",
            "passive dns",
            "urls",
            "tls web",
            "encrypt",
            "ca issuers",
            "f9970e",
            "bd6en timestamp",
            "a487132c3b",
            "false",
            "ssl certificate",
            "tsara brashears",
            "contacted",
            "referrer",
            "copy",
            "historical ssl",
            "collections",
            "password",
            "networks",
            "botnet campaign",
            "skynet",
            "fall",
            "hacktool",
            "malware",
            "critical",
            "relic",
            "monitoring",
            "attack",
            "hiddentear",
            "metro",
            "test",
            "detection list",
            "pattern match",
            "root ca",
            "authority",
            "class",
            "script",
            "mitre att",
            "temp",
            "ck id",
            "show technique",
            "ck matrix",
            "date",
            "unknown",
            "meta",
            "span",
            "error",
            "refresh",
            "body",
            "generator",
            "look",
            "verify",
            "restart",
            "hybrid",
            "accept",
            "click",
            "strings",
            "tools",
            "whois record",
            "msgid10053",
            "msgid10051",
            "communicating",
            "anid",
            "execution",
            "null",
            "core",
            "installer",
            "threat roundup",
            "apple ios",
            "august",
            "highly targeted",
            "apple",
            "sqli dumper",
            "april",
            "february",
            "awful",
            "radar ineractive",
            "october",
            "no data",
            "tag count",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "blacklist",
            "cisco umbrella",
            "site",
            "wormx",
            "malicious site",
            "safe site",
            "malware site",
            "alexa top",
            "million",
            "phishing site",
            "alexa",
            "phishing",
            "agent",
            "bank",
            "inmortal",
            "united",
            "cyber threat",
            "pony",
            "cnc zeus",
            "tracker",
            "cnc server",
            "covid19",
            "engineering",
            "http spammer",
            "host",
            "azorult",
            "asyncrat",
            "cobalt strike",
            "team",
            "hsbc"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Radar Ineractive",
              "display_name": "Radar Ineractive",
              "target": null
            },
            {
              "id": "Inmortal",
              "display_name": "Inmortal",
              "target": null
            },
            {
              "id": "HSBC",
              "display_name": "HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059",
              "name": "Command and Scripting Interpreter",
              "display_name": "T1059 - Command and Scripting Interpreter"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1100",
              "name": "Web Shell",
              "display_name": "T1100 - Web Shell"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1560",
              "name": "Archive Collected Data",
              "display_name": "T1560 - Archive Collected Data"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1176",
              "name": "Browser Extensions",
              "display_name": "T1176 - Browser Extensions"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 21,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 815,
            "FileHash-SHA256": 3404,
            "SSLCertFingerprint": 2,
            "URL": 8938,
            "domain": 1194,
            "hostname": 2705,
            "FileHash-SHA1": 457,
            "CIDR": 7,
            "CVE": 3
          },
          "indicator_count": 17525,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "852 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655650c9b2be6cc930c92cf3",
          "name": "https://myaccount.uscis.gov/",
          "description": "HOW!?!? My device was remotely logged into this account somehow.\nThis is egregious. Silence  Threats. I have no connection to this but was contacted by a while ago. I don't know how or why a part of the government would attack a person with a TBI and C1 - S1 Spinal cord injury allegedly caused by Colorado physical therapist and protect him. Why  is victim, tracked and unsafe, receiving death threats, monitored, denied medical care, stalked EVERYWHERE.   \nEven felons aren't monitored for life. STOP.\nWill this get us killed. Do the right thing.\nGod bless America, purge the government.\nThe truth should set you fee not get you harmed.",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:26:33",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 102,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655652f6ddcbf952a599cded",
          "name": "https://myaccount.uscis.gov/",
          "description": "After Mark Montano Md reported alleged acts by Jeffrey Scott Reimer after receiving 'multiple' reports of him aggressively pursuing Brashears, she was contacted, told she violated the Patriot Act by Big O Tires?!! Received letters from the above and harassed for years. Colorado Workers compensation is so corrupt this may be my last post. She was immediately framed , blamed, porn smeared and stalked. Denied medical care , when received died on surgery table, revised and disabled. Even the mafia would  tackle only the associates bringing undue negative attention to their  own organization.",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:35:50.285000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 100,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65565477da453c46f05a6ac4",
          "name": "BTW VirusTotal - \" interesting files written to disk during execution'",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:42:15.123000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 101,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 223,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655657ca2e402d4f98283de9",
          "name": "https://myaccount.uscis.gov/ ",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T17:56:26.312000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 100,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "655686e2c072557f03e9cba2",
          "name": "https://myaccount.uscis.gov/                         [pulse created by Octoseek]",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-16T21:17:22.087000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 102,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65580c52bf98f256b6a01da6",
          "name": "https://myaccount.uscis.gov/",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-11-18T00:58:58.944000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655650c9b2be6cc930c92cf3",
          "export_count": 101,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "656aac25a8a2caaddf0d3b88",
          "name": "https://myaccount.uscis.gov/",
          "description": "",
          "modified": "2023-12-16T15:00:49.451000",
          "created": "2023-12-02T04:01:41.427000",
          "tags": [
            "whois record",
            "ssl certificate",
            "whois whois",
            "communicating",
            "referrer",
            "ip address",
            "contacted",
            "pe resource",
            "historical ssl",
            "collections wow",
            "cobalt",
            "stealer",
            "quasar",
            "remcos",
            "ursnif",
            "fabookie",
            "name verdict",
            "exit",
            "node tcp",
            "traffic",
            "united",
            "et tor",
            "known tor",
            "relayrouter",
            "anonymizer",
            "tor known",
            "tor relayrouter",
            "cisco umbrella",
            "site",
            "safe site",
            "heur",
            "maltiverse",
            "million",
            "alexa top",
            "unsafe",
            "html",
            "team",
            "riskware",
            "malware",
            "phishing",
            "union",
            "bank",
            "outbreak",
            "downer",
            "shell",
            "mediamagnet",
            "sality",
            "swrort",
            "adaptivebee",
            "unruy",
            "iobit",
            "dropper",
            "trojanx",
            "artemis",
            "installcore",
            "webshell",
            "exploit",
            "crack",
            "webtoolbar",
            "detection list",
            "blacklist http",
            "september",
            "threat roundup",
            "execution",
            "metro",
            "formbook",
            "kgs0",
            "kls0",
            "blacklist https",
            "malicious site",
            "malware site",
            "phishing site",
            "download",
            "malicious",
            "azorult",
            "service",
            "runescape",
            "facebook",
            "genkryptik",
            "fuery",
            "wacatac",
            "alexa",
            "dbatloader",
            "nanocore rat",
            "agent tesla",
            "binder",
            "dridex",
            "hawkeye",
            "small",
            "netwire",
            "trojan",
            "redline stealer",
            "lumma stealer",
            "trojanspy",
            "redline",
            "lumma",
            "tsara brashears",
            "whois",
            "asn owner",
            "highly targeted",
            "relacionada",
            "lolkek",
            "emotet",
            "dark power",
            "wiper",
            "ransomware",
            "cobalt strike",
            "quasar rat",
            "core",
            "bitrat",
            "hacktool",
            "critical",
            "copy",
            "installer",
            "meta",
            "as15169 google",
            "aaaa",
            "a domains",
            "videosdewebcams",
            "search",
            "passive dns",
            "urls",
            "record value",
            "date",
            "certificate",
            "scan endpoints",
            "all octoseek",
            "pulse pulses",
            "files"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America",
            "Germany"
          ],
          "malware_families": [
            {
              "id": "WebToolbar",
              "display_name": "WebToolbar",
              "target": null
            },
            {
              "id": "TrojanSpy",
              "display_name": "TrojanSpy",
              "target": null
            },
            {
              "id": "RedLine",
              "display_name": "RedLine",
              "target": null
            },
            {
              "id": "Lumma",
              "display_name": "Lumma",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1090",
              "name": "Proxy",
              "display_name": "T1090 - Proxy"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "655652f6ddcbf952a599cded",
          "export_count": 93,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 204,
            "FileHash-SHA1": 182,
            "FileHash-SHA256": 6268,
            "URL": 13989,
            "domain": 3229,
            "hostname": 4412,
            "CVE": 19,
            "email": 3
          },
          "indicator_count": 28306,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 227,
          "modified_text": "855 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "pegacloud.net",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "http://fakejuko.site40/",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: Data POST to an image file (jpg)",
        "IDS: Win32.Scar.hhrw POST"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Trojanspy",
            "Radar ineractive",
            "Apnic",
            "Redline",
            "Hsbc",
            "Pegasus - mob-s0005",
            "Win32:wormx-gen [wrm]",
            "Worm:win32:drolnux",
            "Inmortal",
            "Lumma",
            "Webtoolbar"
          ],
          "industries": [
            "Technology",
            "Government",
            "Telecommunications"
          ],
          "unique_indicators": 72062
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/pooban.com",
    "whois": "http://whois.domaintools.com/pooban.com",
    "domain": "pooban.com",
    "hostname": "attachment.pooban.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 12,
  "pulses": [
    {
      "id": "6952fbca42c1b0da7431e6a7",
      "name": "Pegasus / Pegacloud - Infiltration (10-2013 or 2014 to Current/ Ongoing) ",
      "description": "",
      "modified": "2025-12-29T22:08:10.280000",
      "created": "2025-12-29T22:08:10.280000",
      "tags": [
        "backdoor",
        "cyprus",
        "trojan",
        "mtb sep",
        "passive dns",
        "ddos",
        "mtb oct",
        "mtb aug",
        "ipv4 add",
        "smokeloader",
        "trojandropper",
        "extraction",
        "se extraction",
        "failed",
        "data upload",
        "enter s",
        "enter sc",
        "data u",
        "extrac please",
        "prop",
        "extre data",
        "type",
        "extr data",
        "include review",
        "exclude",
        "find s",
        "typ data",
        "source tir",
        "extri",
        "exclude sugges",
        "se type",
        "extra",
        "include data",
        "exclude review",
        "show",
        "showinil tvnes",
        "dom dom",
        "sc cat959",
        "drop",
        "pulse pulses",
        "worm",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "susp",
        "cyprus showing",
        "entries",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "date",
        "registrar",
        "se cre",
        "pul use",
        "url list",
        "status http",
        "linkid182227",
        "linkid151642",
        "first",
        "domain list",
        "ii llc",
        "sc data",
        "ukl extract",
        "hiloti style",
        "msle",
        "win3 data",
        "onio",
        "observea",
        "data data",
        "stop data",
        "monitored target",
        "tsara",
        "pegasus",
        "social engineering"
      ],
      "references": [
        "http://fakejuko.site40/",
        "pegacloud.net",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Win32.Scar.hhrw POST",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Data POST to an image file (jpg)",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:WormX-gen [Wrm]",
          "display_name": "Win32:WormX-gen [Wrm]",
          "target": null
        },
        {
          "id": "Worm:Win32:Drolnux",
          "display_name": "Worm:Win32:Drolnux",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": "6877422df67773a07ef450c2",
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1630,
        "URL": 4078,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 246,
        "FileHash-SHA256": 2561,
        "CVE": 2,
        "domain": 1307,
        "email": 1
      },
      "indicator_count": 10070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 140,
      "modified_text": "111 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6877422df67773a07ef450c2",
      "name": "Pegasus / Pegacloud - Infiltration",
      "description": "Pegasus IoC\u2019s found in the periphery of research. Appears target contacted a \u2018fake host\u2019 after finding name in multiple highly malicious domains. May have appeared between 12/2013 - 11-2014. Target was contacted by telephone and asked \u2018 have you checked Googled yourself\u2019, to which target answered \u2018Not really\u2019. Target was told \u2018you really should Google yourself\u2019. Target, upset about content clicked and began a takedown effort with host.\n\nThis seems to be at the start of many malicious campaigns. Requires further investigation.",
      "modified": "2025-08-15T05:01:22.570000",
      "created": "2025-07-16T06:09:49.704000",
      "tags": [
        "backdoor",
        "cyprus",
        "trojan",
        "mtb sep",
        "passive dns",
        "ddos",
        "mtb oct",
        "mtb aug",
        "ipv4 add",
        "smokeloader",
        "trojandropper",
        "extraction",
        "se extraction",
        "failed",
        "data upload",
        "enter s",
        "enter sc",
        "data u",
        "extrac please",
        "prop",
        "extre data",
        "type",
        "extr data",
        "include review",
        "exclude",
        "find s",
        "typ data",
        "source tir",
        "extri",
        "exclude sugges",
        "se type",
        "extra",
        "include data",
        "exclude review",
        "show",
        "showinil tvnes",
        "dom dom",
        "sc cat959",
        "drop",
        "pulse pulses",
        "worm",
        "files show",
        "date hash",
        "avast avg",
        "win32",
        "susp",
        "cyprus showing",
        "entries",
        "next associated",
        "urls show",
        "date checked",
        "url hostname",
        "server response",
        "ip address",
        "google safe",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "date",
        "registrar",
        "se cre",
        "pul use",
        "url list",
        "status http",
        "linkid182227",
        "linkid151642",
        "first",
        "domain list",
        "ii llc",
        "sc data",
        "ukl extract",
        "hiloti style",
        "msle",
        "win3 data",
        "onio",
        "observea",
        "data data",
        "stop data",
        "monitored target",
        "tsara",
        "pegasus",
        "social engineering"
      ],
      "references": [
        "http://fakejuko.site40/",
        "pegacloud.net",
        "IDS: Hiloti Style GET to PHP with invalid terse MSIE headers",
        "IDS: Win32/Ibashade CnC Beacon",
        "IDS: Win32.Scar.hhrw POST",
        "IDS: Trojan.Win32.Cosmu.cdqg Checkin",
        "IDS: OnionDuke CnC Beacon 1",
        "IDS: Observed Suspicious UA (Mozilla/5.0)",
        "IDS: Data POST to an image file (jpg)",
        "cwt-cwtcxp1-dt1.pegacloud.net\t\u2022 fortrea-prod1.pegacloud.net \u2022 ssl-ssldmp-dt1-sftp.pegacloud.net \u2022 13.40.20.221 \u2022 44.215.155.206 \u2022 44.226.180.214"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Win32:WormX-gen [Wrm]",
          "display_name": "Win32:WormX-gen [Wrm]",
          "target": null
        },
        {
          "id": "Worm:Win32:Drolnux",
          "display_name": "Worm:Win32:Drolnux",
          "target": null
        },
        {
          "id": "Pegasus - MOB-S0005",
          "display_name": "Pegasus - MOB-S0005",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [
        "Technology",
        "Telecommunications",
        "Government"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 20,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 1630,
        "URL": 4078,
        "FileHash-MD5": 245,
        "FileHash-SHA1": 246,
        "FileHash-SHA256": 2561,
        "CVE": 2,
        "domain": 1307,
        "email": 1
      },
      "indicator_count": 10070,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "248 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "684a93360163e8802e213158",
      "name": "ELF:Mirai AMAZON-02 - Autonomous System  65.0.0.0/14",
      "description": "ELF:Mirai-BHZ\\ [Trj]\t\n65.0.0.0/14\nAutonomous System Number\n16509\nAutonomous System Label\nAMAZON-02\nRelated to \u2022 103.252.236.26 | \n\u2022 sr2.reliedhosting.com | \n.\u2022 http://planitair.com/ |\n\u2022 bgptools-wildcard-confirmed.acemalibu.com | \n\u2022 https://www.anyxxxtube.net/search-porn/tsara-brashears/ | \t\t\t\n\u2022 static.ads-twitter.com\t\n\u2022 https://twitter.com/PORNO_SEXYBABES\t\n\u2022 analytics.twitter.com\n\u2022 appleupdate.org\n\u2022 apps.apple.com\n\u2022 pin.it |\n\u2022 https://pin.it/ |\n\u2022 https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian  Critical issue. Cyber weaponry [Unclear] Stealth contractual US cyber defense entity, endless DGA\u2019s. India IP block.\nAdversary named by bupyeongop:\n\ubd80\ud3c9\uc624\ud53c \ucd9c\uc7a5\ub9c8\uc0ac\uc9c0\uc548\ub0b4.COM \ubd80\ud3c9OP (massage service?)\n*DoS with many OTX features",
      "modified": "2025-07-12T07:04:05.635000",
      "created": "2025-06-12T08:43:34.719000",
      "tags": [
        "thumbprint",
        "apnic",
        "apnic whois",
        "database",
        "please",
        "arin whois",
        "north america",
        "caribbean",
        "africa",
        "internet",
        "iana",
        "address range",
        "cidr",
        "network name",
        "allocation type",
        "whois server",
        "algorithm",
        "v3 serial",
        "number",
        "cbe oglobalsign",
        "r6 alphassl",
        "validity",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "link",
        "search",
        "united",
        "a domains",
        "ip address",
        "creation date",
        "record value",
        "date",
        "showing",
        "india unknown",
        "status",
        "passive dns",
        "ipv4 add",
        "pulse submit",
        "url analysis",
        "urls",
        "files",
        "location india",
        "india asn",
        "as133296 web",
        "dns resolutions"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "APNIC",
          "display_name": "APNIC",
          "target": null
        }
      ],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 28,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA1": 27,
        "domain": 2499,
        "hostname": 2651,
        "URL": 10986,
        "CIDR": 2,
        "FileHash-SHA256": 3596,
        "email": 1,
        "FileHash-MD5": 23,
        "CVE": 7
      },
      "indicator_count": 19792,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 141,
      "modified_text": "282 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ad83180deb1186bb4f466",
      "name": "Carrotbat Malware | Stalker Suite |  gogglemaps.com",
      "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools, botnetwork \nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)",
      "modified": "2023-12-20T02:02:59.943000",
      "created": "2023-11-20T03:53:21.699000",
      "tags": [
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "tls web",
        "encrypt",
        "ca issuers",
        "f9970e",
        "bd6en timestamp",
        "a487132c3b",
        "false",
        "ssl certificate",
        "tsara brashears",
        "contacted",
        "referrer",
        "copy",
        "historical ssl",
        "collections",
        "password",
        "networks",
        "botnet campaign",
        "skynet",
        "fall",
        "hacktool",
        "malware",
        "critical",
        "relic",
        "monitoring",
        "attack",
        "hiddentear",
        "metro",
        "test",
        "detection list",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "temp",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "unknown",
        "meta",
        "span",
        "error",
        "refresh",
        "body",
        "generator",
        "look",
        "verify",
        "restart",
        "hybrid",
        "accept",
        "click",
        "strings",
        "tools",
        "whois record",
        "msgid10053",
        "msgid10051",
        "communicating",
        "anid",
        "execution",
        "null",
        "core",
        "installer",
        "threat roundup",
        "apple ios",
        "august",
        "highly targeted",
        "apple",
        "sqli dumper",
        "april",
        "february",
        "awful",
        "radar ineractive",
        "october",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist",
        "cisco umbrella",
        "site",
        "wormx",
        "malicious site",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "phishing site",
        "alexa",
        "phishing",
        "agent",
        "bank",
        "inmortal",
        "united",
        "cyber threat",
        "pony",
        "cnc zeus",
        "tracker",
        "cnc server",
        "covid19",
        "engineering",
        "http spammer",
        "host",
        "azorult",
        "asyncrat",
        "cobalt strike",
        "team",
        "hsbc",
        "noname057",
        "generic malware",
        "blacklist http",
        "malicious url"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Radar Ineractive",
          "display_name": "Radar Ineractive",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 815,
        "FileHash-SHA256": 3404,
        "SSLCertFingerprint": 2,
        "URL": 8938,
        "domain": 1195,
        "hostname": 2705,
        "FileHash-SHA1": 457,
        "CIDR": 7,
        "CVE": 3
      },
      "indicator_count": 17526,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655ad8e83914549cd4658f8e",
      "name": "Radar Ineractive \u2022 Inmortal \u2022 HSBC.com",
      "description": "carrotbat malware, SHAREit services.exe, typosquatting, fraud services, privilege, location tracking, cyber stalking, masquerading, malvertizing, malicious website, C2, control, apple, android, services, CNC, hack tools,\nMaps are real tools. \nhttps://www.anyxxxtube.net/search-porn/tsara-brashears/ (phishing & botnetwork)\nhttp://45.159.189.105/bot/regex (Botnetwork)\nhttps://www.sweetheartvideo.com/tsara-brashears/\nwww.sweetheartvideo.com\t(Tsara Brashears Botnetwork created by attacker)\nhttp://182.22.25.124:7878/182.22.25.124:443\nhttps://pin.it/ (aka malicious Pinterest)\nhttps://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian (100% straight female target - defamation, libel)\ndis.io\npin.it (changed targets Pinterest to this)\nRadar Ineractive \u2022 Inmortal \u2022 HSBC.com",
      "modified": "2023-12-20T02:02:59.943000",
      "created": "2023-11-20T03:56:24.105000",
      "tags": [
        "log id",
        "gmtn",
        "passive dns",
        "urls",
        "tls web",
        "encrypt",
        "ca issuers",
        "f9970e",
        "bd6en timestamp",
        "a487132c3b",
        "false",
        "ssl certificate",
        "tsara brashears",
        "contacted",
        "referrer",
        "copy",
        "historical ssl",
        "collections",
        "password",
        "networks",
        "botnet campaign",
        "skynet",
        "fall",
        "hacktool",
        "malware",
        "critical",
        "relic",
        "monitoring",
        "attack",
        "hiddentear",
        "metro",
        "test",
        "detection list",
        "pattern match",
        "root ca",
        "authority",
        "class",
        "script",
        "mitre att",
        "temp",
        "ck id",
        "show technique",
        "ck matrix",
        "date",
        "unknown",
        "meta",
        "span",
        "error",
        "refresh",
        "body",
        "generator",
        "look",
        "verify",
        "restart",
        "hybrid",
        "accept",
        "click",
        "strings",
        "tools",
        "whois record",
        "msgid10053",
        "msgid10051",
        "communicating",
        "anid",
        "execution",
        "null",
        "core",
        "installer",
        "threat roundup",
        "apple ios",
        "august",
        "highly targeted",
        "apple",
        "sqli dumper",
        "april",
        "february",
        "awful",
        "radar ineractive",
        "october",
        "no data",
        "tag count",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "blacklist",
        "cisco umbrella",
        "site",
        "wormx",
        "malicious site",
        "safe site",
        "malware site",
        "alexa top",
        "million",
        "phishing site",
        "alexa",
        "phishing",
        "agent",
        "bank",
        "inmortal",
        "united",
        "cyber threat",
        "pony",
        "cnc zeus",
        "tracker",
        "cnc server",
        "covid19",
        "engineering",
        "http spammer",
        "host",
        "azorult",
        "asyncrat",
        "cobalt strike",
        "team",
        "hsbc"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Radar Ineractive",
          "display_name": "Radar Ineractive",
          "target": null
        },
        {
          "id": "Inmortal",
          "display_name": "Inmortal",
          "target": null
        },
        {
          "id": "HSBC",
          "display_name": "HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059",
          "name": "Command and Scripting Interpreter",
          "display_name": "T1059 - Command and Scripting Interpreter"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1100",
          "name": "Web Shell",
          "display_name": "T1100 - Web Shell"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1560",
          "name": "Archive Collected Data",
          "display_name": "T1560 - Archive Collected Data"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1176",
          "name": "Browser Extensions",
          "display_name": "T1176 - Browser Extensions"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 21,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 815,
        "FileHash-SHA256": 3404,
        "SSLCertFingerprint": 2,
        "URL": 8938,
        "domain": 1194,
        "hostname": 2705,
        "FileHash-SHA1": 457,
        "CIDR": 7,
        "CVE": 3
      },
      "indicator_count": 17525,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "852 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655650c9b2be6cc930c92cf3",
      "name": "https://myaccount.uscis.gov/",
      "description": "HOW!?!? My device was remotely logged into this account somehow.\nThis is egregious. Silence  Threats. I have no connection to this but was contacted by a while ago. I don't know how or why a part of the government would attack a person with a TBI and C1 - S1 Spinal cord injury allegedly caused by Colorado physical therapist and protect him. Why  is victim, tracked and unsafe, receiving death threats, monitored, denied medical care, stalked EVERYWHERE.   \nEven felons aren't monitored for life. STOP.\nWill this get us killed. Do the right thing.\nGod bless America, purge the government.\nThe truth should set you fee not get you harmed.",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:26:33",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 102,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "855 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655652f6ddcbf952a599cded",
      "name": "https://myaccount.uscis.gov/",
      "description": "After Mark Montano Md reported alleged acts by Jeffrey Scott Reimer after receiving 'multiple' reports of him aggressively pursuing Brashears, she was contacted, told she violated the Patriot Act by Big O Tires?!! Received letters from the above and harassed for years. Colorado Workers compensation is so corrupt this may be my last post. She was immediately framed , blamed, porn smeared and stalked. Denied medical care , when received died on surgery table, revised and disabled. Even the mafia would  tackle only the associates bringing undue negative attention to their  own organization.",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:35:50.285000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 100,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "855 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65565477da453c46f05a6ac4",
      "name": "BTW VirusTotal - \" interesting files written to disk during execution'",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:42:15.123000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 101,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 223,
      "modified_text": "855 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655657ca2e402d4f98283de9",
      "name": "https://myaccount.uscis.gov/ ",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T17:56:26.312000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 100,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "855 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "655686e2c072557f03e9cba2",
      "name": "https://myaccount.uscis.gov/                         [pulse created by Octoseek]",
      "description": "",
      "modified": "2023-12-16T15:00:49.451000",
      "created": "2023-11-16T21:17:22.087000",
      "tags": [
        "whois record",
        "ssl certificate",
        "whois whois",
        "communicating",
        "referrer",
        "ip address",
        "contacted",
        "pe resource",
        "historical ssl",
        "collections wow",
        "cobalt",
        "stealer",
        "quasar",
        "remcos",
        "ursnif",
        "fabookie",
        "name verdict",
        "exit",
        "node tcp",
        "traffic",
        "united",
        "et tor",
        "known tor",
        "relayrouter",
        "anonymizer",
        "tor known",
        "tor relayrouter",
        "cisco umbrella",
        "site",
        "safe site",
        "heur",
        "maltiverse",
        "million",
        "alexa top",
        "unsafe",
        "html",
        "team",
        "riskware",
        "malware",
        "phishing",
        "union",
        "bank",
        "outbreak",
        "downer",
        "shell",
        "mediamagnet",
        "sality",
        "swrort",
        "adaptivebee",
        "unruy",
        "iobit",
        "dropper",
        "trojanx",
        "artemis",
        "installcore",
        "webshell",
        "exploit",
        "crack",
        "webtoolbar",
        "detection list",
        "blacklist http",
        "september",
        "threat roundup",
        "execution",
        "metro",
        "formbook",
        "kgs0",
        "kls0",
        "blacklist https",
        "malicious site",
        "malware site",
        "phishing site",
        "download",
        "malicious",
        "azorult",
        "service",
        "runescape",
        "facebook",
        "genkryptik",
        "fuery",
        "wacatac",
        "alexa",
        "dbatloader",
        "nanocore rat",
        "agent tesla",
        "binder",
        "dridex",
        "hawkeye",
        "small",
        "netwire",
        "trojan",
        "redline stealer",
        "lumma stealer",
        "trojanspy",
        "redline",
        "lumma",
        "tsara brashears",
        "whois",
        "asn owner",
        "highly targeted",
        "relacionada",
        "lolkek",
        "emotet",
        "dark power",
        "wiper",
        "ransomware",
        "cobalt strike",
        "quasar rat",
        "core",
        "bitrat",
        "hacktool",
        "critical",
        "copy",
        "installer",
        "meta",
        "as15169 google",
        "aaaa",
        "a domains",
        "videosdewebcams",
        "search",
        "passive dns",
        "urls",
        "record value",
        "date",
        "certificate",
        "scan endpoints",
        "all octoseek",
        "pulse pulses",
        "files"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America",
        "Germany"
      ],
      "malware_families": [
        {
          "id": "WebToolbar",
          "display_name": "WebToolbar",
          "target": null
        },
        {
          "id": "TrojanSpy",
          "display_name": "TrojanSpy",
          "target": null
        },
        {
          "id": "RedLine",
          "display_name": "RedLine",
          "target": null
        },
        {
          "id": "Lumma",
          "display_name": "Lumma",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1090",
          "name": "Proxy",
          "display_name": "T1090 - Proxy"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "655650c9b2be6cc930c92cf3",
      "export_count": 102,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 204,
        "FileHash-SHA1": 182,
        "FileHash-SHA256": 6268,
        "URL": 13989,
        "domain": 3229,
        "hostname": 4412,
        "CVE": 19,
        "email": 3
      },
      "indicator_count": 28306,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "855 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://attachment.pooban.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://attachment.pooban.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776681644.9338698
}