{
  "type": "URL",
  "indicator": "https://cdn.gearstactics.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://cdn.gearstactics.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3776812238,
      "indicator": "https://cdn.gearstactics.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 15,
      "pulses": [
        {
          "id": "693148dc0eb85adc8edfe1a2",
          "name": "BeeLineRouter.Net \u2022 Isolated / Apple Baxkdoor",
          "description": "",
          "modified": "2026-01-03T07:00:45.529000",
          "created": "2025-12-04T08:39:56.180000",
          "tags": [
            "mitre att",
            "network traffic",
            "ck id",
            "show technique",
            "ck matrix",
            "threat score",
            "december",
            "default browser",
            "guest system",
            "united",
            "dynadot inc",
            "name server",
            "contacted hosts",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "ascii text",
            "pattern match",
            "show process",
            "t1071",
            "general",
            "local",
            "path",
            "click",
            "beelinerouter",
            "access",
            "router",
            "apple",
            "regopenkeyexw",
            "regsz",
            "process32nextw",
            "english",
            "post http",
            "search",
            "observed dns",
            "query",
            "sinkhole cookie",
            "malware",
            "possible",
            "win32",
            "updater",
            "write",
            "next",
            "found",
            "ip address",
            "domain",
            "name servers",
            "unknown ns",
            "ip whois",
            "registrar",
            "cloudflare",
            "title",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as14618",
            "bq dec",
            "virtool",
            "backdoor",
            "checkin",
            "ipv4 add",
            "trojan",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "unknown",
            "show",
            "internal",
            "encrypt",
            "veailmboprd",
            "dns query",
            "wow64",
            "gecko http",
            "entries",
            "medium",
            "ransom",
            "khtml",
            "gecko",
            "delete",
            "installer",
            "win32cve may",
            "america flag",
            "overview ip",
            "asn as20940",
            "expiration",
            "url https",
            "no expiration",
            "url http",
            "pulse show",
            "type indicator",
            "role title",
            "related pulses",
            "record value",
            "domain xn"
          ],
          "references": [
            "HTTPS://BeeLineRouter.Net",
            "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
            "https://appleid.xn--appe-70a.com/",
            "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://vgt.pl/r.n%20-",
            "8-25-220-162-static.reverse.queryfoundry.net",
            "queryfoundry.net",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://68-178-128-104-static.reverse.queryfoundry.net/",
            "0-209-98-172-static.reverse.queryfoundry.net",
            "154-143-182-107-static.reverse.queryfoundry.net",
            "http://51-235-245-104-static.reverse.queryfoundry.net/",
            "167-16-68-38-static.reverse.queryfoundry.net",
            "http://49-116-251-162-static.reverse.queryfoundry./net/",
            "177-231-69-38-static.reverse.queryfoundry.net",
            "http://36-243-60-103-static.reverse.queryfoundry.net/",
            "http://237-189-251-104-static.reverse.queryfoundry.net/",
            "http://227-98-248-162-static.reverse.queryfoundry.net/",
            "237-189-251-104-static.reverse.queryfoundry.net",
            "http://207-214-98-172-static.reverse.queryfoundry.net/",
            "181-135-182-107-static.reverse.queryfoundry.net",
            "http://201-191-251-104-static.reverse.queryfoundry.net/",
            "67-228-69-38-static.reverse.queryfoundry.net",
            "http://0-209-98-172-static.reverse.queryfoundry.net/",
            "http://10-241-60-103-static.reverse.queryfoundry.net/",
            "http://142-232-245-104-static.reverse.queryfoundry.net/",
            "http://154-143-182-107-static.reverse.queryfoundry.net/",
            "http://167-16-68-38-static.reverse.queryfoundry.net/",
            "http://177-231-69-38-static.reverse.queryfoundry.net/",
            "http://181-135-182-107-static.reverse.queryfoundry.net/",
            "http://195-214-98-172-static.reverse.queryfoundry.net/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "GandCrab Ransomware",
              "display_name": "GandCrab Ransomware",
              "target": null
            },
            {
              "id": "Win.Virus.Expiro",
              "display_name": "Win.Virus.Expiro",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "domain": 1049,
            "URL": 5839,
            "hostname": 1944,
            "FileHash-SHA256": 3634,
            "FileHash-MD5": 310,
            "FileHash-SHA1": 295,
            "CVE": 2,
            "email": 15,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13090,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 143,
          "modified_text": "107 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69314920e287845f6b36a265",
          "name": "BeeLineRouter.Net  \u2022 Apple Access",
          "description": "",
          "modified": "2026-01-03T07:00:45.529000",
          "created": "2025-12-04T08:41:04.190000",
          "tags": [
            "mitre att",
            "network traffic",
            "ck id",
            "show technique",
            "ck matrix",
            "threat score",
            "december",
            "default browser",
            "guest system",
            "united",
            "dynadot inc",
            "name server",
            "contacted hosts",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "ascii text",
            "pattern match",
            "show process",
            "t1071",
            "general",
            "local",
            "path",
            "click",
            "beelinerouter",
            "access",
            "router",
            "apple",
            "regopenkeyexw",
            "regsz",
            "process32nextw",
            "english",
            "post http",
            "search",
            "observed dns",
            "query",
            "sinkhole cookie",
            "malware",
            "possible",
            "win32",
            "updater",
            "write",
            "next",
            "found",
            "ip address",
            "domain",
            "name servers",
            "unknown ns",
            "ip whois",
            "registrar",
            "cloudflare",
            "title",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as14618",
            "bq dec",
            "virtool",
            "backdoor",
            "checkin",
            "ipv4 add",
            "trojan",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "unknown",
            "show",
            "internal",
            "encrypt",
            "veailmboprd",
            "dns query",
            "wow64",
            "gecko http",
            "entries",
            "medium",
            "ransom",
            "khtml",
            "gecko",
            "delete",
            "installer",
            "win32cve may",
            "america flag",
            "overview ip",
            "asn as20940",
            "expiration",
            "url https",
            "no expiration",
            "url http",
            "pulse show",
            "type indicator",
            "role title",
            "related pulses",
            "record value",
            "domain xn"
          ],
          "references": [
            "HTTPS://BeeLineRouter.Net",
            "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
            "https://appleid.xn--appe-70a.com/",
            "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://vgt.pl/r.n%20-",
            "8-25-220-162-static.reverse.queryfoundry.net",
            "queryfoundry.net",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://68-178-128-104-static.reverse.queryfoundry.net/",
            "0-209-98-172-static.reverse.queryfoundry.net",
            "154-143-182-107-static.reverse.queryfoundry.net",
            "http://51-235-245-104-static.reverse.queryfoundry.net/",
            "167-16-68-38-static.reverse.queryfoundry.net",
            "http://49-116-251-162-static.reverse.queryfoundry./net/",
            "177-231-69-38-static.reverse.queryfoundry.net",
            "http://36-243-60-103-static.reverse.queryfoundry.net/",
            "http://237-189-251-104-static.reverse.queryfoundry.net/",
            "http://227-98-248-162-static.reverse.queryfoundry.net/",
            "237-189-251-104-static.reverse.queryfoundry.net",
            "http://207-214-98-172-static.reverse.queryfoundry.net/",
            "181-135-182-107-static.reverse.queryfoundry.net",
            "http://201-191-251-104-static.reverse.queryfoundry.net/",
            "67-228-69-38-static.reverse.queryfoundry.net",
            "http://0-209-98-172-static.reverse.queryfoundry.net/",
            "http://10-241-60-103-static.reverse.queryfoundry.net/",
            "http://142-232-245-104-static.reverse.queryfoundry.net/",
            "http://154-143-182-107-static.reverse.queryfoundry.net/",
            "http://167-16-68-38-static.reverse.queryfoundry.net/",
            "http://177-231-69-38-static.reverse.queryfoundry.net/",
            "http://181-135-182-107-static.reverse.queryfoundry.net/",
            "http://195-214-98-172-static.reverse.queryfoundry.net/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "GandCrab Ransomware",
              "display_name": "GandCrab Ransomware",
              "target": null
            },
            {
              "id": "Win.Virus.Expiro",
              "display_name": "Win.Virus.Expiro",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 3,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 310,
            "FileHash-SHA1": 295,
            "FileHash-SHA256": 3634,
            "URL": 5839,
            "CVE": 2,
            "domain": 1048,
            "email": 15,
            "hostname": 1944,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13089,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 145,
          "modified_text": "107 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "69314926519256e3ef0a9358",
          "name": "BeeLineRouter.Net  \u2022 Apple Access",
          "description": "",
          "modified": "2026-01-03T07:00:45.529000",
          "created": "2025-12-04T08:41:06.657000",
          "tags": [
            "mitre att",
            "network traffic",
            "ck id",
            "show technique",
            "ck matrix",
            "threat score",
            "december",
            "default browser",
            "guest system",
            "united",
            "dynadot inc",
            "name server",
            "contacted hosts",
            "process details",
            "windir",
            "openurl c",
            "prefetch2",
            "learn",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "command",
            "spawns",
            "access att",
            "t1566 phishing",
            "ascii text",
            "pattern match",
            "show process",
            "t1071",
            "general",
            "local",
            "path",
            "click",
            "beelinerouter",
            "access",
            "router",
            "apple",
            "regopenkeyexw",
            "regsz",
            "process32nextw",
            "english",
            "post http",
            "search",
            "observed dns",
            "query",
            "sinkhole cookie",
            "malware",
            "possible",
            "win32",
            "updater",
            "write",
            "next",
            "found",
            "ip address",
            "domain",
            "name servers",
            "unknown ns",
            "ip whois",
            "registrar",
            "cloudflare",
            "title",
            "passive dns",
            "urls",
            "files",
            "location united",
            "asn as14618",
            "bq dec",
            "virtool",
            "backdoor",
            "checkin",
            "ipv4 add",
            "trojan",
            "dynamicloader",
            "msie",
            "windows nt",
            "slcc2",
            "media center",
            "unknown",
            "show",
            "internal",
            "encrypt",
            "veailmboprd",
            "dns query",
            "wow64",
            "gecko http",
            "entries",
            "medium",
            "ransom",
            "khtml",
            "gecko",
            "delete",
            "installer",
            "win32cve may",
            "america flag",
            "overview ip",
            "asn as20940",
            "expiration",
            "url https",
            "no expiration",
            "url http",
            "pulse show",
            "type indicator",
            "role title",
            "related pulses",
            "record value",
            "domain xn"
          ],
          "references": [
            "HTTPS://BeeLineRouter.Net",
            "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
            "https://appleid.xn--appe-70a.com/",
            "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
            "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
            "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
            "https://www.sweetheartvideo.com/tsara-brashears",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
            "http://vgt.pl/r.n%20-",
            "8-25-220-162-static.reverse.queryfoundry.net",
            "queryfoundry.net",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://117-114-251-162-static.reverse.queryfoundry.net/",
            "http://81-26-68-38-static.reverse.queryfoundry.net/",
            "http://68-178-128-104-static.reverse.queryfoundry.net/",
            "0-209-98-172-static.reverse.queryfoundry.net",
            "154-143-182-107-static.reverse.queryfoundry.net",
            "http://51-235-245-104-static.reverse.queryfoundry.net/",
            "167-16-68-38-static.reverse.queryfoundry.net",
            "http://49-116-251-162-static.reverse.queryfoundry./net/",
            "177-231-69-38-static.reverse.queryfoundry.net",
            "http://36-243-60-103-static.reverse.queryfoundry.net/",
            "http://237-189-251-104-static.reverse.queryfoundry.net/",
            "http://227-98-248-162-static.reverse.queryfoundry.net/",
            "237-189-251-104-static.reverse.queryfoundry.net",
            "http://207-214-98-172-static.reverse.queryfoundry.net/",
            "181-135-182-107-static.reverse.queryfoundry.net",
            "http://201-191-251-104-static.reverse.queryfoundry.net/",
            "67-228-69-38-static.reverse.queryfoundry.net",
            "http://0-209-98-172-static.reverse.queryfoundry.net/",
            "http://10-241-60-103-static.reverse.queryfoundry.net/",
            "http://142-232-245-104-static.reverse.queryfoundry.net/",
            "http://154-143-182-107-static.reverse.queryfoundry.net/",
            "http://167-16-68-38-static.reverse.queryfoundry.net/",
            "http://177-231-69-38-static.reverse.queryfoundry.net/",
            "http://181-135-182-107-static.reverse.queryfoundry.net/",
            "http://195-214-98-172-static.reverse.queryfoundry.net/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Simda",
              "display_name": "Simda",
              "target": null
            },
            {
              "id": "MyDoom",
              "display_name": "MyDoom",
              "target": null
            },
            {
              "id": "GandCrab Ransomware",
              "display_name": "GandCrab Ransomware",
              "target": null
            },
            {
              "id": "Win.Virus.Expiro",
              "display_name": "Win.Virus.Expiro",
              "target": null
            },
            {
              "id": "Other Malware",
              "display_name": "Other Malware",
              "target": null
            },
            {
              "id": "#VirTool:Win32/Obfuscator.ADB",
              "display_name": "#VirTool:Win32/Obfuscator.ADB",
              "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
            }
          ],
          "attack_ids": [
            {
              "id": "T1204",
              "name": "User Execution",
              "display_name": "T1204 - User Execution"
            },
            {
              "id": "T1566",
              "name": "Phishing",
              "display_name": "T1566 - Phishing"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1113",
              "name": "Screen Capture",
              "display_name": "T1113 - Screen Capture"
            },
            {
              "id": "T1012",
              "name": "Query Registry",
              "display_name": "T1012 - Query Registry"
            },
            {
              "id": "T1045",
              "name": "Software Packing",
              "display_name": "T1045 - Software Packing"
            },
            {
              "id": "T1082",
              "name": "System Information Discovery",
              "display_name": "T1082 - System Information Discovery"
            },
            {
              "id": "T1119",
              "name": "Automated Collection",
              "display_name": "T1119 - Automated Collection"
            },
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            },
            {
              "id": "T1063",
              "name": "Security Software Discovery",
              "display_name": "T1063 - Security Software Discovery"
            },
            {
              "id": "T1053",
              "name": "Scheduled Task/Job",
              "display_name": "T1053 - Scheduled Task/Job"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 6,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 310,
            "FileHash-SHA1": 295,
            "FileHash-SHA256": 3634,
            "URL": 5839,
            "CVE": 2,
            "domain": 1048,
            "email": 15,
            "hostname": 1944,
            "SSLCertFingerprint": 2
          },
          "indicator_count": 13089,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 146,
          "modified_text": "107 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "692fdb10627488a886ec6f8f",
          "name": "Apple \u2022 Gamarue | Fully compromised iOS | Ahmanm , Tulach , Sabey and ?",
          "description": "Device testing. Calling Apple : scam pop ups, apple advisors ,emails, screen shares. Calling : State and Government offices : scam receptionists , investigators, dropped calls, connect without ringing. Calling businesses: routed to scam to scammers. | Apps : all fake. random data. \n\nAligned with same attackers listed. Indicator deletion and attorney caught hijacking. \n\nCannot open LevelBlue Indicators on affected. device. Device can create a mini pulse. \n,",
          "modified": "2026-01-02T05:01:36.144000",
          "created": "2025-12-03T06:39:12.995000",
          "tags": [
            "united",
            "servers",
            "data upload",
            "extraction",
            "sc data",
            "boot",
            "techniques none",
            "modules",
            "logon autostart",
            "execu",
            "privilege",
            "process",
            "evasion",
            "search",
            "info",
            "techniques low",
            "execution flow",
            "injection",
            "apple",
            "rootkit",
            "hybrid analysis",
            "click",
            "windir",
            "openurl c",
            "prefetch2",
            "analysis",
            "tor analysis",
            "ip address",
            "process details",
            "learn",
            "ck id",
            "name tactics",
            "suspicious",
            "informative",
            "adversaries",
            "spawns",
            "command",
            "found",
            "defense evasion",
            "a061s.exe",
            "tulach",
            "christopher p ahmanm",
            "passive dns",
            "urls",
            "url add",
            "http",
            "files domain",
            "files related",
            "pulses otx",
            "virustotal",
            "foundry",
            "helix",
            "mapkit",
            "hacking",
            "denver",
            "retaliation",
            "redirect",
            "no server",
            "reroute",
            "scammers",
            "coconut island",
            "brain sabey",
            "dns requests",
            "domain address",
            "contacted hosts",
            "t1480 execution",
            "file defense"
          ],
          "references": [
            "getsupport.apple.com\t \u2022 apple.com",
            "Matches rule Registry Modification to Hidden File Extension by frack113",
            "Matches rule Msiexec Initiated Connection by frack113",
            "Matches rule Creation of an Executable by an Executable by frack113",
            "Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
            "Matches rule SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
            "Tulach \u2022 114.114.114.114",
            "http://foundry2-lbl.dvr.dn2.n-helix.com"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Trojan/Win32.Gamarue.C1976125",
              "display_name": "Trojan/Win32.Gamarue.C1976125",
              "target": null
            },
            {
              "id": "Trojan.GenericKDZ.93839",
              "display_name": "Trojan.GenericKDZ.93839",
              "target": null
            },
            {
              "id": "Tulach Malware",
              "display_name": "Tulach Malware",
              "target": null
            },
            {
              "id": "Trojan.MyDoom/Mudrop",
              "display_name": "Trojan.MyDoom/Mudrop",
              "target": null
            },
            {
              "id": "Trojan.Win.Small",
              "display_name": "Trojan.Win.Small",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1055",
              "name": "Process Injection",
              "display_name": "T1055 - Process Injection"
            },
            {
              "id": "T1129",
              "name": "Shared Modules",
              "display_name": "T1129 - Shared Modules"
            },
            {
              "id": "T1547",
              "name": "Boot or Logon Autostart Execution",
              "display_name": "T1547 - Boot or Logon Autostart Execution"
            },
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            },
            {
              "id": "T1070",
              "name": "Indicator Removal on Host",
              "display_name": "T1070 - Indicator Removal on Host"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1023",
              "name": "Shortcut Modification",
              "display_name": "T1023 - Shortcut Modification"
            },
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1401",
              "name": "Device Administrator Permissions",
              "display_name": "T1401 - Device Administrator Permissions"
            },
            {
              "id": "T1147",
              "name": "Hidden Users",
              "display_name": "T1147 - Hidden Users"
            },
            {
              "id": "T1408",
              "name": "Disguise Root/Jailbreak Indicators",
              "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
            },
            {
              "id": "T1014",
              "name": "Rootkit",
              "display_name": "T1014 - Rootkit"
            },
            {
              "id": "T1036.004",
              "name": "Masquerade Task or Service",
              "display_name": "T1036.004 - Masquerade Task or Service"
            },
            {
              "id": "T1036",
              "name": "Masquerading",
              "display_name": "T1036 - Masquerading"
            },
            {
              "id": "T1155",
              "name": "AppleScript",
              "display_name": "T1155 - AppleScript"
            },
            {
              "id": "TA0037",
              "name": "Command and Control",
              "display_name": "TA0037 - Command and Control"
            },
            {
              "id": "TA0008",
              "name": "Lateral Movement",
              "display_name": "TA0008 - Lateral Movement"
            },
            {
              "id": "T1430",
              "name": "Location Tracking",
              "display_name": "T1430 - Location Tracking"
            },
            {
              "id": "T1529",
              "name": "System Shutdown/Reboot",
              "display_name": "T1529 - System Shutdown/Reboot"
            },
            {
              "id": "T1542.003",
              "name": "Bootkit",
              "display_name": "T1542.003 - Bootkit"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1069",
              "name": "Permission Groups Discovery",
              "display_name": "T1069 - Permission Groups Discovery"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1480",
              "name": "Execution Guardrails",
              "display_name": "T1480 - Execution Guardrails"
            },
            {
              "id": "T1568",
              "name": "Dynamic Resolution",
              "display_name": "T1568 - Dynamic Resolution"
            },
            {
              "id": "T1410",
              "name": "Network Traffic Capture or Redirection",
              "display_name": "T1410 - Network Traffic Capture or Redirection"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1454",
              "name": "Malicious SMS Message",
              "display_name": "T1454 - Malicious SMS Message"
            }
          ],
          "industries": [
            "Telecommunications"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Q.Vashti",
            "id": "337942",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "hostname": 413,
            "FileHash-MD5": 14,
            "FileHash-SHA1": 4,
            "URL": 1321,
            "domain": 219,
            "email": 3,
            "FileHash-SHA256": 696
          },
          "indicator_count": 2670,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 138,
          "modified_text": "108 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6821389e9d03972dacbb9582",
          "name": "False Executable for MS Windows SHA1-20b60961f5d2eb274cd5e6526ea6c621c60cc36c",
          "description": "https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AZbBwVWDONZSmF3-AVdH&env=Windows%2010%20x64&time=4&sha1=20b60961f5d2eb274cd5e6526ea6c621c60cc36c\n PE32 Executable for MS Windows (EXE)\nResearchers have worked out how to store the data in a single file - and how much it takes to do it - using SHA1 and C3.. and 2.5 million characters.-",
          "modified": "2025-10-01T00:01:22.860000",
          "created": "2025-05-11T23:54:06.106000",
          "tags": [
            "sha1",
            "sha256",
            "sha512",
            "crc32",
            "ssdeep",
            "size",
            "file type",
            "pe32 executable",
            "ms windows",
            "win32 dynamic"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 2,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "Arek-BTC",
            "id": "212764",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 1,
            "FileHash-SHA1": 1,
            "FileHash-SHA256": 122,
            "IPv4": 8,
            "domain": 29,
            "hostname": 65,
            "URL": 118
          },
          "indicator_count": 344,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 123,
          "modified_text": "201 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65b93e70b75e7dce7168f4dd",
          "name": "Google - Lumma Stealer| QakBot | Emotet",
          "description": "Lumma is classified as a stealer - a type of malware that extracts sensitive information from infected devices.\n\nYou can't see it. You will see https://www.google.com and your search. It's hidden spyware. extremely malicious. Targeted individual.",
          "modified": "2024-02-29T17:01:09.717000",
          "created": "2024-01-30T18:22:40.905000",
          "tags": [
            "ssl certificate",
            "whois record",
            "threat roundup",
            "contacted",
            "historical ssl",
            "referrer",
            "urls url",
            "whois whois",
            "october",
            "resolutions",
            "august",
            "execution",
            "installer",
            "iframe",
            "malware",
            "core",
            "emotet",
            "lumma stealer",
            "ransomexx",
            "azorult",
            "ursnif",
            "hacktool",
            "june",
            "qakbot",
            "qbot",
            "april",
            "targeting",
            "tsara brashears",
            "active threat"
          ],
          "references": [
            "google.com.uy [Google search browser, masked, links to malicious porn malware spreader, malvertizing, collection host]",
            "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password cracker]",
            "toolbarqueries.google.com.uy"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [
            "United States of America"
          ],
          "malware_families": [
            {
              "id": "Lumma Stealer",
              "display_name": "Lumma Stealer",
              "target": null
            },
            {
              "id": "HackTool",
              "display_name": "HackTool",
              "target": null
            },
            {
              "id": "Emotet",
              "display_name": "Emotet",
              "target": null
            },
            {
              "id": "Azorult",
              "display_name": "Azorult",
              "target": null
            },
            {
              "id": "RansomEXX",
              "display_name": "RansomEXX",
              "target": null
            },
            {
              "id": "QakBot",
              "display_name": "QakBot",
              "target": null
            },
            {
              "id": "Qbot",
              "display_name": "Qbot",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1068",
              "name": "Exploitation for Privilege Escalation",
              "display_name": "T1068 - Exploitation for Privilege Escalation"
            },
            {
              "id": "T1027",
              "name": "Obfuscated Files or Information",
              "display_name": "T1027 - Obfuscated Files or Information"
            },
            {
              "id": "T1105",
              "name": "Ingress Tool Transfer",
              "display_name": "T1105 - Ingress Tool Transfer"
            },
            {
              "id": "T1057",
              "name": "Process Discovery",
              "display_name": "T1057 - Process Discovery"
            },
            {
              "id": "T1449",
              "name": "Exploit SS7 to Redirect Phone Calls/SMS",
              "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
            },
            {
              "id": "T1583.005",
              "name": "Botnet",
              "display_name": "T1583.005 - Botnet"
            },
            {
              "id": "T1031",
              "name": "Modify Existing Service",
              "display_name": "T1031 - Modify Existing Service"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1071.003",
              "name": "Mail Protocols",
              "display_name": "T1071.003 - Mail Protocols"
            },
            {
              "id": "TA0002",
              "name": "Execution",
              "display_name": "TA0002 - Execution"
            },
            {
              "id": "TA0003",
              "name": "Persistence",
              "display_name": "TA0003 - Persistence"
            },
            {
              "id": "TA0004",
              "name": "Privilege Escalation",
              "display_name": "TA0004 - Privilege Escalation"
            },
            {
              "id": "TA0005",
              "name": "Defense Evasion",
              "display_name": "TA0005 - Defense Evasion"
            },
            {
              "id": "TA0006",
              "name": "Credential Access",
              "display_name": "TA0006 - Credential Access"
            },
            {
              "id": "TA0007",
              "name": "Discovery",
              "display_name": "TA0007 - Discovery"
            },
            {
              "id": "TA0009",
              "name": "Collection",
              "display_name": "TA0009 - Collection"
            },
            {
              "id": "T1030",
              "name": "Data Transfer Size Limits",
              "display_name": "T1030 - Data Transfer Size Limits"
            },
            {
              "id": "TA0010",
              "name": "Exfiltration",
              "display_name": "TA0010 - Exfiltration"
            },
            {
              "id": "TA0011",
              "name": "Command and Control",
              "display_name": "TA0011 - Command and Control"
            }
          ],
          "industries": [
            "Civil Society"
          ],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 1,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 50,
            "FileHash-SHA1": 46,
            "FileHash-SHA256": 3377,
            "hostname": 2502,
            "URL": 8531,
            "domain": 1250,
            "CVE": 2
          },
          "indicator_count": 15758,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 220,
          "modified_text": "780 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597f9c7542ffc6fffaecb30",
          "name": "Injection (RunPE) |Win.Packer - https://myminiweb.com",
          "description": "polypragmonic, dns, win.packer, ig hacking, network bind, tracking",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:44:55.030000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 222,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597fa4d4b5e060fb8a606a8",
          "name": "Botnet Campaign",
          "description": "",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:47:09.403000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6597f9c7542ffc6fffaecb30",
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6597fa4da16bd99cc5c02528",
          "name": "Botnet Campaign",
          "description": "",
          "modified": "2024-02-04T12:05:19.275000",
          "created": "2024-01-05T12:47:09.406000",
          "tags": [
            "ciphersuite",
            "delete c",
            "search",
            "entries",
            "united",
            "stcalifornia",
            "lmenlo park",
            "ometa platforms",
            "odigicert inc",
            "cndigicert sha2",
            "copy",
            "write",
            "unknown",
            "no expiration",
            "expiration",
            "filehashsha256",
            "hostname",
            "domain",
            "ipv4",
            "url http",
            "url https",
            "filehashmd5",
            "filehashsha1",
            "next",
            "iocs",
            "pdf report",
            "pcap",
            "scan endpoints",
            "win64",
            "stix",
            "openioc",
            "enter",
            "ssl certificate",
            "whois record",
            "apple ios",
            "communicating",
            "referrer",
            "contacted",
            "resolutions",
            "threat roundup",
            "password",
            "networks",
            "hacktool",
            "crypto",
            "twitter",
            "june",
            "probe",
            "ransomware",
            "malware",
            "tsara brashears",
            "botnet campaign",
            "january",
            "content reputation",
            "et"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Content Reputation",
              "display_name": "Content Reputation",
              "target": null
            },
            {
              "id": "ET",
              "display_name": "ET",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1060",
              "name": "Registry Run Keys / Startup Folder",
              "display_name": "T1060 - Registry Run Keys / Startup Folder"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "6597f9c7542ffc6fffaecb30",
          "export_count": 18,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2469,
            "FileHash-SHA1": 2295,
            "FileHash-SHA256": 4925,
            "SSLCertFingerprint": 2,
            "URL": 4484,
            "domain": 2044,
            "hostname": 2375,
            "email": 18,
            "CVE": 4
          },
          "indicator_count": 18616,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 221,
          "modified_text": "806 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653e9147fc170101be4f7afe",
          "name": "CNC | Malicious activities. | aig.com [lacks http/https]",
          "description": "My input: unsigned, evasive,Trojan:Win32/Danabot.G, missing STSH, CNC, phishing, trojans, scanning host, exploit host. \n\n\n[Auto populated: Last DNS records are held by a single person, and they are not the same as the previous records, which were posted in the early 1990s and early 2000s, according to the US government.]",
          "modified": "2023-11-28T16:01:50.761000",
          "created": "2023-10-29T17:07:19.371000",
          "tags": [
            "ssl certificate",
            "whois record",
            "communicating",
            "contacted",
            "threat roundup",
            "referrer",
            "october",
            "historical ssl",
            "june",
            "august",
            "execution",
            "quasar",
            "metro",
            "android",
            "djvu",
            "qakbot",
            "qbot",
            "april",
            "skynet",
            "crypto",
            "awful",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus ou",
            "entrust",
            "oentrust",
            "l1k validity",
            "lnew york",
            "group",
            "info",
            "domain status",
            "server",
            "date",
            "registrar abuse",
            "new york",
            "postal code",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "code",
            "microsoft",
            "dns replication",
            "full name",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "iana id",
            "registrar whois",
            "win32 exe",
            "files",
            "detections type",
            "name"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4115,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 2692,
            "domain": 665,
            "hostname": 1448,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 9418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653e9215890dfc9167d774e3",
          "name": "Qakbot, Qbot, Qausar | CNC",
          "description": "My input: unsigned, evasive,Trojan:Win32/Danabot.G, missing STSH, CNC, phishing, trojans, scanning host, exploit host. \n\n\n[Auto populated: Last DNS records are held by a single person, and they are not the same as the previous records, which were posted in the early 1990s and early 2000s, according to the US government.]",
          "modified": "2023-11-28T16:01:50.761000",
          "created": "2023-10-29T17:10:45.609000",
          "tags": [
            "ssl certificate",
            "whois record",
            "communicating",
            "contacted",
            "threat roundup",
            "referrer",
            "october",
            "historical ssl",
            "june",
            "august",
            "execution",
            "quasar",
            "metro",
            "android",
            "djvu",
            "qakbot",
            "qbot",
            "april",
            "skynet",
            "crypto",
            "awful",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus ou",
            "entrust",
            "oentrust",
            "l1k validity",
            "lnew york",
            "group",
            "info",
            "domain status",
            "server",
            "date",
            "registrar abuse",
            "new york",
            "postal code",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "code",
            "microsoft",
            "dns replication",
            "full name",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "iana id",
            "registrar whois",
            "win32 exe",
            "files",
            "detections type",
            "name"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4115,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 2692,
            "domain": 665,
            "hostname": 1448,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 9418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653e92fcaf9d549477914ece",
          "name": "Registrar Abuse | CNC",
          "description": "My input: unsigned, evasive,Trojan:Win32/Danabot.G, missing STSH, CNC, phishing, trojans, scanning host, exploit host. \n\n\n[Auto populated: Last DNS records are held by a single person, and they are not the same as the previous records, which were posted in the early 1990s and early 2000s, according to the US government.]",
          "modified": "2023-11-28T16:01:50.761000",
          "created": "2023-10-29T17:14:36.780000",
          "tags": [
            "ssl certificate",
            "whois record",
            "communicating",
            "contacted",
            "threat roundup",
            "referrer",
            "october",
            "historical ssl",
            "june",
            "august",
            "execution",
            "quasar",
            "metro",
            "android",
            "djvu",
            "qakbot",
            "qbot",
            "april",
            "skynet",
            "crypto",
            "awful",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus ou",
            "entrust",
            "oentrust",
            "l1k validity",
            "lnew york",
            "group",
            "info",
            "domain status",
            "server",
            "date",
            "registrar abuse",
            "new york",
            "postal code",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "code",
            "microsoft",
            "dns replication",
            "full name",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "iana id",
            "registrar whois",
            "win32 exe",
            "files",
            "detections type",
            "name"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4115,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 2692,
            "domain": 665,
            "hostname": 1448,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 9418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f04475b063d0b0d3badca",
          "name": "CNC | Malicious activities. | aig.com [lacks http/https]",
          "description": "",
          "modified": "2023-11-28T16:01:50.761000",
          "created": "2023-10-30T01:17:59.531000",
          "tags": [
            "ssl certificate",
            "whois record",
            "communicating",
            "contacted",
            "threat roundup",
            "referrer",
            "october",
            "historical ssl",
            "june",
            "august",
            "execution",
            "quasar",
            "metro",
            "android",
            "djvu",
            "qakbot",
            "qbot",
            "april",
            "skynet",
            "crypto",
            "awful",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus ou",
            "entrust",
            "oentrust",
            "l1k validity",
            "lnew york",
            "group",
            "info",
            "domain status",
            "server",
            "date",
            "registrar abuse",
            "new york",
            "postal code",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "code",
            "microsoft",
            "dns replication",
            "full name",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "iana id",
            "registrar whois",
            "win32 exe",
            "files",
            "detections type",
            "name"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "653e9147fc170101be4f7afe",
          "export_count": 32,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4115,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 2692,
            "domain": 665,
            "hostname": 1448,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 9418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f047d030109e1cab23db8",
          "name": "Qakbot, Qbot, Qausar | CNC",
          "description": "",
          "modified": "2023-11-28T16:01:50.761000",
          "created": "2023-10-30T01:18:53.112000",
          "tags": [
            "ssl certificate",
            "whois record",
            "communicating",
            "contacted",
            "threat roundup",
            "referrer",
            "october",
            "historical ssl",
            "june",
            "august",
            "execution",
            "quasar",
            "metro",
            "android",
            "djvu",
            "qakbot",
            "qbot",
            "april",
            "skynet",
            "crypto",
            "awful",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus ou",
            "entrust",
            "oentrust",
            "l1k validity",
            "lnew york",
            "group",
            "info",
            "domain status",
            "server",
            "date",
            "registrar abuse",
            "new york",
            "postal code",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "code",
            "microsoft",
            "dns replication",
            "full name",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "iana id",
            "registrar whois",
            "win32 exe",
            "files",
            "detections type",
            "name"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "653e9215890dfc9167d774e3",
          "export_count": 28,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4115,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 2692,
            "domain": 665,
            "hostname": 1448,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 9418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "653f04af6927f6584755d691",
          "name": "Registrar Abuse | CNC",
          "description": "",
          "modified": "2023-11-28T16:01:50.761000",
          "created": "2023-10-30T01:19:43.234000",
          "tags": [
            "ssl certificate",
            "whois record",
            "communicating",
            "contacted",
            "threat roundup",
            "referrer",
            "october",
            "historical ssl",
            "june",
            "august",
            "execution",
            "quasar",
            "metro",
            "android",
            "djvu",
            "qakbot",
            "qbot",
            "april",
            "skynet",
            "crypto",
            "awful",
            "record type",
            "ttl value",
            "algorithm",
            "data",
            "v3 serial",
            "number",
            "cus ou",
            "entrust",
            "oentrust",
            "l1k validity",
            "lnew york",
            "group",
            "info",
            "domain status",
            "server",
            "date",
            "registrar abuse",
            "new york",
            "postal code",
            "contact phone",
            "registrar url",
            "csc corporate",
            "domains",
            "code",
            "microsoft",
            "dns replication",
            "full name",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "iana id",
            "registrar whois",
            "win32 exe",
            "files",
            "detections type",
            "name"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [
            {
              "id": "T1140",
              "name": "Deobfuscate/Decode Files or Information",
              "display_name": "T1140 - Deobfuscate/Decode Files or Information"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": "653e92fcaf9d549477914ece",
          "export_count": 27,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "URL": 4115,
            "FileHash-MD5": 250,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 2692,
            "domain": 665,
            "hostname": 1448,
            "CVE": 1,
            "email": 3
          },
          "indicator_count": 9418,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 218,
          "modified_text": "873 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "toolbarqueries.google.com.uy",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "http://foundry2-lbl.dvr.dn2.n-helix.com",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "HTTPS://BeeLineRouter.Net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "Matches rule Creation of an Executable by an Executable by frack113",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://vgt.pl/r.n%20-",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "google.com.uy [Google search browser, masked, links to malicious porn malware spreader, malvertizing, collection host]",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "getsupport.apple.com\t \u2022 apple.com",
        "Matches rule SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "Tulach \u2022 114.114.114.114",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "Matches rule Registry Modification to Hidden File Extension by frack113",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/",
        "https://appleid.xn--appe-70a.com/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "Matches rule Msiexec Initiated Connection by frack113",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password cracker]"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Hacktool",
            "Azorult",
            "Gandcrab ransomware",
            "Simda",
            "Mydoom",
            "#virtool:win32/obfuscator.adb",
            "Trojan.generickdz.93839",
            "Qakbot",
            "Content reputation",
            "Other malware",
            "Lumma stealer",
            "Qbot",
            "Tulach malware",
            "Emotet",
            "Ransomexx",
            "Trojan.win.small",
            "Win.virus.expiro",
            "Trojan.mydoom/mudrop",
            "Et",
            "Trojan/win32.gamarue.c1976125"
          ],
          "industries": [
            "Civil society",
            "Telecommunications"
          ],
          "unique_indicators": 57134
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/gearstactics.com",
    "whois": "http://whois.domaintools.com/gearstactics.com",
    "domain": "gearstactics.com",
    "hostname": "cdn.gearstactics.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 15,
  "pulses": [
    {
      "id": "693148dc0eb85adc8edfe1a2",
      "name": "BeeLineRouter.Net \u2022 Isolated / Apple Baxkdoor",
      "description": "",
      "modified": "2026-01-03T07:00:45.529000",
      "created": "2025-12-04T08:39:56.180000",
      "tags": [
        "mitre att",
        "network traffic",
        "ck id",
        "show technique",
        "ck matrix",
        "threat score",
        "december",
        "default browser",
        "guest system",
        "united",
        "dynadot inc",
        "name server",
        "contacted hosts",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "ascii text",
        "pattern match",
        "show process",
        "t1071",
        "general",
        "local",
        "path",
        "click",
        "beelinerouter",
        "access",
        "router",
        "apple",
        "regopenkeyexw",
        "regsz",
        "process32nextw",
        "english",
        "post http",
        "search",
        "observed dns",
        "query",
        "sinkhole cookie",
        "malware",
        "possible",
        "win32",
        "updater",
        "write",
        "next",
        "found",
        "ip address",
        "domain",
        "name servers",
        "unknown ns",
        "ip whois",
        "registrar",
        "cloudflare",
        "title",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as14618",
        "bq dec",
        "virtool",
        "backdoor",
        "checkin",
        "ipv4 add",
        "trojan",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "unknown",
        "show",
        "internal",
        "encrypt",
        "veailmboprd",
        "dns query",
        "wow64",
        "gecko http",
        "entries",
        "medium",
        "ransom",
        "khtml",
        "gecko",
        "delete",
        "installer",
        "win32cve may",
        "america flag",
        "overview ip",
        "asn as20940",
        "expiration",
        "url https",
        "no expiration",
        "url http",
        "pulse show",
        "type indicator",
        "role title",
        "related pulses",
        "record value",
        "domain xn"
      ],
      "references": [
        "HTTPS://BeeLineRouter.Net",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://appleid.xn--appe-70a.com/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://vgt.pl/r.n%20-",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "queryfoundry.net",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "GandCrab Ransomware",
          "display_name": "GandCrab Ransomware",
          "target": null
        },
        {
          "id": "Win.Virus.Expiro",
          "display_name": "Win.Virus.Expiro",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "domain": 1049,
        "URL": 5839,
        "hostname": 1944,
        "FileHash-SHA256": 3634,
        "FileHash-MD5": 310,
        "FileHash-SHA1": 295,
        "CVE": 2,
        "email": 15,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13090,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 143,
      "modified_text": "107 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69314920e287845f6b36a265",
      "name": "BeeLineRouter.Net  \u2022 Apple Access",
      "description": "",
      "modified": "2026-01-03T07:00:45.529000",
      "created": "2025-12-04T08:41:04.190000",
      "tags": [
        "mitre att",
        "network traffic",
        "ck id",
        "show technique",
        "ck matrix",
        "threat score",
        "december",
        "default browser",
        "guest system",
        "united",
        "dynadot inc",
        "name server",
        "contacted hosts",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "ascii text",
        "pattern match",
        "show process",
        "t1071",
        "general",
        "local",
        "path",
        "click",
        "beelinerouter",
        "access",
        "router",
        "apple",
        "regopenkeyexw",
        "regsz",
        "process32nextw",
        "english",
        "post http",
        "search",
        "observed dns",
        "query",
        "sinkhole cookie",
        "malware",
        "possible",
        "win32",
        "updater",
        "write",
        "next",
        "found",
        "ip address",
        "domain",
        "name servers",
        "unknown ns",
        "ip whois",
        "registrar",
        "cloudflare",
        "title",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as14618",
        "bq dec",
        "virtool",
        "backdoor",
        "checkin",
        "ipv4 add",
        "trojan",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "unknown",
        "show",
        "internal",
        "encrypt",
        "veailmboprd",
        "dns query",
        "wow64",
        "gecko http",
        "entries",
        "medium",
        "ransom",
        "khtml",
        "gecko",
        "delete",
        "installer",
        "win32cve may",
        "america flag",
        "overview ip",
        "asn as20940",
        "expiration",
        "url https",
        "no expiration",
        "url http",
        "pulse show",
        "type indicator",
        "role title",
        "related pulses",
        "record value",
        "domain xn"
      ],
      "references": [
        "HTTPS://BeeLineRouter.Net",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://appleid.xn--appe-70a.com/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://vgt.pl/r.n%20-",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "queryfoundry.net",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "GandCrab Ransomware",
          "display_name": "GandCrab Ransomware",
          "target": null
        },
        {
          "id": "Win.Virus.Expiro",
          "display_name": "Win.Virus.Expiro",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 3,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 310,
        "FileHash-SHA1": 295,
        "FileHash-SHA256": 3634,
        "URL": 5839,
        "CVE": 2,
        "domain": 1048,
        "email": 15,
        "hostname": 1944,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13089,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 145,
      "modified_text": "107 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "69314926519256e3ef0a9358",
      "name": "BeeLineRouter.Net  \u2022 Apple Access",
      "description": "",
      "modified": "2026-01-03T07:00:45.529000",
      "created": "2025-12-04T08:41:06.657000",
      "tags": [
        "mitre att",
        "network traffic",
        "ck id",
        "show technique",
        "ck matrix",
        "threat score",
        "december",
        "default browser",
        "guest system",
        "united",
        "dynadot inc",
        "name server",
        "contacted hosts",
        "process details",
        "windir",
        "openurl c",
        "prefetch2",
        "learn",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "command",
        "spawns",
        "access att",
        "t1566 phishing",
        "ascii text",
        "pattern match",
        "show process",
        "t1071",
        "general",
        "local",
        "path",
        "click",
        "beelinerouter",
        "access",
        "router",
        "apple",
        "regopenkeyexw",
        "regsz",
        "process32nextw",
        "english",
        "post http",
        "search",
        "observed dns",
        "query",
        "sinkhole cookie",
        "malware",
        "possible",
        "win32",
        "updater",
        "write",
        "next",
        "found",
        "ip address",
        "domain",
        "name servers",
        "unknown ns",
        "ip whois",
        "registrar",
        "cloudflare",
        "title",
        "passive dns",
        "urls",
        "files",
        "location united",
        "asn as14618",
        "bq dec",
        "virtool",
        "backdoor",
        "checkin",
        "ipv4 add",
        "trojan",
        "dynamicloader",
        "msie",
        "windows nt",
        "slcc2",
        "media center",
        "unknown",
        "show",
        "internal",
        "encrypt",
        "veailmboprd",
        "dns query",
        "wow64",
        "gecko http",
        "entries",
        "medium",
        "ransom",
        "khtml",
        "gecko",
        "delete",
        "installer",
        "win32cve may",
        "america flag",
        "overview ip",
        "asn as20940",
        "expiration",
        "url https",
        "no expiration",
        "url http",
        "pulse show",
        "type indicator",
        "role title",
        "related pulses",
        "record value",
        "domain xn"
      ],
      "references": [
        "HTTPS://BeeLineRouter.Net",
        "eta-apple.com \u2022 006.ts.apple.com \u2022 012.ts.apple.com",
        "https://appleid.xn--appe-70a.com/",
        "https://hybrid-analysis.com/sample/87ee92129f42f32417ae21cab1a2bc98adc48ee692a20e1ab3c5277d67dd12e5/69312056ce09855ecd0e3069",
        "https://wallpapers-nature.com/tsara-brashears/urlscan-io",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears-denies-jeffrey-scott-reimer-sex",
        "http://www.anyxxxtube.net/search-porn/tsara-brashears/",
        "https://www.sweetheartvideo.com/tsara-brashears",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian",
        "http://vgt.pl/r.n%20-",
        "8-25-220-162-static.reverse.queryfoundry.net",
        "queryfoundry.net",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://117-114-251-162-static.reverse.queryfoundry.net/",
        "http://81-26-68-38-static.reverse.queryfoundry.net/",
        "http://68-178-128-104-static.reverse.queryfoundry.net/",
        "0-209-98-172-static.reverse.queryfoundry.net",
        "154-143-182-107-static.reverse.queryfoundry.net",
        "http://51-235-245-104-static.reverse.queryfoundry.net/",
        "167-16-68-38-static.reverse.queryfoundry.net",
        "http://49-116-251-162-static.reverse.queryfoundry./net/",
        "177-231-69-38-static.reverse.queryfoundry.net",
        "http://36-243-60-103-static.reverse.queryfoundry.net/",
        "http://237-189-251-104-static.reverse.queryfoundry.net/",
        "http://227-98-248-162-static.reverse.queryfoundry.net/",
        "237-189-251-104-static.reverse.queryfoundry.net",
        "http://207-214-98-172-static.reverse.queryfoundry.net/",
        "181-135-182-107-static.reverse.queryfoundry.net",
        "http://201-191-251-104-static.reverse.queryfoundry.net/",
        "67-228-69-38-static.reverse.queryfoundry.net",
        "http://0-209-98-172-static.reverse.queryfoundry.net/",
        "http://10-241-60-103-static.reverse.queryfoundry.net/",
        "http://142-232-245-104-static.reverse.queryfoundry.net/",
        "http://154-143-182-107-static.reverse.queryfoundry.net/",
        "http://167-16-68-38-static.reverse.queryfoundry.net/",
        "http://177-231-69-38-static.reverse.queryfoundry.net/",
        "http://181-135-182-107-static.reverse.queryfoundry.net/",
        "http://195-214-98-172-static.reverse.queryfoundry.net/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Simda",
          "display_name": "Simda",
          "target": null
        },
        {
          "id": "MyDoom",
          "display_name": "MyDoom",
          "target": null
        },
        {
          "id": "GandCrab Ransomware",
          "display_name": "GandCrab Ransomware",
          "target": null
        },
        {
          "id": "Win.Virus.Expiro",
          "display_name": "Win.Virus.Expiro",
          "target": null
        },
        {
          "id": "Other Malware",
          "display_name": "Other Malware",
          "target": null
        },
        {
          "id": "#VirTool:Win32/Obfuscator.ADB",
          "display_name": "#VirTool:Win32/Obfuscator.ADB",
          "target": "/malware/#VirTool:Win32/Obfuscator.ADB"
        }
      ],
      "attack_ids": [
        {
          "id": "T1204",
          "name": "User Execution",
          "display_name": "T1204 - User Execution"
        },
        {
          "id": "T1566",
          "name": "Phishing",
          "display_name": "T1566 - Phishing"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1113",
          "name": "Screen Capture",
          "display_name": "T1113 - Screen Capture"
        },
        {
          "id": "T1012",
          "name": "Query Registry",
          "display_name": "T1012 - Query Registry"
        },
        {
          "id": "T1045",
          "name": "Software Packing",
          "display_name": "T1045 - Software Packing"
        },
        {
          "id": "T1082",
          "name": "System Information Discovery",
          "display_name": "T1082 - System Information Discovery"
        },
        {
          "id": "T1119",
          "name": "Automated Collection",
          "display_name": "T1119 - Automated Collection"
        },
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        },
        {
          "id": "T1063",
          "name": "Security Software Discovery",
          "display_name": "T1063 - Security Software Discovery"
        },
        {
          "id": "T1053",
          "name": "Scheduled Task/Job",
          "display_name": "T1053 - Scheduled Task/Job"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 6,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 310,
        "FileHash-SHA1": 295,
        "FileHash-SHA256": 3634,
        "URL": 5839,
        "CVE": 2,
        "domain": 1048,
        "email": 15,
        "hostname": 1944,
        "SSLCertFingerprint": 2
      },
      "indicator_count": 13089,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 146,
      "modified_text": "107 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "692fdb10627488a886ec6f8f",
      "name": "Apple \u2022 Gamarue | Fully compromised iOS | Ahmanm , Tulach , Sabey and ?",
      "description": "Device testing. Calling Apple : scam pop ups, apple advisors ,emails, screen shares. Calling : State and Government offices : scam receptionists , investigators, dropped calls, connect without ringing. Calling businesses: routed to scam to scammers. | Apps : all fake. random data. \n\nAligned with same attackers listed. Indicator deletion and attorney caught hijacking. \n\nCannot open LevelBlue Indicators on affected. device. Device can create a mini pulse. \n,",
      "modified": "2026-01-02T05:01:36.144000",
      "created": "2025-12-03T06:39:12.995000",
      "tags": [
        "united",
        "servers",
        "data upload",
        "extraction",
        "sc data",
        "boot",
        "techniques none",
        "modules",
        "logon autostart",
        "execu",
        "privilege",
        "process",
        "evasion",
        "search",
        "info",
        "techniques low",
        "execution flow",
        "injection",
        "apple",
        "rootkit",
        "hybrid analysis",
        "click",
        "windir",
        "openurl c",
        "prefetch2",
        "analysis",
        "tor analysis",
        "ip address",
        "process details",
        "learn",
        "ck id",
        "name tactics",
        "suspicious",
        "informative",
        "adversaries",
        "spawns",
        "command",
        "found",
        "defense evasion",
        "a061s.exe",
        "tulach",
        "christopher p ahmanm",
        "passive dns",
        "urls",
        "url add",
        "http",
        "files domain",
        "files related",
        "pulses otx",
        "virustotal",
        "foundry",
        "helix",
        "mapkit",
        "hacking",
        "denver",
        "retaliation",
        "redirect",
        "no server",
        "reroute",
        "scammers",
        "coconut island",
        "brain sabey",
        "dns requests",
        "domain address",
        "contacted hosts",
        "t1480 execution",
        "file defense"
      ],
      "references": [
        "getsupport.apple.com\t \u2022 apple.com",
        "Matches rule Registry Modification to Hidden File Extension by frack113",
        "Matches rule Msiexec Initiated Connection by frack113",
        "Matches rule Creation of an Executable by an Executable by frack113",
        "Matches rule CurrentVersion Autorun Keys Modification by Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)",
        "Matches rule SERVER-OTHER Squid HTTP Vary response header denial of service attempt",
        "Tulach \u2022 114.114.114.114",
        "http://foundry2-lbl.dvr.dn2.n-helix.com"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Trojan/Win32.Gamarue.C1976125",
          "display_name": "Trojan/Win32.Gamarue.C1976125",
          "target": null
        },
        {
          "id": "Trojan.GenericKDZ.93839",
          "display_name": "Trojan.GenericKDZ.93839",
          "target": null
        },
        {
          "id": "Tulach Malware",
          "display_name": "Tulach Malware",
          "target": null
        },
        {
          "id": "Trojan.MyDoom/Mudrop",
          "display_name": "Trojan.MyDoom/Mudrop",
          "target": null
        },
        {
          "id": "Trojan.Win.Small",
          "display_name": "Trojan.Win.Small",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1055",
          "name": "Process Injection",
          "display_name": "T1055 - Process Injection"
        },
        {
          "id": "T1129",
          "name": "Shared Modules",
          "display_name": "T1129 - Shared Modules"
        },
        {
          "id": "T1547",
          "name": "Boot or Logon Autostart Execution",
          "display_name": "T1547 - Boot or Logon Autostart Execution"
        },
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        },
        {
          "id": "T1070",
          "name": "Indicator Removal on Host",
          "display_name": "T1070 - Indicator Removal on Host"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1023",
          "name": "Shortcut Modification",
          "display_name": "T1023 - Shortcut Modification"
        },
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1401",
          "name": "Device Administrator Permissions",
          "display_name": "T1401 - Device Administrator Permissions"
        },
        {
          "id": "T1147",
          "name": "Hidden Users",
          "display_name": "T1147 - Hidden Users"
        },
        {
          "id": "T1408",
          "name": "Disguise Root/Jailbreak Indicators",
          "display_name": "T1408 - Disguise Root/Jailbreak Indicators"
        },
        {
          "id": "T1014",
          "name": "Rootkit",
          "display_name": "T1014 - Rootkit"
        },
        {
          "id": "T1036.004",
          "name": "Masquerade Task or Service",
          "display_name": "T1036.004 - Masquerade Task or Service"
        },
        {
          "id": "T1036",
          "name": "Masquerading",
          "display_name": "T1036 - Masquerading"
        },
        {
          "id": "T1155",
          "name": "AppleScript",
          "display_name": "T1155 - AppleScript"
        },
        {
          "id": "TA0037",
          "name": "Command and Control",
          "display_name": "TA0037 - Command and Control"
        },
        {
          "id": "TA0008",
          "name": "Lateral Movement",
          "display_name": "TA0008 - Lateral Movement"
        },
        {
          "id": "T1430",
          "name": "Location Tracking",
          "display_name": "T1430 - Location Tracking"
        },
        {
          "id": "T1529",
          "name": "System Shutdown/Reboot",
          "display_name": "T1529 - System Shutdown/Reboot"
        },
        {
          "id": "T1542.003",
          "name": "Bootkit",
          "display_name": "T1542.003 - Bootkit"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1069",
          "name": "Permission Groups Discovery",
          "display_name": "T1069 - Permission Groups Discovery"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1480",
          "name": "Execution Guardrails",
          "display_name": "T1480 - Execution Guardrails"
        },
        {
          "id": "T1568",
          "name": "Dynamic Resolution",
          "display_name": "T1568 - Dynamic Resolution"
        },
        {
          "id": "T1410",
          "name": "Network Traffic Capture or Redirection",
          "display_name": "T1410 - Network Traffic Capture or Redirection"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1454",
          "name": "Malicious SMS Message",
          "display_name": "T1454 - Malicious SMS Message"
        }
      ],
      "industries": [
        "Telecommunications"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Q.Vashti",
        "id": "337942",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "hostname": 413,
        "FileHash-MD5": 14,
        "FileHash-SHA1": 4,
        "URL": 1321,
        "domain": 219,
        "email": 3,
        "FileHash-SHA256": 696
      },
      "indicator_count": 2670,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 138,
      "modified_text": "108 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6821389e9d03972dacbb9582",
      "name": "False Executable for MS Windows SHA1-20b60961f5d2eb274cd5e6526ea6c621c60cc36c",
      "description": "https://sandbox.ti.qianxin.com/sandbox/page/detail?type=file&id=AZbBwVWDONZSmF3-AVdH&env=Windows%2010%20x64&time=4&sha1=20b60961f5d2eb274cd5e6526ea6c621c60cc36c\n PE32 Executable for MS Windows (EXE)\nResearchers have worked out how to store the data in a single file - and how much it takes to do it - using SHA1 and C3.. and 2.5 million characters.-",
      "modified": "2025-10-01T00:01:22.860000",
      "created": "2025-05-11T23:54:06.106000",
      "tags": [
        "sha1",
        "sha256",
        "sha512",
        "crc32",
        "ssdeep",
        "size",
        "file type",
        "pe32 executable",
        "ms windows",
        "win32 dynamic"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 2,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "Arek-BTC",
        "id": "212764",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_212764/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 1,
        "FileHash-SHA1": 1,
        "FileHash-SHA256": 122,
        "IPv4": 8,
        "domain": 29,
        "hostname": 65,
        "URL": 118
      },
      "indicator_count": 344,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 123,
      "modified_text": "201 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65b93e70b75e7dce7168f4dd",
      "name": "Google - Lumma Stealer| QakBot | Emotet",
      "description": "Lumma is classified as a stealer - a type of malware that extracts sensitive information from infected devices.\n\nYou can't see it. You will see https://www.google.com and your search. It's hidden spyware. extremely malicious. Targeted individual.",
      "modified": "2024-02-29T17:01:09.717000",
      "created": "2024-01-30T18:22:40.905000",
      "tags": [
        "ssl certificate",
        "whois record",
        "threat roundup",
        "contacted",
        "historical ssl",
        "referrer",
        "urls url",
        "whois whois",
        "october",
        "resolutions",
        "august",
        "execution",
        "installer",
        "iframe",
        "malware",
        "core",
        "emotet",
        "lumma stealer",
        "ransomexx",
        "azorult",
        "ursnif",
        "hacktool",
        "june",
        "qakbot",
        "qbot",
        "april",
        "targeting",
        "tsara brashears",
        "active threat"
      ],
      "references": [
        "google.com.uy [Google search browser, masked, links to malicious porn malware spreader, malvertizing, collection host]",
        "https://www.pornhub.com/gifs/search?search=tsara+lynn+brashears+lesbian [ iOS unlocker & password cracker]",
        "toolbarqueries.google.com.uy"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [
        "United States of America"
      ],
      "malware_families": [
        {
          "id": "Lumma Stealer",
          "display_name": "Lumma Stealer",
          "target": null
        },
        {
          "id": "HackTool",
          "display_name": "HackTool",
          "target": null
        },
        {
          "id": "Emotet",
          "display_name": "Emotet",
          "target": null
        },
        {
          "id": "Azorult",
          "display_name": "Azorult",
          "target": null
        },
        {
          "id": "RansomEXX",
          "display_name": "RansomEXX",
          "target": null
        },
        {
          "id": "QakBot",
          "display_name": "QakBot",
          "target": null
        },
        {
          "id": "Qbot",
          "display_name": "Qbot",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1068",
          "name": "Exploitation for Privilege Escalation",
          "display_name": "T1068 - Exploitation for Privilege Escalation"
        },
        {
          "id": "T1027",
          "name": "Obfuscated Files or Information",
          "display_name": "T1027 - Obfuscated Files or Information"
        },
        {
          "id": "T1105",
          "name": "Ingress Tool Transfer",
          "display_name": "T1105 - Ingress Tool Transfer"
        },
        {
          "id": "T1057",
          "name": "Process Discovery",
          "display_name": "T1057 - Process Discovery"
        },
        {
          "id": "T1449",
          "name": "Exploit SS7 to Redirect Phone Calls/SMS",
          "display_name": "T1449 - Exploit SS7 to Redirect Phone Calls/SMS"
        },
        {
          "id": "T1583.005",
          "name": "Botnet",
          "display_name": "T1583.005 - Botnet"
        },
        {
          "id": "T1031",
          "name": "Modify Existing Service",
          "display_name": "T1031 - Modify Existing Service"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1071.003",
          "name": "Mail Protocols",
          "display_name": "T1071.003 - Mail Protocols"
        },
        {
          "id": "TA0002",
          "name": "Execution",
          "display_name": "TA0002 - Execution"
        },
        {
          "id": "TA0003",
          "name": "Persistence",
          "display_name": "TA0003 - Persistence"
        },
        {
          "id": "TA0004",
          "name": "Privilege Escalation",
          "display_name": "TA0004 - Privilege Escalation"
        },
        {
          "id": "TA0005",
          "name": "Defense Evasion",
          "display_name": "TA0005 - Defense Evasion"
        },
        {
          "id": "TA0006",
          "name": "Credential Access",
          "display_name": "TA0006 - Credential Access"
        },
        {
          "id": "TA0007",
          "name": "Discovery",
          "display_name": "TA0007 - Discovery"
        },
        {
          "id": "TA0009",
          "name": "Collection",
          "display_name": "TA0009 - Collection"
        },
        {
          "id": "T1030",
          "name": "Data Transfer Size Limits",
          "display_name": "T1030 - Data Transfer Size Limits"
        },
        {
          "id": "TA0010",
          "name": "Exfiltration",
          "display_name": "TA0010 - Exfiltration"
        },
        {
          "id": "TA0011",
          "name": "Command and Control",
          "display_name": "TA0011 - Command and Control"
        }
      ],
      "industries": [
        "Civil Society"
      ],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 1,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 50,
        "FileHash-SHA1": 46,
        "FileHash-SHA256": 3377,
        "hostname": 2502,
        "URL": 8531,
        "domain": 1250,
        "CVE": 2
      },
      "indicator_count": 15758,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 220,
      "modified_text": "780 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597f9c7542ffc6fffaecb30",
      "name": "Injection (RunPE) |Win.Packer - https://myminiweb.com",
      "description": "polypragmonic, dns, win.packer, ig hacking, network bind, tracking",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:44:55.030000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 222,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597fa4d4b5e060fb8a606a8",
      "name": "Botnet Campaign",
      "description": "",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:47:09.403000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6597f9c7542ffc6fffaecb30",
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6597fa4da16bd99cc5c02528",
      "name": "Botnet Campaign",
      "description": "",
      "modified": "2024-02-04T12:05:19.275000",
      "created": "2024-01-05T12:47:09.406000",
      "tags": [
        "ciphersuite",
        "delete c",
        "search",
        "entries",
        "united",
        "stcalifornia",
        "lmenlo park",
        "ometa platforms",
        "odigicert inc",
        "cndigicert sha2",
        "copy",
        "write",
        "unknown",
        "no expiration",
        "expiration",
        "filehashsha256",
        "hostname",
        "domain",
        "ipv4",
        "url http",
        "url https",
        "filehashmd5",
        "filehashsha1",
        "next",
        "iocs",
        "pdf report",
        "pcap",
        "scan endpoints",
        "win64",
        "stix",
        "openioc",
        "enter",
        "ssl certificate",
        "whois record",
        "apple ios",
        "communicating",
        "referrer",
        "contacted",
        "resolutions",
        "threat roundup",
        "password",
        "networks",
        "hacktool",
        "crypto",
        "twitter",
        "june",
        "probe",
        "ransomware",
        "malware",
        "tsara brashears",
        "botnet campaign",
        "january",
        "content reputation",
        "et"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Content Reputation",
          "display_name": "Content Reputation",
          "target": null
        },
        {
          "id": "ET",
          "display_name": "ET",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1060",
          "name": "Registry Run Keys / Startup Folder",
          "display_name": "T1060 - Registry Run Keys / Startup Folder"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": "6597f9c7542ffc6fffaecb30",
      "export_count": 18,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2469,
        "FileHash-SHA1": 2295,
        "FileHash-SHA256": 4925,
        "SSLCertFingerprint": 2,
        "URL": 4484,
        "domain": 2044,
        "hostname": 2375,
        "email": 18,
        "CVE": 4
      },
      "indicator_count": 18616,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 221,
      "modified_text": "806 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "653e9147fc170101be4f7afe",
      "name": "CNC | Malicious activities. | aig.com [lacks http/https]",
      "description": "My input: unsigned, evasive,Trojan:Win32/Danabot.G, missing STSH, CNC, phishing, trojans, scanning host, exploit host. \n\n\n[Auto populated: Last DNS records are held by a single person, and they are not the same as the previous records, which were posted in the early 1990s and early 2000s, according to the US government.]",
      "modified": "2023-11-28T16:01:50.761000",
      "created": "2023-10-29T17:07:19.371000",
      "tags": [
        "ssl certificate",
        "whois record",
        "communicating",
        "contacted",
        "threat roundup",
        "referrer",
        "october",
        "historical ssl",
        "june",
        "august",
        "execution",
        "quasar",
        "metro",
        "android",
        "djvu",
        "qakbot",
        "qbot",
        "april",
        "skynet",
        "crypto",
        "awful",
        "record type",
        "ttl value",
        "algorithm",
        "data",
        "v3 serial",
        "number",
        "cus ou",
        "entrust",
        "oentrust",
        "l1k validity",
        "lnew york",
        "group",
        "info",
        "domain status",
        "server",
        "date",
        "registrar abuse",
        "new york",
        "postal code",
        "contact phone",
        "registrar url",
        "csc corporate",
        "domains",
        "code",
        "microsoft",
        "dns replication",
        "full name",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "first",
        "iana id",
        "registrar whois",
        "win32 exe",
        "files",
        "detections type",
        "name"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [
        {
          "id": "T1140",
          "name": "Deobfuscate/Decode Files or Information",
          "display_name": "T1140 - Deobfuscate/Decode Files or Information"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 27,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "URL": 4115,
        "FileHash-MD5": 250,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 2692,
        "domain": 665,
        "hostname": 1448,
        "CVE": 1,
        "email": 3
      },
      "indicator_count": 9418,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "873 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://cdn.gearstactics.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://cdn.gearstactics.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776700683.8168757
}