{ "type": "URL", "indicator": "https://cdn.server-ads.com", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://cdn.server-ads.com", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 4154664287, "indicator": "https://cdn.server-ads.com", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 1, "pulses": [ { "id": "6928a811eb762bc06b190c7e", "name": "Frosted -> Candace Owens | The Targeted need the help od Honest people. HELP!", "description": "Candace Owens has become more visible to me because of tips , the targeted community, and research by watching to determine the legitimacy of her incredible claims.They sound outrageously familiar. She is a provocateur. She has evidence based on some of the episodes I\u2019ve been encouraged to review..\n\nI\u2019m ringing the bell.\n\nCandace Owens isn\u2019t a deranged conspiracy theorist. She is an intelligent, intuitive, beautiful African American woman that people are turning there back on. The most likely to be attacked, have your back or be dismissed are women, esp., black woman & other women of color. \n\nCandace Owens is openly not a fan of Palantir agenda, J. S. \u2018Vance\u2019 Hamill , The \u2018Gaza Strip Billionaire getaway\u2019, the murde of Palestinians. \n\nShe\u2019s been critical re: of Palantirs expanding government contracts, surveillance viewing them as potentially nefarious or being too embedded within federal power structures. \n\nThey (Palantir)don\u2019t like it.\n#Palantir #NotLikeUs #BillionaireBoysClub #MassMurders", "modified": "2025-11-27T19:35:45.769000", "created": "2025-11-27T19:35:45.769000", "tags": [ "extraction", "sc type", "data upload", "idro anv", "extr data", "active", "malware attacks", "find encrypted", "pom", "win32", "win64", "trojan", "families", "win32clipbanker", "detections et", "susp", "alfper", "ransom", "capture", "singapore", "china", "united", "france", "sweden", "Candace Owens", "Palantir", "The List", "True" ], "references": [ "https://candaceowens.com/", "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg", "InstallCore ET Malware | Candace Owens \u2022 https://otx.alienvault.com/pulse/6927ed9849e14dfc59441aba", "Tucker Carlson Pulse : https://otx.alienvault.com/pulse/68c73fbd85dfbb4d41006ad1", "https://ebsc-ibm.palantircloud.com", "Crazy Frost \u2018hacker\u2019 https://otx.alienvault.com/pulse/692897a64c0e255409b5a67e", "Typo God not His of the Bible is Bigger. Faith without works irks dead though", "No one is immune from the wrath of Palantir. Race or gender doesn\u2019t matter.", "If Dylan Klebold & Eric Harris lived they might think up a business like Palantir." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker", "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker", "target": null }, { "id": "Trojan:Win32/Meterpreter.O", "display_name": "Trojan:Win32/Meterpreter.O", "target": "/malware/Trojan:Win32/Meterpreter.O" }, { "id": "Trojan:Win32/Spiliwan.A", "display_name": "Trojan:Win32/Spiliwan.A", "target": "/malware/Trojan:Win32/Spiliwan.A" }, { "id": "ALF:Trojan:Win32/Cassini_ade36583!ibt", "display_name": "ALF:Trojan:Win32/Cassini_ade36583!ibt", "target": null }, { "id": "Trojandropper:Win32/BcryptInject.B!MSR", "display_name": "Trojandropper:Win32/BcryptInject.B!MSR", "target": "/malware/Trojandropper:Win32/BcryptInject.B!MSR" }, { "id": "Win.Trojan.Autoit-6996111-0", "display_name": "Win.Trojan.Autoit-6996111-0", "target": null }, { "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "target": null }, { "id": "Trojandownloader:Win32/Cutwail.BA", "display_name": "Trojandownloader:Win32/Cutwail.BA", "target": "/malware/Trojandownloader:Win32/Cutwail.BA" }, { "id": "Trojan:Win32/Dorv.A", "display_name": "Trojan:Win32/Dorv.A", "target": "/malware/Trojan:Win32/Dorv.A" }, { "id": "Trojan:Win32/Danabot.G", "display_name": "Trojan:Win32/Danabot.G", "target": "/malware/Trojan:Win32/Danabot.G" }, { "id": "ET Malware", "display_name": "ET Malware", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Media", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 566, "domain": 16, "hostname": 281, "FileHash-SHA256": 245, "FileHash-MD5": 228, "FileHash-SHA1": 223 }, "indicator_count": 1559, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "143 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "No one is immune from the wrath of Palantir. Race or gender doesn\u2019t matter.", "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg", "InstallCore ET Malware | Candace Owens \u2022 https://otx.alienvault.com/pulse/6927ed9849e14dfc59441aba", "If Dylan Klebold & Eric Harris lived they might think up a business like Palantir.", "https://candaceowens.com/", "Crazy Frost \u2018hacker\u2019 https://otx.alienvault.com/pulse/692897a64c0e255409b5a67e", "Tucker Carlson Pulse : https://otx.alienvault.com/pulse/68c73fbd85dfbb4d41006ad1", "https://ebsc-ibm.palantircloud.com", "Typo God not His of the Bible is Bigger. Faith without works irks dead though" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [], "malware_families": [ "Win.trojan.autoit-6996111-0", "Trojan:win32/dorv.a", "Et malware", "Trojandownloader:win32/cutwail.ba", "Trojan:win32/spiliwan.a", "Trojan:win32/meterpreter.o", "Alf:trojan:win32/cassini_ade36583!ibt", "Alf:heraklezeval:trojan:msil/gravityrat!rfn", "Alf:heraklezeval:trojan:win32/clipbanker", "Trojan:win32/danabot.g", "Trojandropper:win32/bcryptinject.b!msr" ], "industries": [ "Civil society", "Media" ], "unique_indicators": 1559 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/server-ads.com", "whois": "http://whois.domaintools.com/server-ads.com", "domain": "server-ads.com", "hostname": "cdn.server-ads.com" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 1, "pulses": [ { "id": "6928a811eb762bc06b190c7e", "name": "Frosted -> Candace Owens | The Targeted need the help od Honest people. HELP!", "description": "Candace Owens has become more visible to me because of tips , the targeted community, and research by watching to determine the legitimacy of her incredible claims.They sound outrageously familiar. She is a provocateur. She has evidence based on some of the episodes I\u2019ve been encouraged to review..\n\nI\u2019m ringing the bell.\n\nCandace Owens isn\u2019t a deranged conspiracy theorist. She is an intelligent, intuitive, beautiful African American woman that people are turning there back on. The most likely to be attacked, have your back or be dismissed are women, esp., black woman & other women of color. \n\nCandace Owens is openly not a fan of Palantir agenda, J. S. \u2018Vance\u2019 Hamill , The \u2018Gaza Strip Billionaire getaway\u2019, the murde of Palestinians. \n\nShe\u2019s been critical re: of Palantirs expanding government contracts, surveillance viewing them as potentially nefarious or being too embedded within federal power structures. \n\nThey (Palantir)don\u2019t like it.\n#Palantir #NotLikeUs #BillionaireBoysClub #MassMurders", "modified": "2025-11-27T19:35:45.769000", "created": "2025-11-27T19:35:45.769000", "tags": [ "extraction", "sc type", "data upload", "idro anv", "extr data", "active", "malware attacks", "find encrypted", "pom", "win32", "win64", "trojan", "families", "win32clipbanker", "detections et", "susp", "alfper", "ransom", "capture", "singapore", "china", "united", "france", "sweden", "Candace Owens", "Palantir", "The List", "True" ], "references": [ "https://candaceowens.com/", "http://www.crazyfrost.com/wp-content/uploads/2011/01/%D0%BA%D0%BE%D0%BB%D0%BB%D0%B0%D0%B68.jpg", "InstallCore ET Malware | Candace Owens \u2022 https://otx.alienvault.com/pulse/6927ed9849e14dfc59441aba", "Tucker Carlson Pulse : https://otx.alienvault.com/pulse/68c73fbd85dfbb4d41006ad1", "https://ebsc-ibm.palantircloud.com", "Crazy Frost \u2018hacker\u2019 https://otx.alienvault.com/pulse/692897a64c0e255409b5a67e", "Typo God not His of the Bible is Bigger. Faith without works irks dead though", "No one is immune from the wrath of Palantir. Race or gender doesn\u2019t matter.", "If Dylan Klebold & Eric Harris lived they might think up a business like Palantir." ], "public": 1, "adversary": "", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "ALF:HeraklezEval:Trojan:Win32/ClipBanker", "display_name": "ALF:HeraklezEval:Trojan:Win32/ClipBanker", "target": null }, { "id": "Trojan:Win32/Meterpreter.O", "display_name": "Trojan:Win32/Meterpreter.O", "target": "/malware/Trojan:Win32/Meterpreter.O" }, { "id": "Trojan:Win32/Spiliwan.A", "display_name": "Trojan:Win32/Spiliwan.A", "target": "/malware/Trojan:Win32/Spiliwan.A" }, { "id": "ALF:Trojan:Win32/Cassini_ade36583!ibt", "display_name": "ALF:Trojan:Win32/Cassini_ade36583!ibt", "target": null }, { "id": "Trojandropper:Win32/BcryptInject.B!MSR", "display_name": "Trojandropper:Win32/BcryptInject.B!MSR", "target": "/malware/Trojandropper:Win32/BcryptInject.B!MSR" }, { "id": "Win.Trojan.Autoit-6996111-0", "display_name": "Win.Trojan.Autoit-6996111-0", "target": null }, { "id": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "display_name": "ALF:HeraklezEval:Trojan:MSIL/Gravityrat!rfn", "target": null }, { "id": "Trojandownloader:Win32/Cutwail.BA", "display_name": "Trojandownloader:Win32/Cutwail.BA", "target": "/malware/Trojandownloader:Win32/Cutwail.BA" }, { "id": "Trojan:Win32/Dorv.A", "display_name": "Trojan:Win32/Dorv.A", "target": "/malware/Trojan:Win32/Dorv.A" }, { "id": "Trojan:Win32/Danabot.G", "display_name": "Trojan:Win32/Danabot.G", "target": "/malware/Trojan:Win32/Danabot.G" }, { "id": "ET Malware", "display_name": "ET Malware", "target": null } ], "attack_ids": [ { "id": "T1012", "name": "Query Registry", "display_name": "T1012 - Query Registry" }, { "id": "T1023", "name": "Shortcut Modification", "display_name": "T1023 - Shortcut Modification" }, { "id": "T1040", "name": "Network Sniffing", "display_name": "T1040 - Network Sniffing" }, { "id": "T1045", "name": "Software Packing", "display_name": "T1045 - Software Packing" }, { "id": "T1053", "name": "Scheduled Task/Job", "display_name": "T1053 - Scheduled Task/Job" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1057", "name": "Process Discovery", "display_name": "T1057 - Process Discovery" }, { "id": "T1060", "name": "Registry Run Keys / Startup Folder", "display_name": "T1060 - Registry Run Keys / Startup Folder" }, { "id": "T1063", "name": "Security Software Discovery", "display_name": "T1063 - Security Software Discovery" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1129", "name": "Shared Modules", "display_name": "T1129 - Shared Modules" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1143", "name": "Hidden Window", "display_name": "T1143 - Hidden Window" }, { "id": "T1204", "name": "User Execution", "display_name": "T1204 - User Execution" } ], "industries": [ "Media", "Civil Society" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 566, "domain": 16, "hostname": 281, "FileHash-SHA256": 245, "FileHash-MD5": 228, "FileHash-SHA1": 223 }, "indicator_count": 1559, "is_author": false, "is_subscribing": null, "subscriber_count": 138, "modified_text": "143 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://cdn.server-ads.com", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://cdn.server-ads.com", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1776636919.37733 }